Privacy Policy
Last updated: 2026-09-24
This Privacy Policy explains how we collect, use, and protect personal data when you use Guidon Cloud at useguidon.com. It applies only to the hosted version we operate - a self-hosted instance run by someone else is governed by that operator's own privacy practices, since we never receive that instance's data.
1. Who controls your data
For data processed through Guidon Cloud, the data controller is Guidon, currently operated as an independent, pre-incorporation project (see our Terms of Service). Contact for any privacy request: support@useguidon.com.
2. What we collect
- Account data: email address, name, avatar, and authentication data (or, if you sign in with Google or Discord, the profile fields those providers share with us).
- Project data: whatever you and your team create - tasks, comments, decisions, files, roadmap items, and similar content.
- Billing data: for a paid plan, Stripe collects and stores your payment details directly - we only ever see your subscription status, plan, and billing period, never your card number.
- Usage and log data: basic request logs and, on the hosted product, aggregate analytics (Google Analytics) and, if we've enabled it, error reports (Sentry) - both scoped to keep out sensitive content, see §5.
3. Legal basis (GDPR)
- Contract: processing needed to provide the Service you signed up for (accounts, projects, billing).
- Legitimate interest: keeping the Service secure, debugging errors, and basic product analytics.
- Consent: optional integrations you turn on yourself (AI features, GitHub, Discord), and any non-essential cookies.
- Legal obligation: retaining billing records as required by tax law.
4. Who else processes your data
We use the following processors for Guidon Cloud. We only share what each one needs to do its job.
| Processor | Purpose | What they receive |
|---|---|---|
| Supabase | Database, authentication, file storage | All account and project data |
| Stripe | Payment processing | Billing/payment details (paid plans only) |
| Resend | Transactional email (password reset, invites) | Your email address, message content |
| Google Analytics | Aggregate, anonymized product usage | Page views, device/browser type - no account content |
| Sentry (if enabled) | Error monitoring | Error messages and stack traces - configured not to include request bodies or cookies |
5. AI features
AI features are off unless an organization's admin turns them on and picks a provider (Anthropic, OpenAI, Groq, OpenRouter, Azure OpenAI, a self-hosted Ollama instance, or another compatible endpoint). Using an AI feature sends the relevant task/project text to that organization's chosen provider, under that provider's own privacy and data-use terms - we don't control what a third-party AI provider does with data once it's sent, beyond what that provider discloses. If your organization uses Ollama or another self-hosted model, that data never leaves the infrastructure your organization controls.
6. Data retention
We keep your data for as long as your account or organization is active. If you delete your organization or account, we delete the associated data within 30 days, except where we're required to keep billing records longer for tax or accounting law, or where data is needed to resolve a dispute or enforce our Terms.
7. Security
Data is encrypted in transit (TLS) and at rest where our infrastructure providers support it. Access to production data is limited to what's needed to operate the Service. No system is perfectly secure, and we can't guarantee absolute security - we'll notify affected users of a qualifying data breach as required by GDPR.
8. Your rights (GDPR)
If you're in the EU/EEA (and, as a matter of policy, if you're anywhere else too), you can:
- Request a copy of your personal data (access);
- Correct inaccurate data (rectification);
- Request deletion of your data (erasure), subject to §6's retention exceptions;
- Get your data in a portable format (portability);
- Object to or restrict certain processing;
- Withdraw consent for anything based on consent, at any time, without affecting past lawful processing;
- Lodge a complaint with your national data protection authority (in Poland, the UODO).
To exercise any of these, email support@useguidon.com. We'll respond within one month, as GDPR requires.
9. Cookies
We use one essential session cookie to keep you signed in - the Service doesn't work without it, so it's not subject to consent under GDPR's ePrivacy rules. Google Analytics, when active, sets its own analytics cookies; a future version of this page will add a consent banner for those before they're set, if we haven't already by the time you're reading this.
10. International transfers
Some processors above (e.g. certain AI providers, or Supabase's underlying infrastructure) may process data outside the EU/EEA. Where that happens, we rely on that processor's own compliance mechanism (such as Standard Contractual Clauses) for the transfer.
11. Children
The Service is not directed at children, and we do not knowingly collect personal data from anyone below the age their country requires for independent consent to online services (in the EU, generally 16, or as low as 13 depending on the country) without a parent or guardian's involvement. If you believe a child has provided us data without appropriate consent, contact us and we'll delete it.
12. Changes to this policy
We'll post updates here with a new "Last updated" date, and notify you by email or in-app notice of any material change to how we use your data.