Privacy Policy
Last updated: October 2, 2026
Who we are and how to contact us
DataVigia operates this data security auditing platform. For any privacy matter or to exercise your rights, please contact privacy@datavigia.com or use the contact form on the website. The controller's full identification and address are available on request.
Controller or processor, depending on the data
In relation to website, account and billing data, DataVigia is the data controller. In relation to data from the platforms that the customer connects (Microsoft 365, Google Workspace, on-premises servers) and to the employee data used in training simulations, the customer is the data controller and DataVigia acts as data processor, under the data processing agreement (DPA).
What data we process
Account data (name, email), billing data, contact form messages, training campaign results (who interacted with the tests) and security metadata from connected platforms (permissions, configurations, access logs, file and folder names). We do NOT access the content of customers' files.
Purposes and legal basis
Provision of the service and account management (performance of the contract, Article 6(1)(b)); billing and compliance with accounting and tax obligations (legal obligation, Article 6(1)(c)); platform security and fraud prevention (legitimate interest, Article 6(1)(f)); responding to commercial enquiries (legitimate interest or consent, which you may withdraw at any time). Data from customer platforms is processed in accordance with the customer's instructions, the customer being responsible for ensuring the relevant legal basis.
Who has access and processors
Internal access is limited to strictly necessary staff, subject to confidentiality. We use processors bound by data processing contracts: Supabase (database and hosting, European Union region, Ireland), Vercel (application hosting and delivery), Anthropic (automated report generation in text), Resend (email delivery) and the Microsoft and Google APIs (accessed with the customer's authorisation). The up-to-date list of processors is available on request.
International transfers
Data is hosted in the European Union (Ireland). Some processors process data outside the European Economic Area, for example in the United States. In such cases, appropriate safeguards apply, in accordance with the transfer mechanism valid at the time: the European Commission's Standard Contractual Clauses and, where the processor is certified, the adequacy decision of the EU-US Data Privacy Framework. Andorra benefits from a European Union adequacy decision, so transfers to Andorra do not require additional safeguards.
Retention periods
Account data is retained for the duration of the contract. Billing data is retained for the applicable statutory periods (as a rule, ten years for tax purposes). Security metadata and audit results are retained during the relationship and deleted or returned at its end, save for any legal obligation. Contact messages are retained for as long as necessary to handle them.
Security
Connector credentials are held in an encrypted vault accessible only to the service; each organisation is isolated from the others (Row Level Security); we apply the principle of least privilege, access control and logging, and data minimisation (we do not collect the content of files).
Automated decisions
Reports are produced with the support of automated processing, but are intended to support human decision-making. We do not take decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals, within the meaning of Article 22 GDPR.
Your rights
You have the right to access your data, rectify it, erase it, restrict or object to the processing, to data portability and to withdraw consent. We respond, as a rule, within one month. Where data is processed on behalf of a customer (the data controller), we forward the request to that customer.
Complaints
You may lodge a complaint with the supervisory authority of your country: in Portugal the CNPD, in Spain the AEPD, in France the CNIL and in Andorra the APDA (Agència Andorrana de Protecció de Dades).
Cookies and minors
We use only essential cookies, described in the Cookie Policy. The service is intended for businesses and is not directed at minors.
Changes to this policy
We may update this policy to reflect legal or service changes. We publish the current version on this page, together with its update date.
Email Checker
In Email Checker, users submit messages to assess fraud risk. Subjects, senders, headers, bodies and attachments are processed. Attachments are never executed or sent to the AI provider; configured reputation services may receive hashes. Limited plain text and technical signals may be sent to Anthropic. Files, bodies and detailed reports are deleted from active DataVigia storage after 1–30 days, as configured by the organization (7 days by default). Verdicts and minimal metadata remain for history. Email provider, AI and backup retention follows the applicable contracts and must be reviewed by the organization before activation. Users see their own checks; organization administrators can see all checks. Results are advisory and do not automatically make decisions or delete messages.
Infrastructure and Wi-Fi collector
When enabled and configured by IT, this collector processes device labels, OPNsense rule metadata, names and indicators of Synology shares visible to the account, and Wi-Fi observations for authorized SSIDs (SSID, BSSID, frequency, signal and advertised protection). Only aggregate counts are sent for other networks. No traffic is captured. Local appliance credentials and the registration key remain in a private folder on the customer machine, without additional encryption by the collector; they are not stored in the cloud connector vault. The portal retains only the latest collection per collector, with scheduled deletion after 30 days without updates. The customer defines scope, establishes a legal basis and informs affected people. Revocation prevents new submissions; deletion requests follow the rights procedure in this policy.
Platform security
To protect accounts and data, we record denied access attempts, privilege attribute changes and interactions with inert decoy resources. Records include the authenticated account when identified, event type, route without parameters, timestamps and a pseudonymized IP representation. These records do not include passwords, cookies or request bodies. Access is restricted to the platform owner, with alerts through the email service. We retain records for 30 days; backups and alert messages follow the respective services’ retention. These signals support human investigation and do not alone prove an intrusion or the identity of the person operating an account.
Presence and operational activity
For account security and operational support, we retain the latest signal for each portal connection for 30 days: account, timestamps, tab visibility/idle state, general area (administration, portal, profile or support), public IP, approximate country/city and device-reported browser/OS. Presence is collected only after MFA authentication; only the Mega Admin can view the global overview. We do not collect GPS, typed text, page contents or browsing history. Browser signals do not prove physical presence; VPNs may alter the origin. Agents are linked to companies and show communications and collections already received, without assuming installation on a user’s computer. Original authentication records and backups follow their own retention policies. Processing supports service security and operation, not productivity assessment.