Privacy Policy
Last updated 20 October 2026
Who we are
Vigil is an AI IT-support agent for Windows endpoints, provided by Rora Labs Ltd (trading as RoraLabs), a company registered in England & Wales, company number 17174536, registered office Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, England. ICO registration ZC152425. Contact: [email protected].
Roles. For the data Vigil processes about an organisation's endpoints and staff, the organisation (for example an MSP or IT team) is the controller and RoraLabs is its processor under the DPA. For account, billing and website data, and for individual (consumer) users, RoraLabs is the controller.
What the Vigil agent collects
| Data | Purpose | Basis |
|---|---|---|
| Device identifiers: hostname, serial number, machine ID | Identify the device and enrol it to your tenant | Contract |
| Signed-in username | Attribute issues and actions to a user | Contract / legitimate interests |
| Windows event logs and process lists relevant to a reported issue | Diagnose and fix the issue | Contract / legitimate interests |
| Issue descriptions you type, and the actions Vigil takes | Provide the service and keep an audit trail | Contract |
| Account data: name, email, organisation | Run your account and billing | Contract |
Vigil reasons locally on the device by default. See the cloud fallback below.
Cloud AI fallback
If the local model cannot resolve an issue, Vigil may send the issue text and relevant system context to our cloud AI provider, Anthropic (US), to obtain a diagnosis. This is the only routine disclosure of endpoint context to a third party. A per-tenant setting allowing an organisation to disable cloud fallback is being introduced; until it is available in your tenant, contact us to have it disabled.
Retention
Device and event data are retained for 90 days. After 90 days operational records are either cleared or pseudonymised (identifiers replaced with a keyed hash) so that they can no longer be attributed to an individual without the key. Account and billing records are kept as long as the account is active and then for the period required by tax law.
Website analytics and cookies
vigil.roralabs.co.uk sets no cookies of its own and uses first-party, cookieless page-view analytics on our own server. See the RoraLabs privacy notice.
Sub-processors
The full list, with locations and transfer mechanisms, is on the sub-processor page.
International transfers
Some sub-processors are in the United States. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified.
Your rights
Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing, to data portability, and to withdraw consent where we rely on it. Email [email protected]; we respond within one month. You may complain to the Information Commissioner's Office at ico.org.uk. If your data is processed on behalf of an organisation, please contact that organisation first.
Complaints
If you want to complain about how we handle your personal data, email us first at [email protected]. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the ICO (ico.org.uk).
Children
Vigil is not directed at children under 13 and we do not knowingly collect their data.
Changes
We will update this page and its date when this policy changes, and notify account holders of material changes.