Privacy Policy

1. Introduction and Scope

PrivacyGuard AI ("we," "our," or "us") operates privacyguardai.io and provides AI-powered privacy compliance tools (the "Service"). This Privacy Policy applies to all users of the Service and explains what personal data we collect, why we collect it, how we use and protect it, how long we keep it, and what rights you have.

This policy is designed to comply with the EU General Data Protection Regulation (GDPR 2016/679), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), PIPEDA (Canada), and other applicable privacy laws. If you are located in the EU/EEA or UK, the GDPR provisions in this policy apply to you.

By using PrivacyGuard AI, you acknowledge this policy. If you do not agree, please discontinue use of the Service.

2. Personal Data We Collect

We collect the following specific categories of personal data:

2.1 Data You Provide Directly

2.2 Data Collected Automatically

3. Why We Collect Data — Purposes and Legal Basis

We process personal data only for the specific purposes listed below. For users in the EU/EEA/UK, we identify the applicable legal basis under GDPR Article 6 for each processing activity.

Marketing communications: We send only transactional emails related to your account and the Service (welcome email, scan reports, DSAR confirmations). We do not send marketing or promotional emails without your explicit opt-in consent. If you wish to receive product updates or newsletters, you may opt in through your account Settings. You may unsubscribe at any time via the link in any email or by contacting [email protected].

4. Data Sharing and Third-Party Processors

We do not sell your personal data. We do not share your personal data with third parties for cross-context behavioral advertising. We share data only with the following named service providers, each acting as a data processor under our instructions and bound by data processing agreements:

All processors are contractually required to: (a) process data only on our documented instructions; (b) implement appropriate technical and organizational security measures; (c) assist us in fulfilling data subject rights requests; and (d) delete or return data upon termination of the relationship.

5. Cookies and Tracking Technologies

We use cookies and similar technologies. You can manage your preferences via the cookie consent banner shown on first visit. For full details, see our Cookie Policy.

We do not use advertising cookies, social media tracking pixels, or behavioral profiling technologies. You may withdraw analytics consent at any time by clearing cookies and selecting "Essential Only" on the banner.

6. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the specific purpose for which it was collected, or as required by law. The following specific retention periods apply:

Upon expiry of the applicable retention period, data is securely deleted or anonymized. You may request early deletion at any time (see Section 7).

7. Your Privacy Rights

Depending on your jurisdiction, you have the following rights. We honor all rights requests regardless of location as a matter of policy.

7.1 Rights Under GDPR (EU/EEA/UK Users)

• Right of Access (Art. 15): Obtain a copy of all personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to Erasure / "Right to Be Forgotten" (Art. 17): Request deletion of your personal data where there is no overriding legal basis to retain it.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format (JSON/CSV) and transfer it to another controller.
• Right to Restrict Processing (Art. 18): Request that we pause processing while a dispute is resolved.
• Right to Object (Art. 21): Object to processing based on legitimate interests (including profiling). We will stop unless we have compelling legitimate grounds.
• Rights Related to Automated Decision-Making (Art. 22): We do not make solely automated decisions that produce legal or similarly significant effects.
• Right to Lodge a Complaint: You may file a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany).

7.2 Rights Under CCPA/CPRA (California Residents)

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected, used, disclosed, or sold about you.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out action is required.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond providing the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

7.3 Rights Under VCDPA, CPA, CTDPA (Virginia, Colorado, Connecticut Residents)

Residents of Virginia, Colorado, and Connecticut have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising and profiling. We do not engage in targeted advertising or profiling. To exercise rights, use the DSAR portal below.

8. International Data Transfers

PrivacyGuard AI is operated from the United States. All data is stored and processed in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

We rely on the following safeguards for international transfers:

• Standard Contractual Clauses (SCCs): We incorporate the EU Commission's approved Standard Contractual Clauses (2021/914/EU) into our data processing agreements with all EU-facing processors.
• Adequacy Decisions: Where the European Commission has issued an adequacy decision for the destination country, we rely on that decision.
• Processor Commitments: All processors listed in Section 4 have committed to GDPR-compliant data transfer mechanisms in their terms of service.

You may request a copy of the applicable transfer safeguards by contacting [email protected].

9. Children's Privacy

The Service is a B2B compliance tool intended for business users. It is not directed to individuals under the age of 16 (or under 13 in jurisdictions where COPPA applies). We do not knowingly collect, solicit, or process personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will delete it within 72 hours of discovery.

If you believe a child under 16 has provided us with personal data, please contact [email protected] immediately.

10. Security Measures

We implement the following specific technical and organizational security measures (TOMs) to protect your personal data:

Despite these measures, no internet transmission is 100% secure. Report suspected security vulnerabilities to [email protected].

11. Do Not Sell or Share My Personal Information (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt out of the sale or sharing of their personal information for cross-context behavioral advertising.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. The third-party service providers listed in Section 4 (Stripe, Resend, Umami, Manus AI Platform) are data processors acting under our instructions — they are not data brokers, and data is not shared with them for advertising purposes.

Because we do not sell or share personal data, no opt-out action is required. However, if you are a California resident and wish to exercise any CCPA/CPRA right — including the right to know, delete, correct, or limit use of sensitive personal information — please submit a request at privacyguardai.io/dsar/submit or email [email protected]. We will respond within 45 days.

11a. CCPA 2026 Data Category Disclosure Chart

As required by Cal. Civ. Code §1798.130(a)(5)(A) and CPPA Regulations (effective Jan 1, 2026), the following chart discloses the categories of personal information collected, disclosed for a business purpose, and sold or shared in the preceding 12 months. We do not sell or share personal information.

11b. Automated Decision-Making Technology (ADMT) Disclosure

As required by CPPA Regulations §7025 (effective Jan 1, 2026) and GDPR Art. 22, we disclose our use of automated decision-making technology:

Your ADMT rights (California residents): You have the right to opt out of the use of ADMT for decisions that produce legal or similarly significant effects concerning you. To exercise this right, contact [email protected]. As noted above, our ADMT tools are informational only and do not produce such effects.

11c. Global Privacy Control (GPC) Signal Support

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out of the sale and sharing of personal information, as required by CPPA Regulations §7025 (Cal.) and Colorado Privacy Act §6-1-1306(1)(a) (Colo.).

Because we do not sell or share personal information for advertising purposes, no opt-out action is needed. However, if your browser sends a GPC signal, we treat it as a confirmed opt-out preference and will not initiate any sale or sharing of your personal data. A visible confirmation notice is displayed in our cookie consent interface when a GPC signal is detected.

To enable GPC in your browser, visit globalprivacycontrol.org.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users for significant changes
• Display a notice in the dashboard for 30 days following a material update

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you must stop using the Service and may request deletion of your account.

13. Contact Us

For any questions about this Privacy Policy, to exercise your rights, or to report a privacy concern: