Privacy Policy

1. Who we are

Reguard AI is provided by [COMPANY NAME] Ltd, a company registered in England and Wales under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS] (“Reguard”, “we”, “us”). You can contact us about privacy at [PRIVACY EMAIL]. [ICO REGISTRATION NUMBER: TBC]

2. Our two roles

We handle personal data in two different capacities:

• As a processor for our customers. When an organisation uses Reguard AI, the content it uploads (questionnaires, questions, answers, its answer bank and organisation profile) may contain personal data (for example names or job titles of staff). Our customer is the controller of that data and we process it only on its instructions, under our Data Processing Addendum. If your personal data appears in a customer's content, please contact that organisation first; we will help them respond to you.
• As a controller. We are the controller of the personal data described in section 3 that we collect to run our business, such as account, billing and enquiry information. This policy mainly describes that processing.

3. Personal data we collect as controller

• Account data: your name, work email address, organisation, role in the Service and authentication data (a hashed password and multi-factor authentication settings).
• Billing data: billing contact details, subscription and invoice records. Card and payment details are collected and held by our payment provider, [PAYMENT PROVIDER: TBC], not by us.
• Enquiry data: information you give us when you contact us, request a demo or ask for support.
• Security and usage logs: IP address, browser information, sign-in events and actions taken in the Service, collected to keep the Service secure and to troubleshoot problems.

Website analytics: if you agree, Google Analytics records which pages of this website you visit, how you reached them, and your approximate location and device type. We do not use analytics on the Service at app.get-reguard.com, and we do not use advertising or tracking tools anywhere.

4. How we use it and our lawful bases

Where we rely on legitimate interests, our interest is running a secure, reliable business-to-business service, and we have weighed it against your rights. We do not use personal data for automated decision-making that has legal or similarly significant effects on you.

5. Who we share it with

We share personal data only with:

• our service providers (subprocessors), listed on our Subprocessors page, including Amazon Web Services for hosting and Anthropic PBC for AI processing of customer content;
• our payment provider, [PAYMENT PROVIDER: TBC];
• Google, which provides Google Analytics for this website, only if you agree to analytics;
• professional advisers such as lawyers and accountants, under duties of confidentiality;
• law enforcement or regulators, where the law requires it; and
• a buyer or successor of our business, subject to this policy.

We do not sell personal data.

6. AI processing

To draft answers, the Service sends relevant parts of customer content to Anthropic PBC through its commercial API. Under Anthropic's commercial terms, data sent through the API is not used to train its models. Anthropic retains such data only in line with its commercial API data-retention policy. Neither we nor Anthropic use customer content to train AI models.

7. International transfers

The Service will be hosted in the UK (AWS London region). Anthropic PBC processes data in the United States. Where personal data is transferred outside the UK or EEA, we put in place appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses. [TRANSFER MECHANISMS: TO CONFIRM] You can ask us for more information at [PRIVACY EMAIL].

8. How long we keep it

• Account data: for as long as your account is active, then for [ACCOUNT RETENTION PERIOD] after closure.
• Billing records: for as long as required by tax and company law (typically six years).
• Enquiry data: [ENQUIRY RETENTION PERIOD] after our last contact with you.
• Security logs: [LOG RETENTION PERIOD].

Customer content is kept until the customer deletes it in the Service or asks us to delete their organisation account, as set out in our DPA.

9. How we protect it

We use encryption in transit (TLS) and field-level encryption at rest (AES-256-GCM) for customer content, multi-factor authentication, role-based access controls and secure session handling. More detail is on our Data Security page and in the security annex to our DPA.

10. Your rights

Under UK GDPR and EU GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing in certain circumstances;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email [PRIVACY EMAIL]. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or, if you are in the EU, your local data protection authority. [EU REPRESENTATIVE: TBC, IF REQUIRED]

11. Cookies

The Service uses only strictly necessary cookies, which it needs to work and so do not require consent. This website also uses Google Analytics cookies, but only if you choose Allow when we ask. We do not use advertising or marketing cookies.

We remember your answer to the analytics question in your browser’s local storage, so we don’t ask on every page. You can change your mind at any time: the button below stops Google Analytics on this device, and we will ask again on your next visit.

You can block or delete cookies in your browser settings, but you will not be able to sign in to the Service without the session cookie.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “last updated” date, and will tell account Admins about material changes.

13. Contact

Privacy questions: [PRIVACY EMAIL]. Post: [COMPANY NAME] Ltd, [REGISTERED ADDRESS].