← VIGIL

Privacy Policy

Last updated: 8 July 2026 · Operator: AZZ&CO LABS, France · legal@vigil-ai.xyz

1. Controller

AZZ&CO LABS (France) is the data controller for https://vigil-ai.xyz. Contact: privacy@vigil-ai.xyz.

2. What we process, and why

  • Account data (email, name, hashed credentials) — to provide the service. Legal basis: contract.
  • Workspace content (documents you upload to the vault, CRM/mail/finance records you connect, meeting transcripts you create) — to provide the features you invoke. Basis: contract.
  • Broker API keys — encrypted at rest (Fernet) and used only to execute the actions you approve. Basis: contract. We never hold your funds.
  • Billing data — handled by Stripe; we store your subscription tier and Stripe customer/subscription identifiers, never card numbers. Basis: contract & legal obligation.
  • Usage & security logs (IP, timestamps, actions) — to secure and improve the service. Basis: legitimate interest.
  • AI processing — your prompts and relevant workspace context are sent to model providers to generate responses. We do not use your content to train models.

3. Processors & transfers

  • Supabase (database & authentication), Vercel (web hosting), Railway (API hosting), OVHcloud (EU — AI runtime), Stripe (payments), Hugging Face & model providers (AI inference), LiveKit (real-time meetings), ElevenLabs (voice synthesis, when used).
  • Where a processor is outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

4. Retention

  • Account & workspace data: for the life of the account, deleted or anonymised within 30 days of account deletion.
  • Billing records: as required by French commercial and tax law (up to 10 years).
  • Security logs: up to 12 months.

5. Your rights

Under the GDPR you may access, rectify, erase, restrict, object, and port your data, and withdraw consent where processing rests on consent. Use the in-app privacy tools (data export & deletion request) or write to privacy@vigil-ai.xyz. You may lodge a complaint with the CNIL (cnil.fr).

6. Security

TLS everywhere, row-level tenant isolation in the database plus route-layer scoping, encrypted secrets, owner-gated outbound actions, and per-order approval for anything that moves money.

7. Mobile app

The VIGIL mobile app is a shell around this same service and processes the same data — no additional device permissions, no advertising identifiers, no third-party ad SDKs, no sale of personal data.