Privacy Policy

What we collect. Account data: your email address, password hash (we never store passwords), Google or SSO identifiers if you sign in that way, and login times. Service data: the monitors, servers, channels and status pages you configure, check results (status codes, response times, extracted page text, response snippets kept as failure evidence), server metrics reported by the agent you install, traces sent by the SDK, alert history and audit log entries. Billing data: your plan, subscription status and Paddle customer id, or, if you subscribe through AWS Marketplace, your AWS customer identifier, AWS account id and contract status (AWS bills you; we never receive card or bank details). Payment card details are collected and stored only by Paddle.com, our merchant of record, and never touch our servers.

Why we use it. To run the monitoring you asked for, deliver alerts to the channels you chose, show you dashboards and reports, bill you, secure the service, and answer support requests. We do not sell personal data and we do not use your data for advertising.

Alert channels and integrations. When you connect Telegram, Slack, Discord, email, webhooks, PagerDuty, ServiceNow, Jira and similar services, we store the tokens or addresses you give us and send alert content to those services. Their handling of that content is governed by their own policies.

AI assistants (MCP). When you connect an AI assistant such as Claude, ChatGPT or Cursor to Vigil's MCP server, you sign in to Vigil and choose read-only access or read plus "acknowledge incidents". We store the connection (the assistant's name, the access you granted, hashes of its access and refresh tokens, and when it was created and last used) so you can see and disconnect it under Settings → API keys → Connected AI apps. The assistant receives only the results of the tools it calls (for example incidents, monitors, servers, logs, errors and traces from your workspace), limited to what your role can see. We receive the tool name and its arguments, never your conversation. Acknowledging an incident is recorded in your audit log. Access tokens expire after 1 hour and refresh tokens after 30 days, and disconnecting revokes both at once. What the assistant does with the results is governed by its provider's policy.

Processors we rely on. Hetzner Online GmbH (server hosting, Germany), Paddle.com (payments and invoicing), Amazon Web Services (billing for subscriptions bought on AWS Marketplace), Brevo (transactional email), Google (optional Google Sign-In; optional AI incident analysis via the Gemini API, which receives incident evidence you explicitly ask to analyse). Each processes data only on our instructions.

Where it is stored. Your data lives in our database on servers rented from Hetzner in Germany (EU). Backups are taken every 6 hours and kept on that server and on a second, operator-controlled backup machine. We use your data only for the purposes above and share it only with the processors listed here.

Retention. Check history and server metrics are kept for the period of your plan (7 to 365 days) and then deleted automatically. Account and billing records are kept while your account exists and as long as tax law requires afterwards. Audit logs are kept for your plan's audit period, and for at least one year for subscriptions bought through AWS Marketplace. Backups are kept for up to 8 weeks.

Security. All traffic is encrypted in transit (HTTPS). Passwords are hashed with PBKDF2, two-factor authentication is available to every account, and access to production systems is restricted to the operator. Agents and SDKs you install talk to us over outbound HTTPS only.

Your rights. You can view and change your data in the app, export monitors through the API, and delete monitors, servers or your account at any time. You may also ask us to access, correct, export or erase your data by emailing hello@puzaricloud.in; we respond within 30 days. When you delete your workspace or ask us to erase your data, it is removed from the live database within 30 days and disappears from backups as they expire (at most 8 weeks). If you are in the EU/UK you have the rights set out in the GDPR, including the right to complain to your supervisory authority.

Cookies. We use only strictly necessary cookies: your session, a CSRF token, and the unlock cookie for password-protected status pages. No advertising or tracking cookies.

Children. The service is for businesses and adults; we do not knowingly collect data from children under 16.

Changes. We will announce material changes to this policy by email or in the app before they take effect.

Contact. PuzariCloud · hello@puzaricloud.in · contact page.