Last updated: November 2026
BeVigil is operated by Travis William Stapleton (ABN 95 547 244 703).
BeVigil collects information you provide when creating an account (name, email, organisation or business details), information generated through use of the platform (shift records, attendance logs, location data while clocked in, incident reports, checkpoint scans, venue coverage requests), and technical information (IP addresses, browser type, usage analytics). To send push notifications we store a notification token for each device you sign in on; it's removed from your account when you sign out on that device. Security companies can choose to make basic listing details (name, tagline, description, contact info) visible to venues in our public company directory.
We use your information to provide and improve the BeVigil platform, process payments, send notifications about shifts and safety events, generate reports, and comply with legal obligations. We do not sell your personal information to third parties.
BeVigil collects guard location data only while a guard is clocked in on shift, and only with explicit consent obtained through the mobile app. Location data is retained for 48 hours and is accessible only to managers within the same organisation. Guards can view their own location history. If a guard has no signal, clock-ins, checkpoint scans and incident reports (including their photos) are stored on the guard's own device and sent automatically once a connection returns; incident reports keep the time the guard submitted them and also record when our servers received them.
We share data with these service providers, each only for its purpose: Supabase (database, file storage and sign-in, hosted in Sydney, Australia), Vercel (web hosting, run in Sydney), Stripe (payment processing), Resend (email delivery), Expo (mobile push notifications), Sentry (error monitoring), Backblaze (an encrypted backup copy of uploaded files, which Backblaze cannot read), OpenStreetMap's Nominatim service (turning site addresses into map locations), Xero (accounting, only if your organisation connects it) and Google Analytics (aggregated website usage statistics). Anthropic's Claude is used to draft incident reports when a manager asks for an AI draft (it receives that incident's text) and to parse inbound venue coverage-request emails, which are routed via Cloudflare (email receiving). When you submit a guard's licence details for automated verification, that information is sent directly to the relevant government licensing authority (ACT, NSW) or, for Queensland, to WorkClear, a third-party verification provider, solely to confirm licence status. Some of these providers store or process data outside Australia, mainly in the United States (Resend, Expo, Sentry, Anthropic, Google Analytics, and Backblaze, which keeps the encrypted backup copy); Stripe, Cloudflare and Xero operate globally. We take reasonable steps to ensure these providers protect personal information consistently with the Australian Privacy Principles. All providers are bound by data processing agreements where applicable. We may disclose data if required by law.
BeVigil uses cookies and browser local storage to keep you signed in and remember your session. We also store your chosen language in a cookie, and, when we are testing a change to a public page, a cookie recording which version of that page you were shown. Our payment processor (Stripe), error-monitoring provider (Sentry) and website analytics provider (Google Analytics) also set their own cookies or local storage when you use the platform, for fraud prevention, diagnosing technical issues, and measuring how the website is used, respectively. We don't use advertising or cross-site tracking cookies. You can control cookies through your browser settings, though blocking essential ones may prevent you from signing in.
Account data is retained for the duration of your subscription. After a subscription is cancelled we keep it for 90 days, and after a free trial ends without a subscription for 60 days; we email the account owner 30 and 7 days before, with a way to export everything, and then permanently delete it. Location ping data is automatically deleted after 48 hours. Incident photos and videos are kept for the minimum period required by the licensing rules of the state where the incident happened, then deleted automatically; where a state's minimum isn't confirmed, they're kept until your organisation deletes them. You can delete your account and personal data yourself at any time from the app (guards: Profile → Delete account; managers/admins: Account, in the web dashboard sidebar; venues/businesses: Account, in the venue portal) — this removes your login and personal data immediately. Shift, attendance, and incident records are kept in anonymised form, since your organisation needs those for payroll and compliance; a venue account's own coverage requests are deleted outright, since they aren't shared organisational records. You can also contact us to request deletion.
BeVigil uses industry-standard security measures including row-level security, encrypted connections (HTTPS/TLS), and secure authentication. We regularly review our security practices.
Under Australian Privacy Act obligations, you have the right to access, correct, or delete your personal information. You can delete your own account directly in the app (see Data retention above) or contact us at hello@bevigil.com.au to exercise these rights.
For privacy-related enquiries, contact us at hello@bevigil.com.au.