Privacy Policy

Plain-English summary

• ✓We collect only the data necessary to provide the service: company info, employee names/emails, exchange API keys (encrypted), wallet addresses, and the balance/transaction data we pull on your behalf.
• ✓We never sell or share your data with marketers, advertisers, or third parties (other than the listed sub-processors used to deliver the service).
• ✓Your data is encrypted at rest (AES-256-GCM) and in transit (TLS).
• ✓Customer firms are the Data Controllers for their employee data. Vigatra is the Data Processor.
• ✓Data-subject requests (access, erasure, portability) are routed to the customer firm — they decide based on their retention obligations.
• ✓Cookies are minimal: session cookie + an optional preferences cookie. No tracking pixels, no third-party analytics.

1. What we collect

We collect the following categories of data: account data (company name, admin email, password hash), employee data (names, emails, departments, onboard tokens you generate for them), credentials (exchange API keys + secrets, encrypted with AES-256-GCM before storage), wallet addresses (public on-chain identifiers you submit), derived data (balances, transactions, NFTs, DeFi positions we fetch on your behalf), audit data (logs of dashboard actions for compliance purposes), and technical data (IP addresses, request timestamps, user-agent strings).

2. Why we collect it

To provide the compliance-monitoring service you contracted us for. The lawful basis is contract performance under GDPR Article 6(1)(b) — we cannot deliver Vigatra without this data. For audit logging specifically, the basis is legitimate interest under Article 6(1)(f) for security and accountability.

3. How long we keep it

Retention is configurable per customer firm and aligns with the financial-record retention requirements of your jurisdiction (e.g. SEC Rule 17a-4 mandates 6 years for broker-dealers in the US). When you cancel your subscription, we retain your data for 90 days for transition purposes, then delete it. Audit logs are retained for the full contract term.

4. Who we share with

Only the sub-processors listed on our security page. We require contractual data-protection commitments from each of them. We do not share data with marketers, advertisers, social-media platforms, or law enforcement absent a valid legal demand.

5. Your rights

If you are an employee being monitored, your rights flow through your employer (the Controller). Submit GDPR/CCPA/equivalent requests to your firm's compliance officer. If you are a Vigatra customer firm, you can export or delete data via the dashboard or by contacting [email protected].

6. Contact

Privacy questions: [email protected]. Security incidents: [email protected].