Privacy

What we store about you

The email address and password you sign up with, handled by our authentication provider. We never see the password itself.

If you sign in with Google instead, Google tells us your email address and your name, and nothing else. Those two are used to create your account and to recognise you when you come back. DueVigil never gets access to your Gmail, your contacts, your calendar, or anything else in your Google account, and it cannot act on your behalf there.

Your business name, reply-to address, default currency, default payment terms, and whether you want the daily digest and weekly summary. That is the whole of your profile.

What we store about the people you invoice

Only what you type in: the client's name, an optional contact person, their email address, and the invoices you record against them — number, amount, currency, issue and due dates, an optional link, and an optional short note that goes into the reminder.

We also keep the notes you write yourself, and any message a recipient leaves when they use the "I already paid" link.

Recipients never have an account and are never asked to make one.

What we keep about the emails

For every reminder: when it was scheduled, when it was sent, and what our email provider reported back — delivered, opened, bounced, or marked as spam.

That record exists for one reason. If reminders start bouncing, sending must stop, both to protect the recipient and to keep the sending domain usable for everyone else on it.

We also keep a copy of each reminder as it was sent — its subject line and text — so that you can see in the app exactly what your client received. It is deleted together with the invoice. Nobody at DueVigil reads it; the only exception is looking into a problem you have asked us to help with.

Your responsibility for recipients

You are responsible for having a genuine business reason to contact the people you add: an invoice you issued to them. DueVigil is not for lists you bought, scraped, or inherited.

Every reminder carries an unsubscribe link that works without logging in. Once someone uses it, DueVigil never emails them again for any invoice, from you or from anyone.

Who else processes it

Supabase stores the database and handles sign-in. Resend sends the email. Vercel runs the site. Sentry receives error reports, configured not to send personal data with them.

Paddle handles payment. They are the seller of record for DueVigil, which means that when you subscribe you are buying from them and they invoice you. Your card details go to Paddle and never reach us: we are told that an account is paid and until when, and nothing more.

Nothing is sold, and nothing is shared with anyone else.

Cookies and tracking

Three cookies work without being asked about, because the site cannot do its job without them: one keeps you signed in, one remembers which language you chose, and one remembers your answer to the question below. None of them follows you anywhere.

If you agree, we load Google Analytics. It records which pages get read, where people leave, and three moments inside the app: an account being created, a client being added, and an invoice being saved. Those three are recorded as bare events — no name, no email address, no invoice number, no amount, nothing about the work or the money. Analytics sets its own cookies and sends what it records to Google, and it is not fetched at all until you say yes.

You are asked once, in a bar at the bottom of the page where refusing takes exactly as many clicks as agreeing. The answer is kept for six months and then we ask again. To change it sooner, clear this site's cookies in your browser and the question comes back.

Google Ads is linked to that Analytics account, which is how we can tell whether an advert we paid for led to somebody signing up. It has no tag of its own on this site, and it is told nothing that Analytics was not already told. Two other third-party scripts exist, each on one page and nowhere else: Paddle's on the settings page, which draws the payment window and sets its own cookies for the payment and for fraud checks, and Soro's on the blog page, which is where the articles come from.

Keeping and deleting

Your data stays while your account exists. Ask us to delete the account and everything above goes with it: clients, invoices, reminders, notes and delivery records.

You can also delete individual invoices and archive clients at any time from inside the app.