Last updated: 26-10-2026
Viglar is built around collecting as little personal data as reasonably necessary. This page explains what we process, why we process it, and how long we keep it.
Viglar is operated by IT Ambit s.r.o., Mamateyova 10, 851 04 Bratislava, Slovakia, IČO: 51 646 552. For privacy-related questions, contact us at contact@viglar.com.
We process only the information reasonably necessary to provide, secure, and operate the Viglar service:
| Data | Why |
|---|---|
| Account information | Email address, password hash, email verification and password-reset information, preferred language, and subscription information are used to provide and manage your account. We do not require your name, telephone number, or home address. |
| Registration attribution | When you create a Viglar account, we may store first-touch attribution information associated with your account, such as the referring website hostname, landing page path, UTM parameters, country, and device category. This helps us understand how users discover Viglar and measure the effectiveness of our own promotional activities. We do not use this information for cross-site tracking, advertising profiles, or third-party advertising. |
| Domains, monitoring data, and saved configurations | We process the domains you add and the technical information needed to monitor or manage them, including SSL certificates, DNS records, WHOIS/domain information, HTTP headers, uptime, open ports, IP reputation, scan results, alerts, and saved SPF, DKIM, and DMARC configurations and history. We also store monitoring settings you configure, including scheduled maintenance windows, their start and end times, status, and recurrence settings where applicable. |
| DMARC aggregate reports | If you enable DMARC report collection for a verified domain, Viglar receives and processes aggregate reports sent by participating email providers and reporting organisations. These reports may contain sending IP addresses, message counts, sending domains, SPF/DKIM authentication results, DMARC policy outcomes, and related technical authentication details. They are used to analyse email authentication and help you identify legitimate senders and potential configuration issues. |
| Website content | If content monitoring is enabled, we retrieve publicly accessible website content and store limited copies to detect unexpected changes or potential security modifications. Such content may incidentally contain personal data published on the monitored website. |
| Login security IP address | When a login attempt fails, we temporarily store the originating IP address to detect repeated failed login attempts, enforce rate limits, prevent brute-force attacks, and protect user accounts and the Service from abuse. |
| Notification channels | If you configure Telegram, Slack, Discord, or a custom webhook, we store the destination information you provide so that we can deliver your requested alerts. |
| Subscription information | Paid subscriptions are processed through Stripe. Viglar stores Stripe Customer ID, Subscription ID, selected plan, and renewal information to manage your subscription. Viglar does not store your full payment card number. |
| Quick Check IP address | The public Quick Check processes your IP address for rate limiting, abuse prevention, service security, and related operational purposes. Quick Check IP logs are automatically deleted after 30 days and are not used to create an account. |
| Server logs | Our web server records standard technical request information such as IP address, time, requested URL, HTTP status, user-agent, and referrer for security, troubleshooting, abuse prevention, and service operation. |
| Public security report sharing records | We store report-link token hashes, associated domain and account identifiers, and link creation, expiration, and revocation timestamps to manage secure, time-limited access to shared reports. |
| Public report rate-limiting records | We store a SHA-256 hash of the requesting IP address and a request counter to enforce rate limits and protect public reports against abuse. These records are automatically deleted after 24 hours. |
Viglar provides a limited unauthenticated Quick Check on the public website. It does not create an account. The IP address used to make the request may be temporarily logged for rate limiting, abuse prevention, and security. These logs are automatically deleted after 30 days.
When content monitoring is enabled, Viglar retrieves publicly accessible website content and stores the 10 most recent content snapshots for each domain. If a scan detects signs of a potential security incident, relevant content may also be stored separately as incident evidence to support investigation. Incident evidence is automatically deleted after 90 days.
When an account holder creates a public security report link, Viglar stores a hash of the access token rather than the original token. The associated domain and account identifiers, creation time, expiration time, and any revocation time are stored to manage the link. Public links provide read-only access to the report and can be revoked before they expire.
If you participate in the Viglar badge rewards program, we process information needed to verify your domain’s eligibility, confirm continuous badge availability, calculate rewards earned, and manage their redemption. This may include your account and domain identifiers, verification and badge-check results, confirmed participation time, reward amounts expressed as days, reward status, and records needed to prevent duplicate rewards and track their processing. Where a reward is redeemed as subscription credit, we process the relevant subscription and credit details through Stripe. Some rewards or subscriptions may require manual review rather than automatic processing. We use this information to operate the program, administer subscription credits, prevent abuse, and maintain appropriate records.
When a public security report is accessed, Viglar uses a SHA-256 hash of the requesting IP address and a request counter to enforce rate limits and prevent abuse. Rate-limit records are automatically deleted after 24 hours. This processing helps protect the security and availability of the Service.
Depending on the purpose, Viglar processes personal data on the following legal bases under applicable data-protection law:
| Purpose | Legal basis |
|---|---|
| Providing monitoring, scans, alerts, and other requested Viglar features | Performance of a contract or steps taken at your request before entering into a contract. |
| Creating and managing your account, authentication, email verification, and password reset | Performance of a contract or steps taken at your request before entering into a contract. |
| Security, abuse prevention, rate limiting, server logging, and preventing unauthorised use of the service | Our legitimate interests in operating, securing, maintaining, and protecting the service. |
| Understanding registration sources and measuring the effectiveness of our own promotional activities | Our legitimate interests in operating, securing, maintaining, and protecting the service. |
| Subscription, payment, and earned reward credit administration | Performance of a contract and, where applicable, compliance with legal obligations. |
| Protection of accounts and prevention of brute-force attacks | Our legitimate interests in operating, securing, maintaining, and protecting the service. |
| Compliance with applicable legal and accounting obligations | Compliance with a legal obligation. |
Viglar does not require your name, telephone number, or home address to provide the service. Payment processing is handled by Stripe. Your full payment card details are processed by Stripe and are not stored on Viglar's own servers.
We use a session cookie to keep you logged in and a language-preference cookie. These cookies are necessary for the operation of the service and are not used for tracking or advertising. We do not use third-party analytics or advertising cookies.
We use a small first-party analytics system to understand how visitors use the Viglar website and to improve our website and services. It does not use third-party analytics services, tracking pixels, browser fingerprinting, or analytics cookies. When you visit a public Viglar page, your IP address may be temporarily processed to generate a daily pseudonymous visitor identifier and to determine your country for aggregated traffic statistics. The IP address itself is not stored in the analytics database. The daily visitor identifier changes each day and is not intended to identify you personally. We may store the pseudonymous visitor identifier, country, page path, referring website hostname, device category, and date and time of the visit. IP geolocation is performed locally using the DB-IP Lite database; the IP address is not sent to DB-IP for individual lookups. Analytics data is retained for up to 90 days and is automatically deleted thereafter. We use this information for aggregated website statistics, technical diagnostics, and improvement of our services. The processing is based on our legitimate interest in maintaining, securing, measuring, and improving the website and our services. IP geolocation data is provided by DB-IP. When you visit Viglar through a link containing campaign parameters, we may temporarily store these parameters in our first-party session so they can be carried across pages. If you create an account, the attribution information may be associated with your account. This may include the referring website hostname, landing page path, UTM source, medium, campaign, content and term parameters, country, and device category. This information is used to understand how users discover Viglar and to measure the effectiveness of our own promotional activities. We do not send this attribution information to advertising platforms or use it for cross-site tracking or advertising profiles. Registration attribution is retained as part of your account data and is deleted when your account is deleted.
We retain personal data only for as long as reasonably necessary for the purposes described in this policy. Scan history, scan results, and associated alerts are automatically deleted after 90 days. Website content snapshots are limited to the 10 most recent snapshots per domain. Incident evidence is automatically deleted after 90 days. Viglar Events history is retained according to event type and incident status: resolved incident records are automatically deleted 180 days after resolution, or 180 days after detection if no resolution timestamp is available. Related change and recovery events are retained until the associated incident expires. Open incidents and their related events are retained while the incident remains open. Standalone change events are automatically deleted after 180 days. Quick Check IP logs are automatically deleted after 30 days. Website analytics data is automatically deleted after 90 days. Registration attribution is retained as part of the associated account data and is deleted when the account is deleted. Standard Apache web-server logs are rotated automatically and retained for approximately 14 log rotations. Deleting a domain deletes its associated monitoring data, including scan history, scan results, alerts, content snapshots, incident evidence, and Viglar Events history. Some information may need to be retained longer where required by law or where necessary to establish or defend legal claims. DMARC aggregate reports, their associated database records, and source emails are automatically deleted 90 days after receipt.
Viglar does not sell your personal data. For IP reputation checks, we may query public reputation and blocklist services such as Spamhaus, SpamCop, Barracuda, and SORBS; the IP address being checked may be sent to the relevant service. Email is sent using Viglar's own mail infrastructure. If you configure Telegram notifications, relevant alert information is sent to the Telegram Bot API. If you configure Slack, Discord, or a custom webhook, relevant alert information is sent to the destination you configured. Such notifications may include the monitored hostname, severity, and alert message; custom webhooks may additionally receive the domain identifier, scan type, and timestamp. You are responsible for the external destination you configure. When DMARC report collection is enabled for a verified domain, email providers and reporting organisations may send aggregate DMARC reports to Viglar. Viglar processes these reports to provide email authentication analytics. The reports contain technical email authentication and delivery metadata rather than the contents of email messages.
Some third-party services used by Viglar may process personal data outside the European Economic Area. Where applicable, such transfers are carried out using legally recognised safeguards required by applicable data-protection law. Stripe provides information about its applicable international data-transfer mechanisms in its current Data Processing Agreement and related documentation.
Depending on applicable law and the circumstances, you may have the right to access your personal data, request correction or deletion, request restriction of processing, object to processing based on legitimate interests, and receive certain data in a portable format. Where processing is based on consent, you may withdraw that consent at any time. To exercise your rights, contact contact@viglar.com. We may need to verify your identity before fulfilling a request. You also have the right to lodge a complaint with the competent data-protection supervisory authority.
You can delete individual domains or your entire account directly from the dashboard. Account deletion removes your account and its associated monitoring data. A keyed hash of the email address, deletion date and limited deletion metadata may be retained for operational history and abuse prevention; the raw deleted email address is not retained in that history.
Passwords are stored using secure one-way hashing rather than in plain text. Access to account and monitoring data is restricted to the relevant account. Viglar uses HTTPS and other reasonable technical and organisational measures designed to protect personal data. No method of transmission or storage can be guaranteed to be completely secure.
We may update this Privacy Policy when the Viglar service, applicable law, or our data-processing practices change. The latest version will be published on this page together with its effective date. For material changes, we may provide additional notice where required by law.
Questions about this Privacy Policy or your personal data: contact@viglar.com.