Privacy Policy

This Privacy Policy describes how Vigilo ("we", "us", or "our"), operated by Safety Desk (safety-desk.com), collects, uses, and safeguards information when you use our workplace safety management platform. By accessing or using Vigilo, you agree to the practices described in this policy.

1. Information We Collect

Account and organisation information

• Organisation name, domain, and logo
• User names, email addresses, job titles, and designations
• Employee ID numbers and PIN credentials (for field worker login)
• Subscription and billing details (processed by Razorpay — we do not store card data)

Safety and operational data

• Safety observations, hazard reports, and incident records
• Permit-to-work entries, inspection checklists, and audit findings
• HIRA assessments, corrective actions, and compliance records
• Training records, assessment attempts, and performance appraisals
• Photos and documents uploaded as evidence or attachments

Usage data

• Browser type, IP address, and pages visited (for security and diagnostics)
• Error logs and application crash reports

2. How We Use Your Information

• To provide, operate, and improve the Vigilo platform
• To send automated alert emails and system notifications you have configured
• To process subscription payments and manage your account
• To respond to support requests and enquiries
• To detect and prevent fraud, abuse, and security incidents
• To comply with applicable laws and regulations

We do not sell, rent, or share your data with third parties for marketing purposes.

3. Data Storage and Location

All application data and uploaded files are stored on Amazon Web Services (AWS) infrastructure located in the ap-south-1 (Mumbai, India) region. Your data does not leave India except as described in Section 4 below.

4. Third-Party Services

We use the following sub-processors to deliver our service:

• Amazon Web Services (AWS) — cloud hosting, database (RDS PostgreSQL), and file storage (S3). Data residency: ap-south-1, India.
• Brevo (Sendinblue) — transactional email delivery. Email content is transmitted to Brevo's servers solely for the purpose of delivery.
• Razorpay — payment processing. Razorpay handles all card and payment data; we receive only transaction status and identifiers.

Each sub-processor is bound by its own data protection obligations and is not permitted to use your data for any other purpose.

5. Data Retention

We retain your organisation's data for the duration of your active subscription. Upon account termination or cancellation, we retain data for 30 days to allow for recovery, after which it is permanently deleted from all systems. You may request earlier deletion by contacting us.

6. Security

We implement industry-standard security measures including:

• TLS 1.2+ encryption for all data in transit
• Encrypted storage for sensitive credentials
• Role-based access controls so users only access data within their organisation
• Regular automated database backups

No system is completely secure. In the event of a data breach that affects your organisation, we will notify you within 72 hours of becoming aware of it.

7. Your Rights

As an account holder you have the right to:

• Access — request a copy of the data we hold about your organisation
• Correction — request correction of inaccurate data
• Deletion — request deletion of your organisation's data
• Export — export your data in CSV or PDF format at any time from within the platform

To exercise any of these rights, contact us at the address below.

8. Cookies

Vigilo uses session cookies strictly necessary for authentication. We do not use advertising or analytics tracking cookies.

9. Applicable Law

This policy is governed by the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 of India.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified to your account's registered email address at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.