Privacy Policy

1. Who we are

Vigilia ("we", "us") is a monitoring service operated by Pablo Matias Perez Piskunow (sole trader, Spain) that watches web applications, explains problems in plain language, and generates fix prompts. This policy explains what data we handle and how. It is written to comply with the GDPR and CCPA.

Vigilia plays two distinct roles: we are the data controller for the information of people who create a Vigilia account, and a data processor for the technical telemetry our monitoring snippet collects from our customers' applications on their behalf.

2. Data we collect from you (account holders)

Account: email address and authentication data, handled by Firebase Authentication (Google). If you sign in with Google, we receive your email from Google.

Apps you register: app name, URL, and the builder tool you use — needed to monitor your app and tailor fix prompts.

Billing: payments are processed by Creem, our merchant of record. We never see or store your card details; we store only your Creem customer reference and subscription status.

Emails we send: incident alerts and (if enabled) a weekly health report, delivered via Resend. You control both in Settings → Notifications.

3. Data our snippet collects from your app's visitors

When you install vigilia.js on your app, it collects technical error telemetry: error messages and stack traces, failed network request URLs and status codes, page URLs, browser/user-agent strings, basic performance metrics, and short "breadcrumb" descriptions of recent interactions (e.g. "clicked 'Pay now'").

Privacy by design: before anything leaves the visitor's browser, the snippet scrubs personal data patterns — email addresses, access tokens, API keys, card-like numbers, phone numbers, IP addresses — and strips query strings from URLs. The same scrubbing runs a second time on our servers. The snippet sets no cookies and does no cross-site tracking; it uses a random per-tab session identifier that is not linked to a person.

Retention: raw events are automatically deleted after ~30 days (database-level TTL). Aggregated error groups and incident diagnoses persist until you delete them or your account.

As the operator of your app, you remain the controller of your visitors' data. We recommend mentioning your use of an error-monitoring service in your own privacy policy.

4. How we use data

To operate the service: detect errors and downtime, group similar errors, and notify you. To generate diagnoses, we send the (scrubbed) error context to Anthropic's Claude API; Anthropic does not train models on this API data. We do not sell data, run ads, or share data with third parties beyond the subprocessors listed below.

5. Subprocessors

Google Cloud / Firebase (hosting, authentication, database — EU multi-region "eur3"), Anthropic (AI diagnosis), Creem (payments, merchant of record), Resend (transactional email).

6. Your rights

Access / portability: Settings → Privacy → "Export my data" downloads everything we hold about your account as JSON.

Erasure: Settings → Privacy → "Delete account" immediately and permanently deletes your account, your apps, all collected events, error groups, incidents, and cancels your subscription.

Rectification / objection / complaints: email us at support@getvigilia.com. EU users may also lodge a complaint with their supervisory authority.

7. Cookies & local storage

The Vigilia dashboard uses Firebase Authentication's local storage to keep you signed in — no advertising or analytics cookies. The monitoring snippet on your app sets no cookies.

8. Changes & contact

We'll update this page when our practices change and note the date above. Questions: support@getvigilia.com. Pablo Matias Perez Piskunow (sole trader, Spain), Carrer de Gorina 4, Sant Cugat del Vallès, Barcelona, Spain 08172.