Privacy Policy

1. Introduction

Guardia-AI ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI compliance assessment service.

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

Guardia AI Ltd, a company registered in England and Wales (company number 17326182) with its registered office at 20 Wenlock Road, London, N1 7GU, United Kingdom, is the data controller for personal data processed through our service. For questions about this policy, contact us at privacy@guardia-ai.com.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Company name (if provided)
• Password (stored securely hashed)

3.2 Assessment Data

When you use our assessment tools, we process:

• AI system descriptions and use cases
• Prediction data uploaded for bias analysis (CSV files)
• Documentation inputs for Annex IV reports
• Risk classification inputs

3.3 Usage Data

We automatically collect:

• Log data (IP address, browser type, access times)
• Feature usage analytics
• Audit log entries (actions taken in the platform)

3.4 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers. Stripe's privacy policy applies to payment data.

4. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Process your assessments and generate reports
• Manage your account and subscription
• Send important service updates
• Improve the Service based on usage patterns
• Comply with legal obligations

5. Data We Do NOT Use

We do not use your uploaded data to train AI models. Your prediction data, AI system descriptions, and other assessment inputs are processed only to provide the requested service and are never used for machine learning training purposes.

6. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract: To provide the Service you've signed up for
• Legitimate interests: To improve and secure the Service
• Legal obligation: To comply with applicable laws
• Consent: For marketing communications (where applicable)

7. Data Retention

We retain your data as follows:

• Account data: Until you delete your account
• Assessment data: Until you delete it or close your account
• Audit logs: 7 years (for compliance purposes)
• Uploaded CSV files: Deleted after processing (not stored long-term)

8. Data Sharing

We share data only with:

• Service providers: Hosting (EU-based), authentication (Supabase), payments (Stripe)
• Legal requirements: When required by law or to protect rights
• Business transfers: In case of merger or acquisition (with notice)

We do not sell your personal data.

9. International Transfers

We primarily process data within the European Economic Area (EEA). If data is transferred outside the EEA, we ensure appropriate safeguards such as Standard Contractual Clauses.

10. Your Rights (GDPR)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities
• Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at privacy@guardia-ai.com. We will respond within 30 days.

11. Data Security

We implement appropriate technical and organizational measures including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

12. Cookies

We use essential cookies for:

• Authentication and session management
• Security features
• User preferences (theme, language)

We do not use advertising or tracking cookies. Analytics are privacy-focused and anonymized.

13. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service before they take effect.

15. Contact Us

For privacy-related questions or to exercise your rights:

Email: privacy@guardia-ai.com
Data Protection Officer: dpo@guardia-ai.com
Guardia AI Ltd, 20 Wenlock Road, London, N1 7GU, United Kingdom

16. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.