Vigilance — Privacy Policy

Who is responsible

This website and the Vigilance product are operated by Modul4r Solutions (Marcello Delcaro), based in Alberta, Canada. Under the GDPR, Modul4r Solutions is the data controller for everything this page describes.

For any privacy question or request, email hello@modul4r.com. A person reads it.

What the software sends

Pro sends nothing. It opens no network connection at all: no licence check, no heartbeat, no telemetry, no crash reports, no usage data, no file contents. Your licence is a signed file we email you, and the software never calls home to check it.

Free sends a report on every run. That is what the free tier costs, and it is the only reason it can be free. vigi activate registers the install and gets a key back. Each run afterwards posts a signed record to us: the install id, the Vigilance version, the sha256 of each file it scanned, the powers found in that file, light structural heuristics, the key, and the time. It never sends your code, a file path, a file name, an IP-linked identity, or anything about you. We use it to build the power registry that makes the next version better at this. A machine with no network cannot run Free; Pro is the offline path.

This is one full report, exactly as it is sent. Nothing else leaves the machine.

one free-tier report

{
  "install_id": "b9f4c2a1-7e3d-4a56-9c21-0f8e2d5a1c77",
  "activated_key": "vgk_",
  "time": "2026-08-24T05:12:03Z",
  "vigi_version": "0.1.31",
  "files": [
    {
      "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "powers": [],
      "heuristics": []
    },
    {
      "hash": "9f2b7c1d4e5a6f80c3b2a1908d7e6f5c4b3a29180716253d4c5b6a7f8e9d0c1b",
      "powers": ["fetch", "shell-pipe"],
      "heuristics": ["minified", "base64-blob"]
    }
  ],
  "sig": ""
}

The first file is clean, so its power list is empty. The second gained the power to reach the network and pipe into a shell. Each file is only a hash. There is no name, no path, and no content.

What the website collects

Analytics and visitor identification. The website loads these third-party tools:

Google Analytics (Google). It sets cookies and records pages you visit, your rough location, your device, and how you found us. We use this to see what content works.
Apollo and Warmly (Apollo.io and Warmly). They try to match your visit to a company, and sometimes to a business profile, using your IP address and cookies. We use this to see which companies read the site.
Digital Pilot. Site analytics, similar to Google Analytics.

Forms. If you send the contact form or ask about early access, we receive what you type: your email, your message, and the page you sent it from. The early-adopter form also stores the company details you provide and a check of whether your email matches the company domain. The form is hosted by Freeform and the lead lands in Attio, our contact database. We use it to reply and, if you signed up for updates, to send them. Every email we send has a working unsubscribe.

Purchases. Checkout runs on Stripe's own pages. Your card number goes to Stripe, never to us. We receive your email and the fact that you bought Pro, and we use them to email you the licence file. There is no machine id to collect. Stripe is the processor for payment data and has its own privacy policy.

Install counter. The counter on the homepage counts unique install ids: one per Pro licence issued and one per free activation. An install id is a random-looking number. It carries no name and we cannot trace it to a person.

The sandbox and hosting. The live sandbox and our host (Vercel) process your IP address to serve pages, cache results, and stop abuse with rate limits. Standard server logs exist for a short time.

Why we are allowed to (lawful bases)

Contract: issuing your license, running the free tier you activated, and answering your messages (GDPR Art. 6(1)(b)).
Legitimate interest: keeping the site up, stopping abuse, and counting installs (Art. 6(1)(f)).
Consent: analytics and visitor-identification cookies (Art. 6(1)(a)). You can withdraw consent at any time. See Your rights below.

Who processes it and where

These companies process data for us: Google (analytics), Stripe (payments), Vercel (hosting, sandbox), Cloudflare (R2 object storage for free-tier activation keys and scan reports), Attio (contacts), Freeform (forms), logo.dev (company logo and name search, receives the text typed in the company field), Apollo.io, Warmly, and Digital Pilot (visitor analytics). Most are in the United States.

Transfers from the EU and UK rely on the EU–US Data Privacy Framework or Standard Contractual Clauses, depending on the provider. Canada holds an EU adequacy decision for data handled under PIPEDA.

We never sell your data. We never share it beyond the processors listed here.

How long we keep it

Contact and early-adopter entries: until you ask us to delete them.
Purchase records: 7 years, because tax law requires it.
Analytics data: up to 14 months, then Google deletes it.
Server and sandbox logs: days, not months.
Free-tier scan reports: kept 90 days, then deleted.
Activation records: kept while the install is active.

Your rights (GDPR and UK GDPR)

If you are in the EU, EEA, or UK, you have rights over your data. You can ask us to show it, correct it, delete it, hand it over in a portable format, restrict what we do with it, or stop processing it. You can withdraw any consent at any time. Email hello@modul4r.com and we will answer within one month.

You can also complain to your local supervisory authority. The EDPB member list has every EU authority; in the UK it is the ICO.

Canadians hold similar rights under PIPEDA. Everyone else can email us too. We answer the same way, wherever you live.

Cookies

None of the tracking tools load until you press Accept on the cookie banner. If you press Decline, the site sets no tracking cookies at all and works exactly the same.

If you accept, the tools above set theirs: Google Analytics (_ga, _ga_*) and the Apollo, Warmly, and Digital Pilot identifiers. Deleting cookies in your browser removes all of them.

Changes

If this policy changes, the new version appears here with a new date. We do not quietly widen what we collect.

Last updated: August 22, 2026.