Privacy Notice

Personal data we collect and why

• Account data — name, email address, organization name, role and login credentials. Used to create and secure your account and to provide the Service. Legal basis: performance of a contract.
• Content you upload — invoices, price lists, supplier and project records, which may include names and contact details of individuals at your suppliers. Used solely to run price matching, produce variance results and generate claim packets. Legal basis: performance of a contract, and our legitimate interest in providing the Service.
• Support messages — the content of emails and in-app messages you send us. Used to answer your questions. Legal basis: legitimate interests.
• Usage and telemetry — pages visited, actions taken, line volumes processed, error reports, device identifiers and IP address. Used for security, fraud and abuse prevention, plan-limit enforcement, troubleshooting and product improvement. Legal basis: legitimate interests and legal obligation.
• Billing contact data — the email and plan associated with your subscription. Card and payment details are collected and held by Paddle, not by us. Legal basis: performance of a contract and legal obligation.

Who we share data with

• Service providers and subprocessors — cloud hosting and database providers, email delivery, and AI processing services used to interpret uploaded documents. They act on our instructions under contract.
• Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect our rights.

We do not sell personal data and we do not share it for advertising purposes.

Retention

Account and uploaded content are retained for as long as your organization is active and for 30 days after account closure, so you can export your records. Billing and tax records are kept for the period required by law. Security logs and telemetry are retained for up to 12 months. After these periods data is deleted or anonymised.

International transfers

Our infrastructure and some subprocessors are located in the United States and the European Union. Where personal data is transferred out of the UK or EEA, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent. UK and EEA residents may also complain to their supervisory authority. We respond to requests within one month. Organization administrators can also export or delete their entire organization from Settings → Your data.

Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls that isolate each organization’s data, role-based permissions, audit logging and session timeouts.

Backups and continuity

The database is backed up automatically with point-in-time recovery, and backups are retained for 7 days. Uploaded source documents are stored redundantly. We test the restore path before major releases. Organization administrators can additionally export a full copy of their data at any time from Settings → Your data, and we recommend keeping a periodic export of your own.

Cookies

Inside the application we use essential cookies and local storage only — to keep you signed in, remember your organization selection, and store interface preferences. We do not use advertising cookies and we do not sell or share your data with advertising networks.

We use Google Analytics to measure how many people visit the site, which pages they read, and whether key steps such as creating an organization or uploading a first file were completed. Google Analytics sets cookies containing a random identifier and records page addresses, approximate location derived from IP address, and device type; IP addresses are anonymised by Google. We never send the contents of your invoices, price lists, variance results or any personal data about your suppliers to Google. Legal basis: our legitimate interest in understanding how the product is used. You can opt out with the Google Analytics opt-out browser add-on, by using a tracking blocker, or by clearing and blocking cookies in your browser. Opting out has no effect on how the product works.

You can clear or block cookies through your browser at any time, though the application will not function correctly without the essential ones.

Contact

Vernco LLC — privacy@guardianprice.app