Privacy Policy
This policy explains what information VigiLayer collects, why we collect it, who we share it with, and what control you have over it. We have tried to write it in the same plain language we use everywhere else in the product.
1. Who we are
VigiLayer is a website security monitoring service operated by Ibad Fahad Anwer, a sole trader based in Pakistan, trading as VigiLayer, at 273/1-10 Korangi Creek Industrial Area, Karachi 75190, Pakistan.
For any question about this policy or your data, contact us at ibad@vigilayer.com.
For the purposes of data protection law, we are the data controller for the information described below.
2. What we collect
Account information
You sign in to VigiLayer using Google. We do not create or store a password for you, and we never see your Google password. When you sign in, Google provides us with:
- Your email address
- Your name and profile picture, where your Google account provides them
- A Google account identifier that lets us recognise you on your next visit
We also store the dates your account was created and last signed in, and session tokens that keep you signed in between visits.
Websites you add
When you add a website to VigiLayer, we store:
- The domain name you entered
- A randomly generated verification token, which we create on our server and which is used only to confirm you control that domain
- Whether and when the domain was verified, and when we last checked it
Scan results
When we check a website, we record the results of those checks: certificate details and expiry dates, which security headers are present, DNS and email configuration records, response times, and whether the site was reachable. This information is gathered from publicly available sources, in the same way any visitor's browser would see it.
Technical information
Like most websites, our hosting provider records technical information when you use VigiLayer, including your IP address, browser type, and the pages you visit. This is used to keep the service running securely and to diagnose problems.
Payment information
If you subscribe to a paid plan, payment is handled by Creem, operated by Armitage Labs OÜ in Estonia, who act as the merchant of record. That means Creem is the seller on your invoice and handles payment, tax and billing correspondence. We never see or store your card number. We keep a record of which plan you are on and your billing history.
3. What we do not collect
We think this is as important as the list above. VigiLayer does not:
- Ask for, or store, the login details for your website, hosting account, or DNS provider
- Install anything on your website, or read its files, database, or source code from the server side
- Collect or process data belonging to your customers
- Submit forms, place orders, create accounts, or interact with your site as a user would
- Attempt to break into, exploit, or stress-test your website
Our checks are passive and non-invasive. They observe what your website already tells the public internet.
4. Why we use your information
| What we do | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| Create and maintain your account | So you can sign in and see your own websites | Performance of a contract |
| Verify domain ownership | To make sure nobody monitors a website they do not control | Performance of a contract; legitimate interests (preventing misuse) |
| Run scheduled checks | To deliver the monitoring you signed up for | Performance of a contract |
| Send alert emails | To tell you when something about your website changes | Performance of a contract |
| Keep logs and rate limits | Security, abuse prevention, and fixing faults | Legitimate interests |
| Send marketing email | To tell you about VigiLayer features | Consent (you can opt out at any time) |
5. Who we share information with
We do not sell your personal information, and we do not share it for advertising. We do rely on a small number of service providers to run VigiLayer:
| Provider | What they handle |
|---|---|
| Supabase | Database, authentication, and hosting of our backend |
| Sign-in, when you choose to sign in with Google | |
| Cloudflare and Google Public DNS | Public DNS lookups used to verify domain ownership and check configuration |
| Resend | Sending alert and account emails |
| Creem (Armitage Labs OÜ) | Processing payments for paid plans, as merchant of record |
| Netlify | Hosting the website you are reading now |
| jsDelivr | Delivering the one JavaScript library the site needs to run |
A note on DNS lookups. To verify that you control a domain, and to check its configuration, we ask public DNS resolvers operated by Cloudflare and Google about that domain name. This means the domain names you add to VigiLayer are sent to those providers as part of an ordinary public DNS query. We query two independent providers deliberately, and only accept a verification when both agree, because relying on a single resolver would make it easier for someone to fake ownership of a domain they do not control.
A note on hosting and loading the site. Loading any page of VigiLayer means your browser connects to the companies that serve it, which are Netlify for the pages themselves and jsDelivr for the one JavaScript library the app needs. Those connections tell each of them your IP address and which page you asked for, in the same way that visiting any website does. We do not send them anything else about you, and we do not use them to track you. Our fonts are served from our own site rather than from a font provider, so simply reading a page does not announce you to one.
A note on paying. Creem loads nothing into these pages. Nothing is sent to them, and your browser never contacts them, unless you actively start a checkout, at which point we send you to Creem's own site to pay. Your card details are entered there and never touch VigiLayer.
We may also disclose information where we are legally required to do so, or where it is necessary to protect our rights, our users, or the public.
6. Where your information is stored
Our database and backend are hosted by Supabase in the Canada Central region. Our service providers may process information in other countries, including the United States.
VigiLayer is operated from Pakistan. That means the person who runs it accesses the database from there in order to support and maintain the service, so your information is available to us in Pakistan even though it is stored in Canada.
If you are in the UK or European Economic Area, we rely on the standard contractual clauses contained in our providers' data processing terms to cover transfers outside your region.
7. How long we keep it
- Account information is kept while your account is open, and deleted within 30 days of you closing it.
- Websites and scan history are kept while the website is in your account, and deleted when you remove it or close your account.
- Unverified domains stop being automatically re-checked after 72 hours. You can remove one at any time from your dashboard, and it is deleted immediately when you do.
- Billing records are kept for as long as tax and accounting law requires, typically 6 years.
- Technical logs are kept for a short period for security and fault diagnosis.
8. Your rights
Depending on where you live, you may have the right to:
- Ask what personal information we hold about you, and get a copy of it
- Have inaccurate information corrected
- Have your information deleted
- Object to or restrict how we use it
- Receive your information in a portable format
- Withdraw consent where we relied on it, such as for marketing email
To exercise any of these, email ibad@vigilayer.com. We will respond within one month.
If you are in the UK or EEA and are unhappy with our response, you can complain to your local data protection authority. If you are in California, you have rights under the CCPA/CPRA including the right to know, delete, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined under California law.
9. Cookies and local storage
VigiLayer uses browser storage to keep you signed in. These are strictly necessary for the service to work: without them, you would be signed out on every page load. We do not use analytics, advertising, or tracking cookies, which is why VigiLayer has no cookie consent banner. If that ever changes, we will ask for your consent first.
10. Security
We protect your information with measures including encryption in transit, database-level access rules so that each account can only ever read its own records, server-side generation of verification tokens, and storage of our own secrets in an encrypted vault rather than in application code.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your personal information, we will notify you and the relevant authority where the law requires it.
11. Children
VigiLayer is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy as VigiLayer changes. We will update the date at the top, and for significant changes we will tell you by email or in the product before they take effect.
13. Contact
Questions, requests, or complaints: ibad@vigilayer.com
Postal address: 273/1-10 Korangi Creek Industrial Area, Karachi 75190, Pakistan
See also our Terms of Service and Acceptable Use Policy, which cover what you may and may not check using VigiLayer, and our Refund Policy.