Home › Privacy Policy

Privacy Policy (GDPR)

Last updated: 21 October 2026

1. Data controller

The controller of the processing activities described below (account, prospecting and browsing data) is:

Company: VIGILAE, simplified joint-stock company with a sole shareholder (SASU), 4 ZA Les Grands Prés, 01170 Chevry, France — R.C.S. Bourg-en-Bresse, SIREN 108 950 528
Data protection contact: rgpd@vigilae.org — Alexandre PEREIRA, data protection contact

2. Specific role regarding AML/CFT data (controller / processor)

The following distinction is essential:

Vigilance file data (identity of the professional's clients, beneficial owners, documents, screening results, suspicious transaction report elements): the regulated professional user is the data controller; Vigilae acts as a processor within the meaning of Article 28 of the GDPR, on the user's documented instructions and under a data processing agreement (DPA).
Account, billing, prospecting and browsing data: Vigilae is the data controller.

AML/CFT processing rests on a legal obligation incumbent on the professional (French Monetary and Financial Code, art. L.561-1 et seq.); certain retention periods and restrictions on rights follow directly from this.

3. Data processed and purposes

Account and use of the service: Professional identity, e-mail, login credentials, technical logs — to provide, secure and improve the service.
Access logging: Our servers log every request — full IP address, date and time, method, requested path, response code and browser (user-agent) — for security and error diagnosis purposes: detecting abuse and investigating after an incident. These logs, kept for 6 months, contain no cookies, no authentication headers and no URL parameters, and any e-mail address in the path is masked.
Vigilance data (as processor): Data required for AML/CFT due diligence uploaded by the user — to enable extraction, identification of beneficial owners, risk rating, screening and the building of the evidence file, in accordance with the user's instructions.
Free self-assessment: Questionnaire responses and contact e-mail — to provide the score, the recommendations and, where appropriate, to contact you again.
Prospecting and business relationship: Professional contact details — for commercial communication, on the basis of legitimate interest and/or consent, with the right to object at any time.
Partner code: If you arrive on the site through a Vigilae partner's link, that partner's code and the date of its arrival are kept in your browser. For thirty days at most, they accompany the request you make, whether for a free self-assessment, a quote, a demonstration or a call back, or your subscription, so that it can be attributed to the partner who referred you to us. The code is then recorded with your request, and deleted with it. With a subscription, it is also passed on to our payment provider and kept with the calculation of the commissions owed to the partner. The partner sees how many requests and subscriptions are attributed to them, without your name or your contact details. The code is also used to limit abusive requests made under the same code. A more recent link from another partner replaces it. After thirty days, the code is no longer used, and the site deletes it on your next visit. You can delete it at any time by clearing the site's data in your browser.
Cookies and audience measurement: See the "Cookies" section below.

4. Legal bases

Performance of the contract (provision of the service to the user).
Legal obligation of the user (AML/CFT framework), for vigilance data processed on their behalf.
Legitimate interest (security, service improvement, measured B2B prospecting).
Consent (non-essential cookies, certain communications).

5. Recipients and sub-processors

Data is accessible to the publisher's authorised personnel and, where applicable, to technical sub-processors bound by contract, in particular:

the hosting provider (OVH SAS: hosting, France — European Union; OVH SAS: backups, France — European Union; Hetzner Online GmbH: backups, Germany — European Union);
the customer relationship management tool (HubSpot Ireland Ltd — data hosted in the European Union), to record and follow up on requests sent through the public forms of the site (online self-assessment, quote request, demonstration, call back) — never client file data;
the e-mail delivery provider (Brevo — Sendinblue SAS, France — European Union), to send transactional messages: request for documents addressed to a firm's client, self-assessment report, digest and reminders. It receives the recipient's address and name, the subject and content of the message, as well as the attachments;
no screening provider: the official lists (European Union, United Nations, the French Direction générale du Trésor) are downloaded onto our servers and the comparison is carried out locally. No client name is transmitted to a third party for screening;
the payment provider (Stripe Payments Europe, Ltd., Ireland — European Union), to collect subscription payments and manage means of payment. It receives the billing address and the payment identifiers; card data is processed by it alone and Vigilae keeps no card number;
the storage of supporting documents (OVH SAS, France — European Union), where the documents provided by the professional or their client — identity, address, evidence of the source of funds — are kept for the five-year statutory period. They are encrypted before being deposited;
AI assistance (document extraction, copilot): it has been enabled since 5 September 2026. The model is Claude, from Anthropic, run on Google Cloud infrastructure (Vertex AI) in the europe-west1 region, within the European Union. It receives the content of the documents submitted for extraction and the text of the questions put to the copilot. This data is not used to train any model; prompts and responses are kept for no more than sixty days for the sole purpose of abuse detection, then deleted. Screening, risk rating and the register continue to work without it, on deterministic engines: the AI perceives, the engine calculates, and the decision remains the professional's;
the audience measurement of the public pages (Google Ireland Ltd — Google Analytics 4), subject to your prior consent: nothing is measured until the banner has been accepted, refusal being the default state. It concerns only the public website, never the application or any client file data.

Data is neither sold nor transferred to third parties for commercial purposes.

6. Transfers outside the European Union

Data is hosted and processed within the European Union. No transfer outside the EU is carried out in the chosen configuration. Should a sub-processor involving a transfer outside the EU be introduced, it would be governed by appropriate safeguards (standard contractual clauses or an adequacy decision) and this policy would be updated.

7. Retention periods

Account data: for the duration of the contractual relationship, then archived in accordance with applicable legal obligations.
Vigilance data: retained under the control of the professional acting as data controller. AML/CFT regulations require retention for 5 years from the end of the business relationship or the completion of the transaction (art. L.561-12 of the French Monetary and Financial Code).
Prospecting data: 3 years from your request, or 30 days if your address has not been confirmed; unless you object.
Cookies: duration specified in the dedicated section (at most 13 months for trackers subject to consent).

8. Security

Technical and organisational measures are implemented to protect the data: encryption of sensitive data at rest (AES-256-GCM vault), sealing and timestamping of the register (SHA-256 hash), access control, logging. The confidentiality of the suspicious transaction report is respected by design (art. L.561-18 CMF): its existence and content are not disclosed to the client.

9. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions regarding the fate of your data after your death.

For vigilance data, the exercise of certain rights (in particular erasure) may be limited by the legal retention and confidentiality obligations specific to AML/CFT, and must be addressed to the professional acting as data controller.

To exercise your rights over the processing for which Vigilae is the controller: rgpd@vigilae.org. You may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

10. Cookies

The site only stores elements strictly necessary for its operation and your display preferences (light/dark theme, language, remembering your consent choice), stored locally in your browser. If you arrive through a partner's link, the site also keeps that partner's code there, used for thirty days at most (see "Partner code" in section 3). It uses cookieless audience measurement (Umami, self-hosted), which is exempt from consent. It also uses Google Analytics 4, a third-party tracker subject to prior consent: nothing is measured through this tool until you have accepted the banner (refusal by default, no advertising cookies). You can withdraw your consent at any time by refusing the banner or clearing the site's data in your browser.

11. Changes

This policy may be updated. The applicable version is the one published on this page on the date you consult it.