1. Who we are
PointVigil (part of the Meerkat Cloud product family) is operated by Dibene Technology Solutions (Pty) Ltd ("PointVigil", "we", "us"), a company registered in South Africa. We are the responsible party / data controller for personal information processed through the service. Questions about this policy can be sent to jdevilliers@dibene.co.za.
2. What PointVigil does
PointVigil watches the Microsoft SharePoint document libraries you choose and emails a digest of what changed — new files, edits, moves and deletions — on the schedule you set. It connects to your Microsoft 365 tenant with read-only access that your administrator approves.
3. Information we process
- Account & contact data — the name, work email address, organisation and Microsoft tenant identifier of the people who sign in or are invited, and the billing contact you provide.
- SharePoint change metadata — file and folder names, change type (created, modified, moved, deleted), timestamps, the display name of the person who made a change, and links back into SharePoint. We read this through the Microsoft Graph API to build your digests. We do not copy, store or read the contents of your files.
- Deletion records from the Microsoft 365 audit log — Microsoft's change feed does not say who deleted a file, so for deletions we also query your tenant's Microsoft 365 (Microsoft Purview) audit log for SharePoint file and folder deletion events and read the file name, folder, time and the sign-in email address of the person who deleted the item. We request deletion events only, keep them in memory while we match them to a change, and the person's sign-in address then appears in the digest your recipients receive. We do not read other audit-log activity or the contents of any file.
- Recipient data — the email addresses you configure to receive each library's digest.
- Billing data — your subscription status, plan and Paystack subscription references. Card and payment details are handled directly by our payment processor; we never see or store full card numbers.
- Technical & usage data — standard server logs (such as IP address, request time and delivery outcomes) used to run, secure and troubleshoot the service.
4. Microsoft 365 access & permissions
Access to your tenant is granted by a Global Administrator through Microsoft's own consent screen. PointVigil requests the minimum permissions it needs: Sites.Read.All (read library changes), Organization.Read.All (read basic tenant details) and AuditLogsQuery-SharePoint.Read.All (read the SharePoint entries of the Microsoft 365 audit log, used only to show who deleted a file). These are read-only with respect to your content. Showing who deleted a file requires auditing to be turned on in your Microsoft 365 tenant, which it is by default; if it is off or the permission is not granted, digests simply show deletions without a name. PointVigil does not ask for permission to send email in your tenant: digests are sent from PointVigil's own mailbox (no-reply@pointvigil.com) to the recipients you choose. You can revoke PointVigil's access at any time from the Microsoft Entra admin centre, which immediately stops all processing.
5. How we use information
- To provide the core service — detecting changes and delivering digest emails.
- To manage your account, subscription and billing.
- To provide support and to secure, maintain and improve the service.
- To comply with legal obligations.
6. Legal basis
Where the POPIA (Protection of Personal Information Act, South Africa) or the GDPR applies, we process personal information on the basis of performing our contract with you, our legitimate interests in operating and securing the service, your consent (which you may withdraw), and compliance with law.
7. Sharing and sub-processors
We do not sell personal information. We share it only with service providers who help us run PointVigil, under appropriate safeguards:
- Microsoft Azure — hosting and database, in the South Africa North region.
- Paystack — payment processing for subscriptions.
We may also disclose information where required by law.
8. International transfers
Your data is primarily hosted in South Africa. Where a sub-processor processes data outside your country, we rely on appropriate safeguards and the protections those providers offer.
9. Retention
We keep account, configuration and billing data for as long as your subscription is active and as needed afterwards to meet legal and accounting obligations. Change metadata is retained only as long as needed to build and deliver your digests and maintain delivery reliability. When you close your account, we delete or anonymise personal information within a reasonable period, except where we must retain it by law.
10. Security
We protect information with measures appropriate to its sensitivity, including encryption in transit (HTTPS/TLS), secrets stored in a managed key vault, access through a least-privilege managed identity, and read-only Microsoft 365 permissions. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.
11. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal information, object to or restrict certain processing, and withdraw consent. To exercise these rights, contact jdevilliers@dibene.co.za. You also have the right to lodge a complaint with the Information Regulator (South Africa) or your local data-protection authority.
12. Cookies
PointVigil uses only an essential sign-in cookie needed to keep you authenticated. We do not use advertising or third-party tracking cookies.
13. Children
PointVigil is a business tool and is not intended for use by anyone under 18.
14. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the date above and, where appropriate, by notifying you.
15. Contact
Dibene Technology Solutions (Pty) Ltd — Information Officer
Email: jdevilliers@dibene.co.za