Privacy Policy

1. Who We Are (Data Controller)

The Vigmis service is provided by VIGMIS US LLC, a Wyoming limited liability company with its registered office at 30 N Gould St Ste N, Sheridan, WY 82801, USA ("Vigmis", "we", "us"). The platform is developed and operated on our behalf by Taurus Management and Investments Ltd. (טאורוס ניהול והשקעות בע"מ), Company No. 514565118, Israel, acting as our technology provider and data sub-processor.

We are the Data Controller for personal data collected through vigmis.com and the Vigmis dashboard. For all privacy-related inquiries: privacy@vigmis.com.

2. Information We Collect

Account & identity data

• Name and email address — provided during sign-up via Clerk (our authentication provider)
• Profile preferences and notification settings

Business & onboarding data

• Business name, website URL, industry, and description
• Advertising budget, campaign goals, and geographic targeting preferences
• Brand assets, tone of voice, and creative preferences you provide
• Information about your products, services, and target audience

Customer list & audience data (optional)

• If you choose to use First-Party Audiences, you may upload a customer list (such as email addresses and phone numbers) or connect a store/CRM so we can build advertising audiences on your behalf — for example to exclude existing customers from campaigns aimed at new customers.
• We hash this data (SHA-256) in memory before it is used and never store the raw email addresses or phone numbers, and never write them to our logs. Only the hashed values are transmitted to the advertising platform (Meta, and Google where applicable) to create or exclude the audiences you approve.
• We store only audience metadata (the audience name, the platform audience identifier, and how many records matched) — not the underlying personal data.
• You must be authorised to share this data for advertising; we ask you to confirm this once before the feature is used, and you can have an audience deleted at any time.

AI Discovery data

• Our AI Discovery feature measures whether your business is mentioned when buyers ask an AI assistant questions about your category. To do this we send your public business details (name, category, location, website) and generated buyer questions to an AI provider. We do not send your customers’ personal data for this measurement.
• We store the measured results (counts of mentions/citations and the gaps found) so you can track them over time. These are real measured counts, not predictions.

Ad platform credentials

• OAuth access tokens for Google Ads, Meta (Facebook/Instagram), and TikTok Ads
• We store tokens in encrypted form and use them solely to manage your campaigns
• Campaign performance data retrieved from connected platforms

Usage and technical data

• Dashboard interactions, features used, and session activity
• IP address, browser type, and device information
• System logs for error diagnosis and security monitoring

Billing data

• Payment is processed entirely by Stripe. We do not store or access your credit card numbers.
• We retain billing history (amounts charged, invoices) for tax and legal compliance.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing your account information, business data, and ad platform credentials is necessary to provide the Vigmis service you have subscribed to.
• Legitimate interests (Art. 6(1)(f) GDPR): We process usage data, logs, and aggregated analytics to improve service quality, diagnose errors, and ensure security — where these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c) GDPR): We retain billing records and audit logs as required by applicable tax and financial regulations.
• Consent (Art. 6(1)(a) GDPR): Where you have opted in to WhatsApp or email performance alerts, we rely on your consent, which you may withdraw at any time from Dashboard → Settings → Notifications.

4. How We Use Your Data

• Creating, launching, and optimising advertising campaigns on your behalf
• Generating AI-powered campaign strategies, creative content, and performance analysis
• Calculating and charging our management fee via Stripe
• Sending performance alerts via WhatsApp and email (only where you have opted in)
• Providing customer support and responding to your requests
• Improving our platform features and computing industry benchmarks using aggregated or pseudonymised data. We do not train AI models on your identifiable content; our aggregated benchmarks are computed without account identifiers
• Building and excluding advertising audiences from a customer list you provide (First-Party Audiences), using hashed identifiers only, where you have enabled this and confirmed you are authorised to share the data
• Measuring whether your business is discoverable by AI assistants (AI Discovery), using your public business details only
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal and regulatory obligations

We do not use your data for advertising to third parties and we do not sell your personal data. When you provide a customer list for First-Party Audiences, you act as the controller of that data and Vigmis acts as your processor; the advertising platforms (Meta, Google) act as sub-processors for the Custom Audiences / Customer Match programs.

5. Data Sharing & Sub-processors

We do not sell your data. We share data only with the third-party providers listed below, each of whom is contractually bound to process your data only as instructed and to maintain appropriate security:

6. International Data Transfers

The data controller is VIGMIS US LLC (United States); the platform is operated on its behalf from Israel by Taurus Management and Investments Ltd. Your data may be processed in the United States, Israel, and other countries where our sub-processors operate. These countries may have data protection laws that differ from those in your home country.

Israel: The European Commission has recognised Israel as providing an adequate level of data protection for personal data transferred from the EEA (Adequacy Decision 2011/61/EU). Transfers to Israel do not require additional safeguards.

United States and other countries: Where we transfer data to sub-processors in countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or on other lawful transfer mechanisms. You may request a copy of the applicable transfer safeguards by contacting privacy@vigmis.com.

7. Data Retention

• Account & campaign data: Retained while your account is active; removed within 30 days of account deletion, except records we must keep for legal/evidence reasons below.
• Pixel / conversion events: Up to 24 months.
• AI advisor chat history: 30 days.
• Competitor Insights results: Up to 90 days, or until you delete them.
• Customer-list audiences (First-Party Audiences): We never store the raw emails/phones — only hashed audience metadata, kept while your account is active. When you delete an audience or your account, we also delete the corresponding Custom Audience on the advertising platform so the hashed list does not persist there.
• AI Discovery results: Measured mention/citation counts and gaps are kept for the life of your account so you can track them over time, or until you delete them.
• Product analytics / telemetry: Up to 12 months.
• Creative generation jobs (temporary): Up to 12 months. Creatives you have approved or purchased are kept for the life of your account (not auto-deleted).
• Security & access logs: Up to 24 months for fraud prevention and incident response.
• Audit trail of material actions: Up to 7 years.
• Consent & authorisation evidence (Terms acceptance, spend/publish authorisations): Up to 7 years after the relevant relationship ends, to evidence the consent if challenged.
• Billing & invoice records: At least 7 years as required by applicable tax law, even after account deletion.
• Ad platform OAuth tokens: Deleted immediately upon account deletion or platform disconnection.
• Backups: Rotated on a cycle of up to 90 days.
• Anonymised / aggregated data: May be retained indefinitely for service improvement.
• Where a law in your jurisdiction requires a longer retention period for a particular record, that period applies to that record.

8. Your Rights

Rights under GDPR (EEA & UK users)

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data, subject to our legal retention obligations.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to restrict processing (Art. 18): Request that we limit how we process your data in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA within the EU).

Rights under CCPA (California residents)

• Right to know: Request disclosure of the personal information we have collected about you and the purposes for collection.
• Right to delete: Request deletion of personal information we have collected, subject to legal exceptions.
• Right to opt-out of sale: We do not sell personal information. No opt-out is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of the above rights, contact us at privacy@vigmis.com. We will respond within 30 days (GDPR) or 45 days (CCPA).

9. Cookies & Tracking

We use the following cookies and similar technologies:

• Essential cookies: Required for authentication and session management, provided by Clerk. Cannot be disabled without affecting core functionality.
• Security cookies: Used to detect and prevent fraudulent activity.
• Analytics & product-improvement cookies: We use PostHog (a first-party-configured analytics provider) for usage analytics and session recording to understand and improve the dashboard. These are non-essential and run only after you accept analytics cookies; you can decline or withdraw at any time via the cookie banner. Input fields are masked in session recordings.

We do not use third-party advertising cookies, and we do not sell your personal data or use it to advertise to you across other sites. Non-essential analytics do not run until you accept them. See our Cookie Policy for details.

10. Children's Privacy

The Vigmis platform is intended for use by businesses and professionals aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has provided us with personal data, please contact us at privacy@vigmis.com and we will delete it promptly.

11. Data Deletion

To delete your account and all associated data:

• Go to Dashboard → Settings → Danger Zone → Delete Account
• Or email privacy@vigmis.com

Upon deletion, your campaigns are paused, all platform OAuth connections are revoked, and your data is permanently removed within 30 days. Billing records are retained as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or via an in-app notice at least 14 days before the changes take effect. The current version is always available at vigmis.com/privacy. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

For all privacy-related requests and inquiries:

privacy@vigmis.com
Data controller: VIGMIS US LLC (Wyoming, USA) — contact via privacy@vigmis.com.
Platform operated on its behalf by Taurus Management and Investments Ltd., 25 Mabshovitz Binyamin St., Herzliya 4640525, Israel.