Privacy Policy
Last updated 10 November 2026
VigilRisk is operated by Becloudsmart Pty Ltd (“we”, “us”). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Questions or requests go to hello@vigilrisk.io.
Who is responsible for what
Each customer organisation has its own VigilRisk workspace. What the customer puts in it — risks, obligations, documents, the names of the people involved — is the customer’s information, and we handle it on the customer’s instructions to provide the service. For information about you as a user, a demo or signup enquirer, or a billing contact, we are responsible directly.
What we collect
- Account details: your name and work email, and the identifiers and profile photo Microsoft returns when you sign in with Microsoft.
- Sign-in and security records: when you signed in and from which IP address, and an audit trail of changes made in a workspace and who made them.
- Workspace content: whatever your organisation records or uploads.
- Enquiries: the name, email, company and message you give us when you request a demo or sign up.
- Billing: the billing contact and plan. Card details are collected and held by Stripe; we never see or store them.
- Service diagnostics: server logs and performance telemetry used to run and fix the service.
Cookies
We use only cookies the service needs to work: a sign-in session cookie (valid for 24 hours), a short-lived cookie that protects the sign-in process, and, if you arrived through a partner’s link, a 30-day cookie recording which partner referred you. A preference cookie remembers whether you last worked in the Dashboard or Agentic view, and your light or dark theme choice is kept in your browser. We do not use advertising or third-party analytics cookies.
How we use it
To provide, secure and support the service; to bill for it; to send the emails the service relies on (sign-in links, invitations, review reminders, billing notices); and to respond to your enquiries. We do not sell personal information and we do not send marketing email.
AI features
When someone in your workspace uses an AI feature, the content needed for that request is sent to an AI provider and the answer comes back to VigilRisk. By default that provider is Anthropic, with Voyage AI creating the search index over your documents; both process data in the United States. A workspace can instead use Microsoft Azure OpenAI or its own provider account, configured by us on request. AI suggestions are saved as drafts for a person to accept or reject.
Where your information is stored
VigilRisk runs on Microsoft Azure in the Australia East region. Your workspace data and uploaded documents are stored there. Some service providers process information outside Australia:
- Microsoft (hosting, and Microsoft sign-in)
- Anthropic and Voyage AI (AI features, United States)
- Stripe (payments, United States)
- Resend (transactional email, United States)
We share with each of them only what it needs to do its part.
How long we keep it
- Workspace data: for as long as the subscription runs, then 90 days after it ends, during which the workspace is read-only so you can export what you need. After that the workspace database and its documents are deleted, and backup copies expire within a further 35 days.
- Your user account: while it is active, or until you ask us to delete it.
- Sign-in records: 7 years, for security and compliance. If your account is erased, these records stop identifying you by name or email. A workspace’s own audit trail is part of its workspace data and is deleted with it.
- Signup enquiries: unconfirmed signups 7 days after the link expires; confirmed signups 30 days.
- Records of emails we sent: 1 year.
- Demo requests: until you ask us to delete them.
Your choices and rights
You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account, by emailing hello@vigilrisk.io. If your account belongs to a customer’s workspace, we may involve that customer’s administrator. You can turn off the weekly review digest from your own items page.
Security
Each customer workspace has its own database, and access is checked on every request. Connections are encrypted, secrets are held in a key vault, and changes in a workspace are recorded in a tamper-evident audit trail. To report a security issue, email security@vigilrisk.io.
Complaints
If you have a concern about how we handled your information, contact us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We will update this page when our practices change and revise the date above. Material changes affecting customers are notified to workspace administrators.