This is the same text you accept in the app.
Privacy Policy
Last updated 26 September 2026
1. The short version
Vigilo keeps your vehicle records on your own phone first, and syncs them to your account so you can sign in on another phone. We do not sell your data, we do not show you advertising, and we do not track you across other apps or websites. Your location and your carte grise photos never leave your phone.
Two things are sent to help us improve the app, and both are on unless you turn them off: the text read from your scans ("Improve scanning"), and usage data about how the app is used ("Anonymous usage data"). You choose both during sign-up and can change them at any time in Settings.
The data controller is the publisher of Vigilo. Contact: support.vigilo@tiwizix.com.
2. What we collect
Your account. Your first and last name, your date of birth, your email address, your country, how you sign in (an emailed code, Google or Apple) and, if your sign-in provider supplies one, your profile photo. If you add a phone number for account recovery, we store it once a text message has verified it. Adding one is optional.
Your vehicles. For each vehicle you add: its registration number, make, model, engine, fuel, gearbox, year and type of rear brakes; its mileage and the dates you updated it; the maintenance you record, with its date and mileage; and the dates on its papers, such as insurance, vignette, contrôle technique and registration.
Your settings. Your language, appearance, main vehicle, reminder choices, quiet hours and privacy switches, so they follow your account to a new phone.
Sharing. When you invite someone, the email address you invited, the access you gave them and when it changed. We keep a record of past shares so "who has had access to this vehicle" stays answerable, even after access ends.
Your phones. For each phone signed in to your account: an identifier for the installation, and a token that lets us send it a notification. It is deleted when you sign out on that phone.
Purchases. If you buy Pro, the store tells us which plan you bought, when, and until when. We never receive your card or bank details.
Scan contributions — if "Improve scanning" is on. See section 4.
Diagnostics. When the app crashes or hits an error, we receive a report: what went wrong, the app version, the phone model and operating system. We also receive a replay of the last minute or so of the screen before the error, so we can see what led to it. See section 5 for what the replay hides.
Usage data — if "Anonymous usage data" is on. See section 5.
Security signals. To stop abuse of sign-up and of the codes we send, we use your IP address, reduced to an irreversible fingerprint, to count requests, and we check with Apple or Google that requests come from a genuine copy of the app.
3. What stays on your phone
Your location. If you allow it, Vigilo notices when you stop at a fuel station, so it can ask for your mileage when the odometer is in front of you. Your position is compared on your phone with a list of stations stored on your phone. It is never sent to us or anyone else, and no history of where you go is kept.
Your carte grise photos. When you scan a carte grise, the photo is read on your phone. It is never uploaded or kept.
Your OBD-II dongle. If you connect one, Vigilo talks to it over Bluetooth on your phone. The identifier the vehicle reports is used on your phone, to check it is the right vehicle. The mileage it reads is saved to your vehicle like a reading you typed.
4. Scan contributions ("Improve scanning")
When you scan a carte grise, the scanner can misread. To measure and improve it, Vigilo records what the scanner read and what you corrected.
What is sent. The printed labels of the card, the positions of the text on the card, and for each field what was read, what you kept or corrected, and how confident the scanner was. Personal details — your name, your address, your identity numbers — are removed, or reduced to their shape (for example "a letter, then six digits") before anything is written. The record is linked to your vehicle and your account so we can compare it with the values you confirmed. It never contains a photo.
How it is protected. Each record is encrypted on your phone before it leaves it, with a key that only we hold, offline, outside our servers. Our servers store it unread. The link to your account is inside the encrypted part. On our servers the record carries only a coded tag, which lets us erase your contributions on request.
Your choice. The switch is on for a new account. You can turn it off during sign-up or at any time in Settings. When it is off, nothing is recorded, and anything not yet sent is deleted from your phone. "Delete my scan contributions" in Settings erases everything your account has already sent, from every phone.
How long. We keep contributions until you delete them or delete your account, and no longer than we need them to improve the scanner.
5. Crash reports and usage data
Crash reports are handled by Sentry, in the European Union. They are needed to keep the app working and are sent whether or not usage data is on.
Usage data is handled by PostHog, in the European Union. It covers which screens you open, in what order, which features you use, and — for about one visit in five — a recording of the screen, so we can see where the app is hard to use. It is not linked to your name or email: it is tied to a random identifier for your installation. Your IP address is discarded. It starts with sign-up, never on the welcome screen, and never before you have made the choice.
What recordings hide. Everything you type is hidden. So are registration numbers, email addresses, phone numbers and names wherever they appear on screen, your profile photo, the carte grise screens as a whole, and the camera. Buttons, titles and the layout of each screen stay visible, because that is what shows us where a driver got stuck.
Your choice. "Anonymous usage data" is on for a new account. You can turn it off during sign-up or at any time in Settings. Turning it off stops recording at once.
6. Why we use it, and on what basis
- To provide the service you signed up for: your account, your vehicles and their schedule, reminders, sync between your phones, sharing, and Pro. This is necessary to perform our agreement with you.
- To keep the service secure and working: preventing abuse, fixing crashes. This is our legitimate interest, and necessary to protect your account.
- To improve the scanner and the app: scan contributions and usage data. This is based on your consent, which you can withdraw at any time in Settings.
- To meet legal obligations, such as keeping purchase records.
We do not use your data for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.
7. Who else sees it
People you invite. When you share a vehicle, the people you invite see what you allow them to see. When someone with edit access changes it, you may be told their name and what changed. You choose who, and you can withdraw it.
Our service providers, who process data only on our behalf and under contract:
- Google Firebase — accounts and sign-in, the database (stored in Belgium, EU), backend functions, notifications, and app integrity checks;
- Sentry (EU) — crash reports;
- PostHog (EU) — usage data;
- RevenueCat (United States) — reads your App Store or Google Play purchase to tell us whether you are on Pro, using your account identifier;
- Apple and Google — the app stores and their payment systems, and sign-in if you choose it;
- an email delivery provider — to send your sign-in codes and sharing invitations.
We do not sell your personal data, and we do not share it for advertising.
8. Where it is processed
Your records are stored in the European Union. Some providers above — RevenueCat, and parts of Google, Apple, Sentry and PostHog's infrastructure — may process data outside Morocco and the EU, including in the United States. Where a transfer goes to a country the CNDP does not list as adequate, we do it only with the authorisation or safeguards Moroccan law requires.
9. How long we keep it
We keep your account and vehicle data while your account exists.
When you delete your account, your records are encrypted and made unreadable immediately, your sign-in is disabled, and your scan contributions are erased. For 30 days they can be restored if you ask us to. After 30 days the key is destroyed, and your personal data cannot be read by anyone, including us. The maintenance history of a vehicle, with nothing that identifies you, may be kept attached to the vehicle.
Crash reports are kept for up to 90 days. Usage data is kept for up to 12 months, and screen recordings for up to 30 days. Purchase records are kept as long as the law requires.
10. Your rights
Under Moroccan Law 09-08 you have the right to know whether we hold data about you and to get a copy, to correct it, to object to its use for legitimate reasons, and to have it deleted. In the app you can see and correct your details, switch off scan contributions and usage data, delete your scan contributions, and delete your account, all from Settings. For anything else, write to the address below. We answer within 30 days.
If you are not satisfied with our answer, you may complain to Morocco's data protection authority, the CNDP (www.cndp.ma).
11. Children
Vigilo is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.
12. Security
Data is encrypted in transit and at rest. Access to your records is restricted to your own account and to the people you have shared a vehicle with. Scan contributions are encrypted on your phone before they leave it. No system is perfectly secure. If a breach affecting your data occurs, we will tell you and the authorities as the law requires.
13. Changes
If we change this policy in a way that matters, we will tell you in the app before the change takes effect. If a change needs your consent, we will ask for it.
14. Contact
Questions, or a request about your data: support.vigilo@tiwizix.com