Privacy Policy

Draft, last updated 6 October 2026.

Who we are

Vigavo (vigavo.com) provides website security scanning, monitoring and database backups. This policy explains what data we process and why. Contact: info@vigavo.com.

Data we process

Account data (email, password hash, settings); scan results for the URLs you submit; connection credentials you give us for backups; the contents of your backups; billing records from our payment provider; feedback you send us.

Purposes

To run scans, monitoring, alerts, backups and restores you request; to send report and account emails; to prevent abuse; and to improve the product with aggregate statistics.

Analytics and cookies

We use first-party cookies only: a session cookie when you sign in, a CSRF protection cookie, your language and theme preference, and a random visitor id (vg_ab) that keeps page experiments consistent and counts page events. These events store no IP address and no email. We use no third-party trackers.

Processors

Backblaze (backup storage, EU), Hetzner (servers, EU), Cloudflare (network, global), Brevo (email, EU), Paddle (payments, UK) and Sentry (error reports, EU/US). Each processes data only to provide their service to us.

Retention

Free scans are deleted after 30 days. Backups are kept for the retention period of your plan. When you delete your account, your data and backups are deleted within 24 hours, except records we must keep by law.

Security and encryption

Connection credentials and backups are encrypted with per-account keys (AES-256-GCM). Backup connections use read-only database users. Access to production is limited and logged.

Your rights

You can access, correct, export or delete your data, and object to processing, by writing to info@vigavo.com. You may also complain to your data protection authority.

Data processing agreement

Business customers can request our data processing agreement (DPA) at info@vigavo.com.

Incidents

If a breach affects your personal data, we will notify you and the competent authority within 72 hours of becoming aware of it.