1. Controller and contact
WriteIt.ai s.r.o., ID 04518136, Na Folimance 2155/15, Vinohrady, 120 00 Prague 2, Czech Republic, Commercial Register of the Municipal Court in Prague, C 247717, operates Vigent and acts as controller for the website and account data described here. Contact support@vigent.legal or our registered office.
2. Data and purposes
When you sign in, we process your verified email, account identifier, creation time and relevant identity-provider information to provide and secure your account. Session identifiers, sign-in transactions, credential hashes, API-key labels/prefixes/expiry/revocation and security records support authentication and access control. We do not store the plaintext API key for later retrieval. Technical data such as connection information, timestamps and errors helps us operate and protect the service. Sign-up attribution can include the referring domain and campaign parameters supplied in the sign-in link, or a direct-visit marker. Communications are used to handle your requests.
3. Legal bases
Account provision and requested service communications rely on performing or preparing our agreement with you. Security, abuse prevention, diagnostics and source attribution rely on our legitimate interests in operating and understanding the service, balanced against your rights. Records required by accounting or other applicable law rely on legal obligations. Consent is requested separately where legally required; accepting terms does not substitute for it.
4. Providers and recipients
Our infrastructure uses Hetzner hosting and Google Cloud infrastructure/secret storage. DNS and domain services use Cloudflare. If you choose Google sign-in, Google processes its identity-provider step. Transactional sign-in email uses Brevo when enabled. Providers receive only the data their function requires and act under applicable agreements or their own identity-provider terms. We may disclose data where legally required, or to protect rights and investigate abuse. Your external agent provider processes information under its own terms; this website does not operate that agent.
5. Cookies and browser storage
The account uses necessary Secure, HttpOnly session and short-lived sign-in-binding cookies. Access tokens expire within 15 minutes; server-side sessions expire and can be revoked. API keys and login tokens are not persisted in localStorage or sessionStorage. The site has no advertising cookies. Optional analytics is not enabled in this foundation, and no analytics identifier is stored by it. Campaign attribution is carried in URLs rather than browser storage.
6. Retention and security
Account information is retained while needed to provide the account and handle legitimate legal/security obligations. Sign-in links expire within 15 minutes, sessions have bounded lifetimes and revoked/expired credentials no longer authorise access. Expiry is not a promise of immediate deletion of the related record. We retain security and support records only for the purposes and legal obligations that justify them, and review retention when operational systems change. Backups may retain copies until replaced under the applicable retention process. We apply access controls and protect credentials; no system can promise absolute security.
7. International processing
Some providers or their support operations may process data outside the EEA. Where an international transfer requires safeguards, we rely on an applicable adequacy decision or contractual safeguards such as the European Commission's standard contractual clauses, with additional measures as required. Contact us for information about the safeguards relevant to your data.
8. Your rights
Subject to applicable conditions, you can request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can withdraw any separately given consent without affecting earlier lawful processing. Contact support@vigent.legal for account access/export/deletion requests; we may need to verify identity. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz, or your competent supervisory authority. These rights and legal response deadlines are not limited by this policy.
9. Changes
We update this policy when relevant processing changes. The effective date identifies the published version. We give any further notice required by applicable law.