Privacy Policy
Última atualização: 8 de novembro de 2026
Estes documentos estão redigidos em inglês e italiano; é apresentada a versão em inglês.
In short
- We never store the messages you send to the API and we never use them to train models.
- We keep what an account needs (name, email, keys, usage totals) and a few security signals, for as long as they are needed.
- No advertising, no tracking cookies, no sale of data.
- You can see your data and delete your account from the dashboard at any time, and ask us for a copy of everything we hold about you.
1. Who is responsible
The controller of the personal data described here is VigiMod. Contact for anything about your data: privacy@vigimod.com. We have not appointed a Data Protection Officer, as the law does not require one for this service.
This policy covers the website vigimod.com (including the customer area my.vigimod.com) and the VigiMod API.
2. Two different roles
- Your account and the website: here we decide why and how data is used, so we are the controller.
- Messages you send to the API (often written by the members of your community): we process them only to return the scores to you, on your instructions, so for that content you are the controller and we are your processor. That relationship is governed by the Data Processing Agreement. If you are a member of a community that uses VigiMod, the community operator is your first point of contact.
3. What we process, why, on what legal basis, for how long
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account: name, email, profile picture and account id from GitHub or Discord if you sign in with them, password (stored only as a hash) | Creating and running your account | Contract (art. 6(1)(b) GDPR) | Until you delete the account |
| Sessions: a sign-in token and your browser type | Keeping you signed in | Contract | Up to 14 days, or until you sign out |
| API keys: a one-way hash and a short visible prefix (the full key is shown to you once and never stored) | Authenticating your requests | Contract | Until you delete the account |
| Usage counters: per key and per hour, the number of requests, messages and flags per category | Your usage dashboard and the rate limits | Contract | Until you delete the account |
| Security log: sign-ins and changes to your keys, with the browser used | Letting you check the activity on your account; protecting it | Legitimate interest in security (art. 6(1)(f)) | Until you delete the account |
| Security signals: a random identifier of your browser and, only when our hosting passes it reliably, your IP address, both stored as keyed one-way hashes | Limiting free accounts per device or network, slowing down password guessing, enforcing blocks for breaches of the Terms | Legitimate interest in preventing fraud and abuse (art. 6(1)(f), recital 47) | 12 months from the last time they were seen; 90 days after the account is deleted; blocks until they expire or are lifted |
| Acceptance of the Terms: date and version | Proving the agreement | Legitimate interest | Until you delete the account |
| Newsletter: email, name, date and way you subscribed or unsubscribed | Sending news, new models and offers | Your consent (art. 6(1)(a)), withdrawable at any time | Until you unsubscribe (the record of your choice until the account is deleted) |
| Service emails: address and content of verification and password emails | Confirming your address, resetting your password | Contract | As long as our email provider keeps its delivery logs |
| Content sent to the API or to the demo on the website: text, previous messages, rules, an optional user identifier | Returning the scores (as processor for API customers) | Your instructions / the contract; for the demo, our legitimate interest in letting visitors try the service | Not stored. If a user identifier is sent for spam detection, a normalized copy of the text stays in memory for up to 60 seconds. Never written to disk or logs, never used for training. |
| Technical data of every visit: IP address, date and time, page or endpoint requested | Delivering and protecting the service | Legitimate interest | Kept by our hosting provider for its own short security retention |
You only have to give us an email address (or sign in with GitHub or Discord) to have an account; everything else is optional. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Cookies
We only use cookies that are strictly necessary (sign-in, security, your choices). Details are in the Cookie Policy.
5. Who receives the data
We do not sell personal data and we do not share it for advertising. It is processed for us by these providers, bound by data processing agreements:
- Hugging Face, Inc. (USA): hosting of the website and the API.
- Turso (USA): the database, stored in the European Union (Ireland).
- Resend (USA): sending service emails and the newsletter, and keeping the newsletter list.
If you sign in with GitHub or Discord, they receive the sign-in request and act as independent controllers under their own privacy policies. We may also disclose data when the law or an authority requires it.
6. Transfers outside the European Union
Some providers are based in the United States. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework when the provider is certified under it, and otherwise on the Standard Contractual Clauses approved by the Commission (Decision 2021/914). You can ask us for a copy of the safeguards at privacy@vigimod.com.
7. Security
All traffic is encrypted (HTTPS). API keys and security signals are stored only as one-way hashes, passwords only as hashes, and access to the systems is limited and protected with two-factor authentication. If a breach affects your data, we will tell you and the authority as the law requires.
8. Your rights
You can ask to access your data, correct it, delete it, restrict its use, receive it in a portable format, and object to processing based on our legitimate interest. Where processing is based on consent (the newsletter), you can withdraw it at any time, without affecting what happened before. Much of this is in the dashboard: settings, keys, usage, newsletter switch and account deletion. For anything else write to privacy@vigimod.com: we answer within one month. You also have the right to lodge a complaint with a supervisory authority; in Italy it is the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of the country where you live or work.
9. Children
VigiMod is a service for developers and community managers and is not meant for children. You must be at least 14 years old to create an account; if you are under 18, your parent or guardian must agree to the Terms.
10. Changes
If we change this policy in a way that matters, we will tell you by email or in the dashboard before the change applies. The date at the top shows the current version.