Legal
Privacy Policy
Effective 3 August 2026 · Revised 12 August 2026
Guardal Inc., which trades as Guardal Technologies ("Guardal," "we," "us," "our"), builds decision intelligence software for critical operations. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with guardal.ai (the "Site"), our supplier process, and our communications with you, and it describes the rights and choices available to you. We keep our data footprint deliberately small, and we name every service provider that touches your information below.
This policy applies to personal information we control as a business and controller. It does not apply to information we process on behalf of a customer or partner under a written agreement, where that customer or partner is the controller and its own notice governs.
1. Scope and roles
For the purposes of the European Union and United Kingdom General Data Protection Regulation ("GDPR"), Guardal is the data controller of the personal information described in this policy. For the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and other United States state privacy laws, Guardal is a business.
2. Personal information we collect
Information you provide to us. We receive only what you choose to submit:
- Newsletter: your email address, if you submit it. The footer form is the only form on this site.
- Email to us: whatever you choose to include when you write to contact@guardal.ai, which is the channel for partner inquiries, privacy requests, supplier questions and everything else.
- Booking a demonstration: the name, email address and any detail you enter on the scheduling page, which is operated by cal.com under its own notice.
Information collected automatically. Our hosting and content-delivery provider records standard server and security log data, which may include your IP address, browser and device type, referring page, pages requested, and date and time stamps, in order to deliver, secure, and troubleshoot the Site. If, and only if, you affirmatively accept analytics, we also collect aggregate, cookieless traffic and page-performance measurements. We do not build advertising or cross-context behavioral profiles, and we do not track you across other websites or services.
Information from third parties. We do not purchase personal information from data brokers.
Categories under United States law. In the terms used by the CCPA/CPRA, we may collect identifiers (name, email, IP address), professional or employment-related information (role, company, inquiry details), internet or network activity (server logs), and, only if you include it in a message, other information you choose to provide. We do not collect Social Security numbers, government identifiers, financial account numbers, precise geolocation, biometric data, or health information through the Site.
Categories, sources, purposes, and recipients. The grid below is the same information stated the way a reviewer reads it.
| Category | What it is here | Where it comes from | Why we process it | Who receives it |
|---|---|---|---|---|
| Identifiers | Name, email address, IP address | You, and standard server logs | Answering you, operating and securing the Site | Hosting, email, and form-processing providers |
| Professional or employment information | Company, role, country, what you supply | You | Answering you, evaluating supply relationships | Hosting and form-processing providers |
| Commercial information | The content of an inquiry or a supplier registration | You | Answering you, keeping our own records | Hosting and form-processing providers |
| Internet or network activity | Pages requested, referrer, browser and device type, timestamps | Standard server logs, and analytics only after you accept it | Delivering, securing, and debugging the Site | Hosting and analytics providers |
| Other information you choose to send | Anything you put in a free-text field | You | Answering you | Hosting and form-processing providers |
We retain each category for the period stated in section 8. We disclose each category to service providers under contract for the business purposes listed above, and to authorities where the law requires it. We have not sold or shared personal information as those terms are defined by the CCPA/CPRA, and we have not disclosed personal information for cross-context behavioral advertising, in the twelve months before the effective date of this policy or at any time.
3. Sensitive personal information
We do not intentionally collect sensitive or special-category personal information through the Site, and we ask that you not send it. Please keep inquiries general and releasable, and do not submit export-controlled technical data or classified information. If you send sensitive information anyway, you consent to our handling it as described here for the limited purpose of responding to you, and we will delete it when it is no longer needed.
4. How and why we use personal information
We use personal information to:
- respond to inquiries and requests, and arrange demonstrations;
- contact you about supply opportunities you registered for;
- send you news about Guardal, if you asked for it;
- handle and verify privacy requests;
- operate, maintain, secure, debug, and improve the Site;
- detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity;
- comply with legal, regulatory, and export-control obligations, and enforce our terms; and
- establish, exercise, or defend legal claims.
We do not use personal information to make decisions that produce legal or similarly significant effects about you through solely automated means.
5. Legal bases for processing (EEA, UK, and Switzerland)
Where the GDPR applies, we rely on the following legal bases:
- Consent, for analytics and for the newsletter where you opted in. You may withdraw consent at any time, without affecting processing already carried out.
- Legitimate interests, in operating, securing, and improving the Site, responding to inquiries, managing supplier relationships, and protecting our rights, where those interests are not overridden by your interests or fundamental rights.
- Compliance with legal obligations, including tax, export-control, and record-keeping requirements.
- Performance of, or steps toward, a contract, where you engage with us as a supplier or partner.
6. Cookies, analytics, and consent
We do not set advertising or cross-site tracking cookies. Your analytics choice is stored on your own device in your browser's local storage and is not transmitted to us. Our analytics, when enabled, are cookieless and aggregate. Nothing loads until you accept. You can change or withdraw your choice at any time using the Consent Preferences link in the footer of any page; declining stops the analytics from loading and reloads the page so no measurement script remains.
7. How and with whom we disclose personal information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only in the following circumstances:
- Service providers and processors, which act on our behalf under contract and are permitted to use the information only to provide services to us:
- Vercel Inc. (United States) hosts the Site, serves it over its content-delivery network, runs our form endpoint, and keeps operational request logs. If you accept analytics, Vercel Analytics and Vercel Speed Insights collect aggregate, cookieless usage and performance data.
- Airtable / Formagrid, Inc. (United States) stores what is submitted through the forms above so that we can act on it.
- Professional advisors, such as lawyers, accountants, and auditors, under duties of confidentiality.
- Corporate transactions, in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or provide notice and choice.
- Legal, safety, and export-control compliance, where we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process, or governmental request, including United States export-control and sanctions authorities, or to protect the rights, property, or safety of Guardal, our users, or others.
We do not disclose personal information to any party for that party's own independent marketing.
8. Data retention
We retain personal information only for as long as necessary for the purposes described in this policy, and then delete or de-identify it. As general guidance, and subject to legal holds and applicable law:
- inquiry and demonstration correspondence is retained for up to 24 months after the last contact;
- supplier-register records are retained for the duration of the relationship and for a reasonable period afterward;
- newsletter records are retained until you unsubscribe; and
- server and security logs are retained for a short operational period consistent with our providers' defaults.
Where the law requires a longer or shorter period, or where information is subject to a legal hold, we follow that requirement.
9. Information security
We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls and least-privilege principles, vendor security diligence, and the same adversarial testing discipline we apply to our product. We limit access to personal information to those who need it. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by applicable law.
10. International data transfers
We are based in the United States, and the service providers listed above process data in the United States. If you contact us from the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with data-transfer restrictions, your personal information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum, together with the safeguards maintained by our providers. You may request information about these safeguards using the contact details below.
11. Your privacy rights
Depending on where you live you may have some or all of the rights below, subject to legal limits and to verification. Each one is named separately so you can point at the one you want.
European Economic Area, United Kingdom, and Switzerland
- Access. Ask whether we process personal information about you and receive a copy of it.
- Rectification. Have inaccurate personal information corrected and incomplete information completed.
- Erasure. Have personal information deleted where one of the grounds in Article 17 applies.
- Restriction. Have processing restricted while an accuracy dispute or an objection is resolved.
- Objection. Object to processing carried out on the basis of our legitimate interests, and object at any time to direct marketing.
- Portability. Receive the information you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
- Automated decisions. We make no decision producing legal or similarly significant effects about you by solely automated means, so the Article 22 right has nothing to bite on here.
- Withdraw consent. Where we rely on consent, withdraw it at any time without affecting processing already carried out.
- Complain. Lodge a complaint with your supervisory authority. We ask that you contact us first so we can try to resolve it.
California
- Know and access. Learn the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes, and the categories of recipients. Section 2 states all four in advance.
- Delete. Have personal information we collected from you deleted, subject to the statutory exceptions.
- Correct. Have inaccurate personal information corrected.
- Opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of and we publish no "Do Not Sell or Share My Personal Information" link. If that ever changes, the link will appear here and in the footer before the practice starts.
- Limit the use of sensitive personal information. We do not collect sensitive personal information through the Site and we do not use or disclose it for purposes that would trigger this right.
- Equal treatment. We will not deny you service, charge you a different price, or provide a different level of quality because you exercised a privacy right. We run no financial incentive programs.
- Authorized agent. An agent may submit a request for you. We will require written proof of authorization and may still verify your identity directly with you.
- Other California rights. California Civil Code section 1798.83 lets residents request details of personal information disclosed to third parties for their direct marketing purposes. We make no such disclosures.
Other United States states
If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law, you may have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We conduct no targeted advertising, no sale, and no profiling of that kind.
How to exercise any of these
Email contact@guardal.ai and say which right you are exercising. We respond within the period the applicable law sets. We may need to verify your identity first, and we will decline a request we cannot reasonably verify. We will tell you the reason for any refusal.
Appeals
If we decline, you may appeal by replying to our decision or writing to contact@guardal.ai. We will inform you of the outcome and the reasons within the period the applicable law sets. Where your state provides one, you may also contact your Attorney General.
12. Suppliers and business contacts
If you engage with us as a supplier or business contact, we process your business-contact information to evaluate and manage the relationship, meet compliance and diligence obligations, and maintain our records. Reach us at contact@guardal.ai; there is no supplier form on this site.
13. Third-party links
The Site may link to third-party sites and services, such as our profiles on external platforms. Those services are governed by their own privacy policies, and we are not responsible for their practices. Review their policies before providing information.
14. Children
The Site is intended for a professional audience and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.
15. Changes to this policy
We may update this policy as our practices, services, or legal obligations change. Material changes will be reflected by a new effective date at the top of this page and, where required, by additional notice. Your continued use of the Site after an update constitutes acceptance of the revised policy.
16. Contact us
For privacy questions or to exercise your rights email contact@guardal.ai. You may also write to Guardal Inc., United States. If you are in the European Economic Area or the United Kingdom and believe we have not resolved your concern, you may contact your local data protection supervisory authority.