Legal
Privacy Policy
Last updated: May 17, 2026
This Privacy Policy explains how Vgil ("we", "us", or "our") collects, uses, and protects personal information you provide when joining our waitlist at vgilai.com. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA"), and other applicable data protection laws.
1.Who We Are (Data Controller)
Vgil is operated by Infohouse of GRC Tech ("the Company"). For the purposes of GDPR and other applicable data protection laws, the Company is the data controller responsible for your personal information.
For any questions about this policy or how we handle your data, contact us at privacy@vgilai.com.
2.What Personal Data We Collect
We collect only what you choose to provide when signing up for our waitlist. Only your email address is required — all other fields are optional.
| Field | Required | Purpose |
|---|---|---|
| Email address | Yes | To manage your waitlist position and notify you when access is ready |
| Full name | No | To personalise our communications with you |
| Phone number (with country code) | No | To contact you directly about your access, if preferred |
| Company name | No | To understand the types of organisations interested in Vgil |
| Job role | No | To prioritise beta access and shape product features for your use case |
| Company size | No | To prioritise beta access and inform product development |
| AI compliance / security concern (free text, max 300 chars) | No | To directly inform our product roadmap — we read every response |
We do not collect special category data (health information, racial or ethnic origin, political opinions, biometric data, or similar sensitive data). We do not use cookies for tracking, analytics, or behavioural advertising.
3.How We Use Your Data
We use your information solely for the following purposes:
- ▶To manage your position on the waitlist and notify you when early access becomes available.
- ▶To prioritise beta access based on your role, company type, and stated use case.
- ▶To send you a single confirmation when you sign up, and relevant product updates as we approach launch.
- ▶To understand the aggregate needs of prospective customers and shape product development.
- ▶To respond to any questions or requests you send us directly.
We will not use your data for automated profiling or decision-making that produces legal or similarly significant effects on you.
4.Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 GDPR:
Consent — Article 6(1)(a)
By submitting the waitlist form, you consent to us collecting and processing your personal information for the purposes described above. You may withdraw consent at any time by contacting privacy@vgilai.com. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
Legitimate Interests — Article 6(1)(f)
We have a legitimate interest in understanding who is interested in our product so we can build features that address real needs. We have balanced this interest against your rights and concluded it does not override them, given the limited and entirely voluntary nature of the data we collect.
5.Data Sharing and Sub-processors
We do not sell, rent, or trade your personal information to any third party. We share data only with the following sub-processor, strictly to operate our waitlist service:
| Sub-processor | Location | Purpose |
|---|---|---|
| Supabase Inc. | Frankfurt, Germany (EU) | Database storage for waitlist entries |
| Google Cloud | Belgium (EU) | Hosting and request logs for this website |
We may also disclose your data where required by applicable law, regulation, or a valid legal process (such as a court order), or where necessary to protect the rights, property, or safety of Vgil, our users, or the public.
6.International Data Transfers
Your data is stored within the European Union, on infrastructure operated by Supabase Inc. in Frankfurt, Germany. The website itself is served from Google Cloud in Belgium.
If you are located in the EEA, your personal data therefore does not leave the EEA in the ordinary course of our processing, and no third-country transfer safeguard is required for it.
If you are located in the United Kingdom or Switzerland, your data is transferred to the EEA, which benefits from an adequacy decision in both cases. Where any onward transfer to a third country is necessary, we rely on Standard Contractual Clauses approved by the European Commission under Article 46(2)(c) GDPR.
7.Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes set out in this policy:
- ▶Waitlist data is retained until the beta programme concludes, or for a maximum of 24 months from the date of sign-up, whichever is sooner.
- ▶If you become a paying customer, your data will be retained in accordance with our customer data retention policy, which we will provide at that time.
- ▶You may request deletion of your waitlist data at any time — see Section 8.
8.Your Rights
EU / EEA / UK Residents — GDPR
You have the following rights regarding your personal data. To exercise any of them, email privacy@vgilai.com. We will respond within 30 days.
Right of Access (Art. 15)
Request a copy of the personal data we hold about you.
Right to Rectification (Art. 16)
Request correction of inaccurate or incomplete data.
Right to Erasure (Art. 17)
Request deletion of your personal data ("right to be forgotten").
Right to Restriction (Art. 18)
Request that we limit how we process your data in certain circumstances.
Right to Data Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to Object (Art. 21)
Object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
You also have the right to lodge a complaint with your local supervisory authority. Find your national EU authority at edpb.europa.eu/about-edpb/board/members. In the UK, the relevant authority is the Information Commissioner's Office (ICO) at ico.org.uk.
California Residents — CCPA / CPRA
California residents have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Right to Know
Request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for which we use it.
Right to Delete
Request deletion of personal information we have collected from you, subject to certain legal exceptions.
Right to Correct
Request correction of inaccurate personal information we maintain about you.
Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights.
Right to Opt-Out of Sale / Sharing
We do not sell or share your personal information for cross-context behavioural advertising. No opt-out is required, but you may confirm this at any time by contacting us.
To submit a CCPA/CPRA request, email privacy@vgilai.com with the subject line "Privacy Request — California". We will verify your identity before processing your request and respond within 45 days.
9.Cookies and Tracking
Our website uses only technically necessary cookies required for the site to function (such as session management). We do not use analytics cookies, advertising cookies, or any third-party tracking technologies. No third-party advertising networks operate on vgilai.com.
Because we do not set non-essential cookies, no cookie consent banner is currently required. If this changes, we will update this policy and obtain your prior consent before setting any non-essential cookies.
10.Children's Privacy
Vgil is a B2B product intended for business professionals aged 16 and over. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has submitted their information to us, please contact privacy@vgilai.com and we will delete it promptly.
11.Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated by updating the "Last updated" date at the top of this page and, where appropriate, by notifying you via the email address you provided. We encourage you to review this page periodically.
12.Contact Us
For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please reach out to our privacy team:
Vgil Privacy Team
Email: privacy@vgilai.com
GDPR requests: responded to within 30 days of receipt. CCPA/CPRA requests: responded to within 45 days of receipt.