Privacy Policy

Version 1.0 — effective 11 October 2026. Supersedes the version of 1 January 2026.

Računalniške storitve, Tadej Nitič s.p. ("Nitech", "we", "us"), registration number 9777300000, registered office Štihova ulica 13, 1000 Ljubljana, Slovenia, is the controller of the personal data described below. Contact for privacy matters: info@nitech.si. We have not appointed a Data Protection Officer.

Two roles, kept separate. For your account, your billing relationship and our own security logs, we are the controller and this Policy explains that processing. For the data you put into Vigil about your business, your clients and your store, we act as a processor on your instructions — that relationship is governed by our Data Processing Agreement.

In one paragraph

Vigil is a tool for watching public product prices, used by businesses and individuals alike. It is not built to collect information about people, and we have deliberately kept the personal data it touches to the minimum needed to run an account: who you are, how to reach you, that you paid, and enough security logging to keep the account safe. We do not sell data, we run no advertising or analytics trackers, and we use one cookie to keep you logged in, plus one that remembers your language if you choose one.

1. What we collect, why, and on what legal basis

Account data — email address and optional name (to create and operate your account and send service notices); your password, stored only as an Argon2id hash; your two-factor secret if you enable it; session and refresh tokens, stored hashed. Legal basis: performance of our contract, Art. 6(1)(b) GDPR.

Security data — failed-login counters, lockout timestamps, last-active timestamp, IP address, user agent, request timestamps, error logs and rate-limit counters. Used to keep the Service up, investigate faults and stop abuse. Legal basis: our legitimate interests in network and information security, Art. 6(1)(f).

Billing data — paid subscriptions are sold by Polar Software, Inc., our reseller and merchant of record, which collects and processes your payment details as an independent controller under its own privacy policy. We never receive or store your card number. We store the identifiers Polar gives us, your plan, its status, seat count, trial dates and cancellation state. Legal basis: contract, Art. 6(1)(b), and legal obligation for tax and accounting records, Art. 6(1)(c).

Content you put into the Service — the companies, domains and URLs you monitor, your own product prices and floors, your repricing rules, client labels, share links and notification settings. This is business data and is normally not personal data; where it does contain personal data, we handle it as a processor under the DPA.

Monitored page content — a full-page screenshot, a compressed copy of the HTML, and the product and price data extracted from the pages you tell us to monitor. These are public retail pages and the subject matter is products, not people, but a public page can incidentally contain personal data. We do not seek it out, index it, or make it searchable by person. Legal basis: legitimate interests, Art. 6(1)(f), balanced against the minimal impact on anyone incidentally named. This history is deleted after 6 months.

Store connections — if you connect your own store, the credentials you create for us (encrypted at rest with AES-256-GCM), your catalogue data, and an audit log of every price preview and price change. Used only to read your catalogue and write the changes your rules produce. Legal basis: contract, Art. 6(1)(b).

Support, bug reports and email preferences — what you send us, plus your digest and alert settings and an unsubscribe token that makes the link in an email work without logging in. Legal basis: contract and legitimate interests; consent where a message is marketing rather than service-related.

What we do not do. No advertising, remarketing or third-party analytics. No selling or renting of personal data, ever. No profiling of individuals and no automated decision-making with legal or similarly significant effects on a person under Art. 22 GDPR — Dynamic Pricing makes automated decisions about your product prices, on rules you configure, not about people. We collect no special-category data, and you must not put any into the Service.

2. Who we share it with

We share personal data only with providers who help us run Vigil, each bound by a data processing agreement: Railway (application hosting, the managed PostgreSQL database and snapshot storage, all in the EU), Polar (reseller and merchant of record), Resend (transactional email) and Anthropic (AI-assisted extraction of monitored public pages, on the Scale, Agency and Enterprise plans — it receives the visible text of a public retail page, never your account data or store credentials). The full list, with locations and safeguards, is at /subprocessors.

Where you configure an outbound destination — a Slack webhook, your own webhook endpoint, your store — we send alerts and price changes there at your instruction. We may also disclose data where legally required, to enforce our terms, or to protect the rights and safety of Vigil, our customers or the public. If we are ever acquired, data may transfer with the business, and we will give notice before it becomes subject to a materially different policy.

3. International transfers

Our database and application infrastructure are hosted in the EU. Polar, Resend and Anthropic are established in the United States. Transfers to them are covered by the European Commission's Standard Contractual Clauses (2021/914), supplemented by our own transfer assessment, encryption in transit and at rest, and data minimisation. A copy of the safeguards is available on request.

4. How long we keep it

Account data — while the account exists. An account you delete in Settings is signed out at once and erased for good 30 days later; until then we can restore it if you ask.
Monitoring history (change events, snapshots, extracted products) — 6 months, pruned automatically.
Snapshot files (screenshots, HTML) — only the two most recent captures per monitored URL.
Watchlist price history (buyer product watches) — kept for the life of the watch, deliberately outside the 6-month prune, because a long price series is the point of a watch. Deleted when you delete the watch or the offer, and with the account.
Store credentials — until you disconnect the store or close the account.
Repricing audit log — while the account and the rule exist. Erased when you delete the rule it belongs to, and with the account.
Session and refresh tokens — up to 30 days, or until logout.
Security and access logs — up to 30 days.
Invoices and tax records — as required by Slovenian tax law, currently 10 years.
Backups — overwritten on a rolling cycle not exceeding 30 days.
Trial-used marker (a date on your account) — kept indefinitely, to enforce one trial per account.

5. Your rights

You may access your data, have it corrected or erased, restrict or object to processing based on legitimate interests, receive it in a portable format, and withdraw consent where processing rests on it. Write to info@nitech.si; we answer within one month and will tell you if a complex request needs longer. Much of this is self-service: you can edit your profile, export price history to Excel, download a copy of everything in your account, delete companies and pages, revoke share links, disconnect stores, change alert settings, unsubscribe from the digest and delete your account inside the Service.

You may complain to the Slovenian supervisory authority — Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si — or to the authority where you live or work. We would rather you told us first.

6. Security

Passwords hashed with Argon2id, never stored or logged in plain text.
Optional TOTP two-factor authentication.
Short-lived access tokens with rotating refresh tokens in httpOnly cookies; tokens stored only as hashes.
Store credentials encrypted at rest with AES-256-GCM; reset and share-link tokens stored hashed.
TLS on all production connections, security headers, and CORS restricted to our own web origin.
Rate limiting on authentication and other sensitive endpoints, with lockout after repeated failures.
SSRF protection in the crawler: private and internal address ranges and non-HTTP(S) schemes are blocked before any page is fetched.
Row-level security on every database table, with authorisation enforced in the API layer.
Data hosted in the EU, with encryption at rest at the storage layer.

No system is perfectly secure. If we suffer a personal data breach likely to result in a risk to you, we will notify the supervisory authority within 72 hours where required and tell affected users without undue delay. To report a vulnerability, write to info@nitech.si — we will not pursue good-faith security research that respects our users' data.

7. Children

Vigil is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

8. Cookies

We use the session cookie that keeps you signed in: it is httpOnly, sent only to our own API, and expires after 30 days or at logout. If you choose a language, a second cookie remembers that choice for a year. No advertising, analytics or cross-site tracking cookies are used. See our Cookie Policy.

9. Changes

We may update this Policy. For material changes we will notify you by email or in the Service before they take effect. Past versions are available on request.

10. Contact

Računalniške storitve, Tadej Nitič s.p., Štihova ulica 13, 1000 Ljubljana, Slovenia — registration number 9777300000, tax number 27253775 (VAT identification SI27253775 under Article 76.a ZDDV-1; not a VAT payer). info@nitech.si.