1. Who we are, what this policy covers, and our two roles
1.1 The controller of your personal data is Clouds On Mars Sp. z o.o., a limited liability company registered in Poland, ul. Bukowińska 22/13B, 02-703 Warsaw, Poland, entered in the National Court Register (KRS) under number 0000670382. E-mail: contact@guardioz.com. Clause 1.2 of the Terms gives our other company details.
1.2 Our Data Protection Officer is Agnieszka Łapińska, e-mail IOD@cloudsonmars.com. You can write to the Data Protection Officer about any matter that concerns your personal data.
1.3 "You" means a natural person whose personal data we process as a controller: a person who uses an Account, whose e-mail address someone else used to register, who opens a page of the Application without an Account, who opens the Demo, who visits the Website or reads the Documentation, or who contacts us. When you use an Account, you act for the Customer. "You" does not include persons whose personal data is in Customer Data (section 2).
1.4 Defined terms:
| Term | Meaning |
|---|---|
| Guardioz, we, us | Clouds On Mars Sp. z o.o. |
| Service | the Guardioz service as a whole |
| Application | the web application at app.guardioz.com, including its programming interface (REST API) |
| Agent | the Guardioz monitoring agent software installed on the Customer's server |
| Customer | the business that holds the Account |
| Account | the user account in the Application. One person uses it, for the Customer. |
| Organization | the unit in the Application that Servers belong to. It has a name and a plan, and no other details. |
| Server | a PostgreSQL instance registered in the Application |
| Snapshot | one set of data the Agent sends |
| Customer Data | everything the Agent sends from the Customer's server |
| Account Data | data about the person who uses the Account |
| finding | the result of a check on the Snapshots of a Server |
| Website, Documentation | guardioz.com, docs.guardioz.com |
| Demo | the public demo of Guardioz at demo.guardioz.com, which shows a sample Organization without an Account |
| User-Agent | the text that your browser or program sends with each request to name itself and your operating system |
| Terms, DPA, Privacy Policy, Service Provider List, Agent Licence | the Terms of Service, the Data Processing Agreement, this policy, the list of service providers and the Guardioz Agent Software Licence, at https://guardioz.com/terms, /dpa, /privacy, /service-providers and /agent-licence |
1.5 This policy covers the Service at app.guardioz.com, the Demo, the Website and the Documentation. The Service is for business use.
1.6 We are the controller of Account Data, of the request data of anyone who opens the Application or the Demo, of data about visitors to the Website and readers of the Documentation, and of messages that people send us, except for personal data from a Customer's databases that they contain (clause 3.29). We are the processor, or where the Customer is itself a processor, a sub-processor, of Customer Data and of the other personal data described in clause 2.1 of the DPA, such as findings and the names of Servers. The Customer is the controller of that data, or a processor for its own clients. The DPA governs that processing. Where this policy mentions Customer Data, it does so for information only; section 2 summarises it.
2. Customer Data: a short summary
2.1 The Agent runs on the Customer's server. It reads data from PostgreSQL and from the operating system and sends it to the Application as Snapshots. The Documentation describes this at https://docs.guardioz.com/reference/data-collected/. The binding list of categories is in Annex I of the DPA.
2.2 Customer Data can contain personal data. For example, the list of current database sessions holds database user names, the IP address and host name of connecting clients, application names and the text of SQL statements, which can contain any value that the Customer's software puts into them. The Agent removes a password written right after the word PASSWORD from that text, and a password written in another form stays in it.
2.3 We process Customer Data on behalf of the Customer, under the DPA, to provide the Service to the Customer, on the Customer's documented instructions. On the same instructions we anonymise it and use the anonymised data to maintain and improve the Service, for example in statistics across all Customers (DPA clause 7). Anonymised data contains no personal data, and the statistics name no Customer, no Server and no object on a Server. We do not use Customer Data, or anonymised data made from it, to train AI models, and we use Customer Data for no purpose of our own.
2.4 During the contract, the Application does not delete Customer Data by age: the Customer decides how long it is kept by deleting Servers or the Account (clause 13.1 of the DPA). After the contract ends, it is deleted as clause 13.9 of the DPA describes. Some Customer Data remains for a time after deletion: in backups (clause 9.3), in our server logs (clause 3.28), and in what our e-mail and error-monitoring providers already received (clause 9.5).
2.5 Information from Customer Data reaches our providers in finding notifications (clause 3.20) and in error reports (clause 3.24). Support messages can contain data about the Customer's server (clause 3.29).
2.6 If your personal data is inside Customer Data, the Customer, or its own client where the Customer acts as a processor, is the controller and decides about it, so please send your request to them. If you write to us, we tell you that we act as a processor and cannot handle the request ourselves. Where your message lets us identify the Customer, we forward it, without undue delay, to the Account's e-mail address or, if the Account has been deleted, to the last e-mail address we have for it. We do not confirm whether a particular organisation is our Customer, we do not verify your identity, and we do not access, correct or delete Customer Data at your request, unless the Customer instructs us or the law requires it. We keep your message and our reply as a record of how we handled the request (clause 3.30).
3. The Application: Account Data
Legal bases, purposes and retention
3.1 Where you are the Customer yourself, the legal basis for processing Account Data is the performance of the contract with you (Article 6(1)(b) GDPR). Where you act for a Customer, the legal basis is our legitimate interest in providing the Service to that Customer (Article 6(1)(f) GDPR). Where the law requires us to keep data, for example for accounting and tax purposes, the legal basis is that legal obligation (Article 6(1)(c) GDPR). After your Account is deleted, we may keep the data needed to establish, exercise or defend legal claims, based on our legitimate interest (Article 6(1)(f) GDPR).
3.2 For each kind of data in this policy (numbers are clauses; a legitimate interest is a basis under Article 6(1)(f) GDPR):
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account and Organization (3.3 to 3.9) | to run your Account and let you use the Application | 3.1; for an e-mail address that someone else typed, 3.6 | until you delete the Account; an Account whose e-mail address is not confirmed: 30 days (clause 3.6) |
| Link to Google or GitHub (3.10 to 3.14) | to let you sign in with that account | 3.1 | until you disconnect it or delete your Account |
| Session records (3.15 to 3.17) | to keep you signed in and protect your Account | 3.1, and our legitimate interest in keeping Accounts safe | until you delete your Account |
| Account e-mails (3.18) | to confirm your e-mail address, let you reset your password and warn you about a second registration of your address | 3.1 | we keep no copy; the address and the subject stay in our server logs for up to about 5 weeks (clause 3.28), and Brevo keeps its record for 1 month (clause 9.5) |
| Welcome e-mail (3.18) | to welcome you, ask for your feedback and offer help | our legitimate interest in learning what our users need and in helping them start | as account e-mails; your reply: as correspondence |
| Orders of a paid plan (3.5) | to conclude and perform the order, and to keep the records that tax and accounting law requires | 3.1; for the records, our legal obligation (Article 6(1)(c) GDPR) | as long as tax and accounting law requires |
| Finding notifications (3.19, 3.20) | to tell you about findings | 3.1 | as account e-mails |
| Error reports (3.23 to 3.25) | to find and fix errors | our legitimate interest in finding and fixing errors | 30 days (clause 9.5) |
| Server logs (3.26 to 3.28) | to run the Service, keep it safe and find faults | our legitimate interest in these purposes | up to about 5 weeks (clause 3.28) |
| Correspondence (3.29, 3.30) | to answer you | our legitimate interest in responding to your request and, if a business relationship is established, performance of a contract (Article 6(1)(b) GDPR) | 3 years after the last message in the conversation (clause 3.30) |
| Complaints (3.30) | to handle a complaint about the Service (clause 17 of the Terms) | our legal obligation to provide a complaint procedure (Article 6(1)(c) GDPR, with Article 8(3)(4) of the Polish Act on Providing Services by Electronic Means), and performance of the contract (Article 6(1)(b) GDPR) | 3 years after the complaint is closed; for that time, our legitimate interest in establishing, exercising or defending legal claims (clause 3.30) |
| Requests about personal data (3.30, 10.6) | to handle a request under Articles 15 to 22 GDPR and to show how we handled it | our legal obligation (Article 6(1)(c) GDPR, with Articles 5(2) and 12 GDPR) | 3 years after the request is closed, on the same basis as complaints (clause 3.30) |
| Statistics of use (3.32) | to improve and develop the Service | our legitimate interest in improving the Service | the statistics contain no personal data; the records that we read are kept as the rows above say |
| Operation of the Service (3.33) | to run the Service, find faults and offer help | 3.1 | the records that we read are kept as the rows above say |
| Analytics on the Website (4.1) | to measure visitor traffic and improve the Website | your consent (Article 6(1)(a) GDPR) | event data: 2 months; data tied to the client ID: 14 months after your last visit (clause 4.1) |
| Hosting of the Website and the Documentation (4.2, 5.1) | to deliver the pages that you open | our legitimate interest in running the Website and publishing the Documentation | no request logs are kept for us |
| Request logs of the Demo (4.5) | to run the Demo, keep it safe, find faults and count visits | our legitimate interest in these purposes | up to about 5 weeks (clause 3.28) |
| Legal claims (3.1) | to establish, exercise or defend legal claims, also after your Account is deleted | our legitimate interest in these purposes | only the data needed for a claim, until the claim is time-barred |
Where an error report, a log line, an e-mail about findings or a message to us holds Customer Data or personal data from a Customer's databases, we process that data as the Customer's processor, under the DPA.
Registration and your Account
3.3 There are three ways to create an Account.
| Way | What you give | What we store, and when |
|---|---|---|
| Sign-up form in the Application | your name, a name for your Organization, your e-mail address and a password | the Account (e-mail address, name, a hash of the password) and the Organization, at once, before your e-mail address is confirmed (clause 3.6) |
| REST API | the same four values | the same, at the same moment |
| Google or GitHub | you sign in at the provider | the Account (the e-mail address and name from the provider, no password hash until you set a password) and the link to the provider (clause 3.11), when you come back from the provider; the Organization only later, when you type its name |
3.4 The Account holds your e-mail address, which identifies it, your name and a hash of your password, not the password itself. Upper and lower case in the address do not matter: we store it in lower case. The Application adds a random 8-digit account number, a time zone setting, three notification settings (clause 3.19), the way you registered, whether the Account is active, the time it was created, the times of account e-mails, including when your e-mail address was confirmed, and the count of incorrect passwords in clause 3.17.
3.5 The Organization record holds its name, its plan and the time it was created. The name is free text, and the Application can suggest it from your e-mail address, so it can be personal data. The record holds no legal form, postal address, tax number or country. Today an Organization has at most one user, and nobody else can join it. When you order a paid plan, we keep the order and its confirmation in our correspondence (clause 3.30) and the documents that tax and accounting law requires.
3.6 An e-mail address typed by someone else. Because a registration with a password is stored before the e-mail address is confirmed, a person can type an address that is not theirs. We then hold a record about that address, and its owner receives an address confirmation e-mail, or an e-mail with the subject "You already have an account - Guardioz" when an Account with that address exists. Nobody can sign in with a password until the address is confirmed. An Account whose e-mail address is not confirmed within 30 days is deleted automatically, with its Organization. If this happened to your address, write to us (clause 16.1), and we will delete the record and its Organization sooner. Legal basis: our legitimate interest in running the sign-up, in checking that an address belongs to the person who registers with it, and in letting its owner know (Article 6(1)(f) GDPR).
3.7 The address confirmation link is valid for 48 hours, and the password reset link for 30 minutes. Both contain your user id and your e-mail address (clause 3.27).
3.8 If you use the REST API, you get an access token and a refresh token. The access token is valid for 15 minutes. The refresh token is valid for 7 days, and each time it is used, it is replaced by a new one, valid for 7 days from then. We store the refresh token as a hash, with no IP address and no User-Agent.
3.9 When you add a Server, the Application creates an install token, valid for 60 minutes.
Sign-in with Google or GitHub
3.10 You can sign in with Google or with GitHub.
3.11 After you sign in at Google or GitHub, our server reads your id there, your verified e-mail address and your name (at GitHub, your login if you have set no name). We store the provider's name, your id there and the date. We do not store the provider's access tokens, your profile picture or the rest of your profile.
3.12 If an Account with the same confirmed e-mail address exists, the Application connects the Google or GitHub identity to that Account.
3.13 When you disconnect a provider in your settings, or delete your Account, we delete our record of that identity. The permission you gave at Google or GitHub stays until you withdraw it there. A cookie holds the state of the sign-in (clause 6.5).
3.14 Google and GitHub are independent controllers for what they do on their side. Table C of the Service Provider List names the company of each that acts for users in the European Economic Area.
Sessions
3.15 When you sign in, the Application stores a session record: a hash of the session token, your full User-Agent, a shortened IP address, and times. The full IP address reaches our server logs (clause 3.26) and our error-monitoring provider (clause 3.23), not the Account tables.
3.16 A session ends 24 hours after you sign in, or earlier, after 12 hours with no request.
3.17 In your settings you can see your active sessions and end them. The record of an ended or expired session is not deleted. It stays until you delete your Account. To protect your Account against password guessing, the Application counts incorrect passwords in a row each time it asks for your password: when you sign in, when it asks you to sign in again before a sensitive action, and when you change your password. After five in a row, it refuses your password for 30 seconds, and this period doubles with each further incorrect password, up to 15 minutes. During that period even the correct password is refused, and the sign-in page gives the same answer as for a wrong password. The count and the end of the period are kept with your Account. They are cleared when your password is accepted or when you reset your password. Sign-in with Google or GitHub is not limited by them. The Application keeps no other history of your sign-ins.
E-mails we send you
3.18 There are four account e-mails. Three of them are address confirmation, password reset, and "You already have an account - Guardioz"; you cannot switch them off, and we limit how often each is sent. The fourth is a welcome e-mail, "Welcome to Guardioz", which the Application sends once per Account: when your e-mail address is confirmed for the first time, or when an Account opened with Google or GitHub is created. It comes from the personal address of the Product Owner of Guardioz, a member of our team, and a reply to it goes to that person's mailbox (clause 3.30). If you do not want us to write to you this way again, say so in your reply. The Application sends no other account e-mails.
3.19 Finding notifications. After it analyses a Snapshot, the Application can e-mail the active users of the Organization whose e-mail address is confirmed, when a group of findings on a Server becomes more serious than the level it last recorded. Of the three settings, critical is on by default, with no opt-in step, and warning and suggestion are off. You change them in your Account settings. On the Free plan only the critical setting can be switched on. A choice you made earlier for the other two is kept, and it applies again if your Organization moves to a plan that includes them. Today that is the way to stop these e-mails, because they carry no unsubscribe link. You cannot set them for one Server separately.
3.20 A finding notification contains the name of the Server (by default its host name) in the subject and in the text, the time of the Snapshot, the titles of the finding groups, the number of affected objects and a link to the Server. For findings about settings and about transaction log archiving it also contains, for up to five findings of each group, the explanation that the Application shows, with measured values such as the current and the recommended setting, free disk space, the volume of transaction logs, the name of a transaction log file and the number and times of failed archiving attempts. For findings about replication slots it also contains the names of up to five affected slots and measured values for each of them, such as the volume of transaction logs that the slot holds, how long it has been inactive, free space on the transaction log disk and the space left before the slot can lose transaction logs that it still needs. Today it contains no names of databases, schemas, tables or indexes, and no SQL text.
3.21 The Application sends e-mail through one provider, Brevo, which receives the sender, your e-mail address, the subject and the full content of each e-mail. The Application uses Brevo only to send single e-mails, and our Brevo account holds no contact lists or campaigns. Brevo records when an e-mail is delivered and, if your mail program loads the images in it, when it is opened. It also records when you click a link in it: to do that, Brevo replaces each link with a link to its own address, which forwards you to ours. Brevo ties these events to your e-mail address. We use them to check that our e-mails reach you and are read. Legal basis: our legitimate interest in knowing that the e-mails of the Service are delivered (Article 6(1)(f) GDPR). If you do not want opens to be recorded, set your mail program not to load images automatically. The Application itself stores no delivery, open or click records. How long Brevo keeps them: clause 9.5.
3.22 The Application keeps no copy of the e-mails it sends, and no record of who received a finding notification. Our server logs hold the recipient address and the subject of each e-mail (clause 3.27). For Brevo, see clause 9.5. Each e-mail except the welcome e-mail shows a logo loaded from the Website, so if your mail program loads images, the host of the Website receives your IP address and User-Agent (clause 4.2).
Error monitoring
3.23 The Application is set up to send an error report to our error-monitoring provider, Sentry, when an error happens. This happens on our server, not in your browser. Error reporting is switched on in production, and production sends no traces of requests that did not fail. A report contains the IP address of the caller (also inside request headers that our web server adds), the other request headers including the User-Agent, the web address and method of the request, technical details of the error, and recent log lines. It contains no request content, so no Snapshot, and no cookies.
3.24 Error text and log lines are free text. They can contain a recipient's e-mail address and an e-mail subject, and the subject of a finding notification contains the Server name. An error from our database can also carry the values being written or read. These can be Account Data or Customer Data, for example database user names, client IP addresses and SQL text. A report about a request from an Agent carries the IP address of the Customer's server.
3.25 Our code does not add your user identity to an error report, but it can arrive inside that free text. For Sentry, see clause 9.5.
Server logs
3.26 Our production server keeps request logs. For each request they hold the IP address, the User-Agent and the web address that was requested.
3.27 These logs also hold e-mail addresses. They record your user id and e-mail address when you open a confirmation or reset link (clause 3.7), and the recipient address and subject of each e-mail the Application sends, including the Server name in finding notifications. An error message in a log can contain an e-mail address or values from our database (clause 3.24). E-mail addresses and IP addresses are written in full.
3.28 Our server logs are kept for up to about 5 weeks: an entry is deleted at the latest 36 days after it was written. Our hosting provider's agent on the machine sends copies of the operating system's log files to the hosting provider every hour (Service Provider List, row A1). The log files of our database are also in our encrypted backups, and a copy there stays as long as the backup (clause 9.3). Our other logs are not in the backups.
Support and other correspondence
3.29 When you write to us (clause 16.1), or reply to the welcome e-mail, we process your name, your e-mail address and your message. Our support page asks for the Server name, the installer output and lines from the Agent log, so a message can contain data about the Customer's server. It is not Customer Data as the DPA defines it, because the Agent did not send it. If it contains personal data from the Customer's databases, we process that data for the Customer under clause 2.4 of the DPA and delete it when the request is handled. The contact address is in the Documentation, on the Website, in every e-mail from the Application and in the installer's messages.
3.30 Our mailboxes in the guardioz.com domain, including contact@guardioz.com and the mailbox that receives replies to the welcome e-mail, are in Microsoft 365 (Exchange Online). We keep a complaint or a request about personal data, with our answer, for 3 years after the matter is closed, so that we can show how we handled it and defend legal claims. We keep other correspondence for 3 years after the last message in the conversation. Once a year we delete the correspondence whose period has ended, so a message can stay up to one year longer. Personal data from a Customer's databases in a message is deleted as clause 3.29 says. We delete a message sooner on request, unless we need it to establish, exercise or defend legal claims, or the law requires us to keep it, for example for an order of a paid plan (clause 3.5).
What the Application does not collect
3.31 Always free for one user. The Application has no payment function. It collects no payment data, phone number, postal address, profile picture or company registration data. It runs no analytics or tracking scripts and has no consent banner. Clauses 3.32 and 3.33 describe how we use its own records.
Statistics of use
3.32 We combine Account Data of all Accounts into statistics about how the Service is used: for example, how many Accounts are created in each of the ways in clause 3.3, how many of them reach each step of connecting a Server, and how often people sign in. The statistics are counts and shares and contain no personal data. We make them from the records that this section describes, and we use them to improve and develop the Service. Legal basis: our legitimate interest in improving the Service. You can object (clause 10.5).
Operation of the Service
3.33 To run the Service, find faults and offer help, our staff review the state of each Account and Organization: the e-mail address of the Account and the way it was created, the Organization and its plan, its Servers and whether their Agents deliver Snapshots, whether analyses succeed, which findings the Application shows, and whether our e-mails are delivered. When we see a problem, we can write to the e-mail address of the Account to offer help. Legal basis: clause 3.1. We prepare this review from the production database on the computer of the staff member who reads it, where it is kept only in memory, never written to disk, and replaced by each new review (clause 8.2).
4. The Website and the Demo
4.1 Analytics, with your consent. We use Google Analytics to measure visitor traffic - how many people visit, which pages are popular, and where visitors come from. This helps us improve the site. Google Analytics is loaded only after you accept analytics cookies. Before you make a choice, and after you reject analytics, the Website does not load the Google Analytics script on the pages you open. It tells visitors apart by a random client ID for each browser. Our code sets the lifetime of its cookies (clause 6.8) and switches off Google signals and ads personalisation for it. According to Google, the data is then not used for ads personalisation or for demographics and interests reports. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw (clause 6.9). Google Ireland Limited provides Google Analytics to us and processes this data for us under Google's data processing terms. We do not let Google use the data to improve its own products and services. Google can use it, combined with data from other websites and apps, for statistics about whole industries, in a form that according to Google identifies neither us nor you. Google's support staff can access our Analytics account to solve technical problems. According to Google, Google Analytics 4 does not log or store IP addresses.
4.2 The Website runs on Microsoft Azure App Service. The host receives the IP address and User-Agent of each visitor, and of anyone whose mail program loads the logo in our e-mails (clause 3.22). Legal basis: our legitimate interest in running the Website (Article 6(1)(f) GDPR). The host keeps no log of these requests for us.
4.3 The Website has no contact form, waiting list or newsletter sign-up, and its contact links open your mail program. Apart from Google Analytics it loads only its own resources, its fonts included. Its own code sets no cookie; it only deletes the Google Analytics cookies (clause 6.9).
4.4 The Website, the Application and the Documentation link to other websites. This policy does not apply to them. Read their own privacy statements.
4.5 The Demo. The Website links to the Demo, a public demo of Guardioz at demo.guardioz.com. It shows a sample Organization with a sample Server, read-only, and none of its data comes from a Customer. You use it without an Account and without signing in. The Demo sets no cookie. If you choose a database on the Activity page of the sample Server, your browser keeps that choice (clause 6.3). The Demo sends nothing to our e-mail, sign-in or error-monitoring providers. Its server keeps request logs with your IP address, your User-Agent and the web address that you requested, to run the Demo, keep it safe, find faults and count how many browsers visit it each day, and keeps them as clause 3.28 describes for our server logs. We count visits on the Demo's server, and the count contains no IP address and no User-Agent. Legal basis: our legitimate interest in these purposes (Article 6(1)(f) GDPR).
5. The Documentation
5.1 The Documentation runs on Microsoft Azure Static Web Apps. The host receives your IP address and User-Agent when your browser asks for a page. Legal basis: our legitimate interest in publishing the Documentation (Article 6(1)(f) GDPR). The host keeps no log of these requests for us. It serves the pages from points that Microsoft distributes around the world, so a request is handled at a point near the reader.
5.2 The Documentation has no analytics and no consent banner. It loads nothing from another host, and its own code sets no cookie. Its search runs inside it, and what you type does not go to an outside service. It stores three entries in your browser, none with personal data (clause 6.10).
5.3 "Ask AI about this page" holds three ordinary links, to chatgpt.com, claude.ai and cursor.com. Nothing reaches these hosts until you click. When you click, the provider (OpenAI, Anthropic or Cursor) receives the web address of the page you were reading, with what any website receives from your browser. Each provider is responsible for this data under its own privacy policy.
6. Cookies and browser storage
6.1 Cookies are small files that your browser stores on your device. Browser storage (local storage and session storage) keeps small values in a similar way. The tables below say what each entry holds and whether we ask for your consent first. You can block and delete both in your browser settings. If you block the session cookie, you cannot sign in to the Application.
6.2 Some entries in the tables below are not needed to sign in or to use a page. They remember a choice you made, the state of a page, or the sign-in method you used last, so that you do not have to repeat it. We set them without asking, because they only serve the page you asked for. Our code sends none of them to another company. None of them is used for analytics or advertising, and none holds your name, e-mail address or user id.
6.3 The Application:
| Name | Type | What it holds, and why | Lifetime | Do we ask for your consent first? |
|---|---|---|---|---|
__Host-guardioz_session | cookie | the session cookie: a random token that keeps you signed in | clause 3.16 | No. The sign-in you ask for needs it. |
__Host-guardioz_oauth | cookie | the sign-in state cookie: the state of a Google or GitHub sign-in (clause 6.5) | clause 6.5 | No. This sign-in method needs it. |
last_login_method | cookie | email, google or github: the sign-in method you used last, so that the sign-in page can show it; no user id | 365 days | No (clause 6.2). |
activity_db:<Server UUID> | local storage | the monitored database you chose on the Activity page of a Server (the UUID is the Server's id) | no end date | No (clause 6.2). |
guardioz-theme | local storage | the light or dark theme you chose with the theme switcher; without it, the Application follows the theme of your system | no end date | No (clause 6.2). Stored when you choose Light or Dark, and removed when you choose System. |
6.4 The session cookie, __Host-guardioz_session, holds a random token, and our server keeps only a hash of it. When you sign out, use "Log out everywhere" or delete your Account, we end the session on our server. From then on the cookie no longer signs you in, even if your browser still holds it.
6.5 The sign-in state cookie is created when you start a Google or GitHub sign-in. It holds the state of that sign-in and sometimes the page to return to, but no user id, e-mail address or token. The Application clears it when you return from Google or GitHub, whether the sign-in succeeded or not. Its lifetime is 10 minutes from the start of the sign-in. If you do not return, it stays in your browser until those 10 minutes have passed, and after that our server no longer accepts it.
6.6 Set without asking. last_login_method is set after each successful sign-in, for 365 days. It stays after you sign out, because the sign-in page reads it then, and it stays after you delete your Account. Anyone who opens the sign-in page in the same browser after you sees which method you used. activity_db:<Server UUID> also stays after you sign out, so on a shared computer the next user of the browser can read that database name. You can delete both in your browser settings.
6.7 The Website:
| Name | Type | What it holds, and why | Lifetime | Do we ask for your consent first? |
|---|---|---|---|---|
guardioz_cookie_consent | local storage | your choice about analytics, the date you made it and the "Last updated" date of this policy at that time | until you choose again or clear your browser storage; the Website uses it for 6 months (clause 6.9) | No (clause 6.2). It records the choice you make. |
_ga | cookie | the random client ID that tells visitors apart, for traffic statistics | 420 days (clause 6.8) | Yes. It is set only after you choose "Accept analytics". |
_ga_<id> | cookie | the state of a visit, for traffic statistics | 420 days (clause 6.8) | Yes. It is set only after you choose "Accept analytics". |
6.8 The Google Analytics script sets its cookies itself. Our code sets their lifetime to 420 days (14 months of 30 days). The script can renew them when you visit the Website again, and the 420 days then count from that visit. Apart from it, the Website's own code loads no script from another host.
6.9 Withdrawing consent to analytics. Use the Cookie settings link in the footer of the Website's pages and choose "Reject analytics". The Website then deletes the Google Analytics cookies from your browser and does not load Google Analytics on the pages you open. If Google Analytics is running in the page you have open, the Website reloads that page without it. Whenever your browser holds no valid acceptance - before a choice, after a rejection, or after a choice has expired - the Website deletes the Google Analytics cookies it finds when you open one of its pages. Your choice is kept only in your browser, not on our servers. The Website uses it for 6 months and then asks again. It also asks again, and says that this policy has changed, when we change this policy in a way that matters to you. Withdrawing consent does not affect the processing before it. Data that Google Analytics already received is deleted when its retention period in clause 4.1 ends.
6.10 The Documentation:
| Name | Type | What it holds, and why | Lifetime | Do we ask for your consent first? |
|---|---|---|---|---|
starlight-theme | local storage | the light or dark theme you chose | no end date | No (clause 6.2). Stored when you choose a theme. |
starlight-synced-tabs__os | local storage | the operating system tab you clicked | no end date | No (clause 6.2). Stored when you click a tab. |
sl-sidebar-state | session storage | the state and scroll position of the menu | until you close the tab | No (clause 6.2). Stored automatically. |
6.11 The Application sets no cookies other than the three in clause 6.3, none of them for advertising, and uses no other browser storage. The Demo sets no cookie, and its only browser storage entries are the activity_db and guardioz-theme entries in clause 6.3. The hosting platforms of the Website and the Documentation set no cookies of their own: session affinity, the App Service function that would set one, is switched off, and neither platform sent a cookie when we checked.
7. Who receives personal data
7.1 The Service Provider List, at https://guardioz.com/service-providers, names each provider's legal entity, the place of processing and the transfer mechanism: Table A for Customer Data, Tables B and C for Account Data and data about visitors.
7.2 Recipients:
| Recipient | What it does for us | Personal data it can receive |
|---|---|---|
| Microsoft (Azure) | hosts the Application, its database and encrypted backups, the Demo, the Website and the Documentation | Account Data and Customer Data; the IP address and User-Agent of visitors of the Website and the Demo, of readers and of people whose mail program loads our e-mail logo |
| Microsoft (Microsoft 365) | our e-mail correspondence (clause 3.30) | your messages and our answers |
| Brevo | sends the Application's e-mails, and technical alerts about our own machines to our staff | your e-mail address, the subject and the full content (clauses 3.20 and 3.21); in the alerts, lines from our server logs, which can contain e-mail addresses and IP addresses |
| Sentry | error monitoring | IP addresses, request headers, web addresses, and error or log text that can contain e-mail addresses, Server names and values from our database (clauses 3.23 and 3.24) |
| Google and GitHub, for sign-in | confirm your identity when you choose them | that you sign in to the Application; they act as independent controllers (clause 3.14) |
| Google, on the Website | Analytics after your consent | IP address, User-Agent, the client ID and usage data (clause 4.1) |
7.3 Other providers work for us and, according to our code, receive no Account Data and no Customer Data. Among them is GitHub, which hosts our source code and runs our deployments.
7.4 We do not share personal data processed for Guardioz with other companies of the Clouds On Mars group, and the Application sends them no data.
7.5 We do not sell, rent, or trade your personal data to third parties. We may have to give personal data to a public authority where the law requires it.
8. Where data is stored, and transfers outside the European Economic Area
8.1 The database of the Application holds Account Data and Customer Data. The database and its encrypted backups are in Microsoft Azure, in the Poland Central region. We keep no copy in a second region.
8.2 Our staff work with this data remotely, from their work computers. A review of the state of the Service (clause 3.33) is prepared on such a computer and kept there only in memory. Copies of the database are made only on the production machine (clause 9.4).
8.3 Clause 8.1 is about the database and its backups only. It does not extend to the providers in section 7 or to the hosting of the Demo, the Website and the Documentation. Our Sentry organization is in the EU region of Sentry, which stores error reports in Frankfurt, Germany. The terms of Brevo name its hosting servers in France and Belgium. The Demo and the Website are hosted in Microsoft Azure, in the Poland Central region. The Documentation is served from points that Microsoft distributes around the world, not from one region.
8.4 Some providers in section 7 are in the United States or can process data there. Two transfer mechanisms matter for them. The first is the European Commission's adequacy decision for the EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795. It covers the organisations on the list at https://www.dataprivacyframework.gov/list. The second is the standard contractual clauses of Implementing Decision (EU) 2021/914.
8.5 The Service Provider List states, for each provider, the legal entity, the place of processing, the transfer mechanism and the date on which we checked its Data Privacy Framework status.
8.6 You can ask us for a copy of the safeguards that apply to a transfer of your data (clause 16.1).
9. How long we keep data
9.1 We state what our systems do today and give no period that they do not enforce.
9.2 We keep each kind of data for the period in the table below, or until the event that it names, such as the deletion of the Account.
| Data | Kept until | More |
|---|---|---|
| Customer Data and what is derived from it, such as findings | during the contract, until the Customer deletes the Server or the Account; after the contract ends, as clause 13.9 of the DPA describes | the Customer decides (clause 13.1 of the DPA) |
| Technical records of analysis jobs | until the Customer deletes the Server or the Account | deleted together with the Server (clause 10.3) |
| Account: e-mail address, name, password hash, settings; the Organization, its name and its plan | until you delete the Account; if the e-mail address is not confirmed, 30 days after the Account was created | clause 3.6 |
| A registration with an e-mail address that someone else typed | 30 days, unless the address is confirmed; sooner on request | clause 3.6 |
| Link to Google or GitHub | until you disconnect it or delete the Account | clause 3.13 |
| Session records: full User-Agent, shortened IP address | until you delete the Account | they stay after the session ends (clause 3.17) |
| API refresh tokens and install tokens | until you delete the Account | they stay after they expire |
| Server logs | up to about 5 weeks; copies of the database's log files stay in backups as long as the backup | clause 3.28 |
| Request logs of the Demo | up to about 5 weeks, as our server logs | clause 4.5 |
| Website and Documentation hosting | no request logs are kept for us | clause 4.2 and clause 5.1 |
| Backups, deleted data included | up to about 36 days after deletion | clause 9.3; temporary copies: clause 9.4 |
| Brevo: the record of each e-mail sent, with its delivery, open and click events | 1 month | clause 9.5 |
| Sentry | 30 days, the data retention period of our Sentry plan | clause 9.5 |
| Complaints and requests about personal data, with our answers | 3 years after the matter is closed | clause 3.30 |
| Other correspondence | 3 years after the last message in the conversation | clause 3.30 |
| Orders of a paid plan | as long as tax and accounting law requires | clause 3.5 |
| Google Analytics data | event data: 2 months; data tied to the client ID: 14 months after your last visit | clause 4.1 |
9.3 Deleted data stays in our encrypted backups for some time. Backup retention is 14 days. A backup made before the deletion is removed after about 14 to 21 days, and the backup storage then keeps the deleted files for 14 more days. In total, deleted data stays in the backups for up to about 36 days. We do not remove single records from a backup.
9.4 Temporary copies of the database can exist on the production machine. A weekly restore test makes one and deletes it when the test ends. A rollback of a deployment can also leave one. We delete it once the rollback is finished, and the production machine deletes it automatically at the latest 15 days after it was last read or changed.
9.5 Our Brevo account is set to delete the record of each e-mail after 1 month and to keep no copy of its content. On our Sentry plan, the data retention period is 30 days.
10. Your rights and how to use them today
10.1 Under the GDPR, you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict processing in certain circumstances;
- object to processing based on legitimate interest (clause 10.5);
- data portability: receive your data in a structured, commonly used and machine-readable format;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- not be subject to a decision based solely on automated processing, including profiling, that has legal effects for you or affects you in a similarly significant way (section 12 says we make no such decisions);
- lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl, or the data protection authority of the EU country where you live or work, or where the infringement took place.
10.2 How you use these rights today:
| What you want | In the Application | By e-mail to us (clause 16.1) |
|---|---|---|
| See your data, get a copy, data portability | your settings show your e-mail address, account number and creation date | Yes. The Application has no export function, so we prepare the copy ourselves, in a structured, commonly used and machine-readable format. |
| Correct your data | your name, time zone, Organization name and password | a change of your e-mail address |
| End a session | your settings; the record stays (3.17) | - |
| Delete data | a Server (10.3); your Account, with its Organization and the Organization's Servers (10.4); a link to Google or GitHub (3.13) | a record about your e-mail address that someone else created (3.6); an Account you cannot delete yourself, for example after an unfinished sign-up or when we disabled it |
| Stop finding notifications | your Account settings (3.19) | - |
| Withdraw consent to analytics | Cookie settings on the Website (6.9) | - |
| Restrict processing; object (10.5) | - | Yes |
| Reopen a disabled Account | - | Yes. A disabled Account cannot sign in. |
10.3 Deleting a Server. You can delete a Server in the Application. The deletion is immediate and cannot be undone. It removes the Server record and what was collected for it, including the Snapshots, the findings and the technical records of analysis jobs; clause 13 of the DPA lists the rest. Removed data stays for a time in backups (clause 9.3), and stays in our server logs (clause 3.27) and in what our e-mail and error-monitoring providers already received (clause 9.5). The Agent stays on the Customer's server, and the Application refuses the data it keeps sending, until the Customer removes it.
10.4 Deleting your Account. You delete your Account in your settings in the Application. It asks you to confirm twice and, if your last sign-in is not recent, to sign in again. The deletion is immediate and cannot be undone.
- It removes your user record, your links to Google or GitHub, your sessions, your API refresh tokens and your install tokens.
- Because an Organization has at most one user (clause 3.5), it also removes the Organization and its name, and every Server of the Organization with what was collected for it, as clause 10.3 describes.
The Agents on the Customer's servers keep running until the Customer removes them, and the Application refuses the data they send. As with a Server (clause 10.3), removed data stays in backups for a time, in our server logs and in what our providers already received. Apart from these copies, after the deletion we keep only what the table in clause 3.2 names for complaints, requests about personal data, orders of a paid plan and legal claims. While an Account is disabled, its Agents keep sending Snapshots, and the Application keeps storing them; if the Account is not reopened within 30 days, we can end the contract, and its data is then deleted (clauses 16.9 and 16.10 of the Terms). To have a disabled Account deleted sooner, write to us (clause 10.2).
10.5 Your right to object. Where we process your personal data on the basis of our legitimate interests (clauses 3.1, 3.2, 3.6, 3.18, 3.21, 3.32, 4.2, 4.5 and 5.1), you can object at any time, on grounds that relate to your particular situation. Write to the address in clause 16.1. After an objection we stop that processing, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims (Article 21(1) GDPR).
10.6 To use your rights, write to the address in clause 16.1 or to our Data Protection Officer (clause 1.2). If you can, write from the e-mail address of your Account. Then we can check that the request comes from you.
10.7 We answer within one month of receiving your request. We can extend this by two further months where requests are complex or numerous. If we do, we tell you within the first month and give the reason (Article 12(3) GDPR).
11. Whether you must give us data
11.1 To create an Account you must give your name, a name for your Organization, an e-mail address and a password, or sign in through Google or GitHub. Without this data we cannot create the Account, and you cannot use the Application. No law requires you to give it.
11.2 For Customer Data we are the processor, and the Customer decides what the Agent sends: clause 16.4 of the DPA lists the Customer's controls, and the Customer informs the people whose data is in Customer Data (clause 16.2 of the DPA).
11.3 When you write to us, you decide what you send. If you give us no way to answer, we cannot answer you.
11.4 Analytics on the Website is optional. The Website works the same way if you reject it.
12. Automated decision-making
12.1 On the Website, in the Documentation, in the Demo and in the Application, we make no decision about you by automated means alone that has a legal effect on you or affects you in a similarly significant way, and we do no profiling of this kind.
12.2 The Application checks each Snapshot against rules automatically and shows the results as findings about a Server. The findings are about the configuration and state of the Server. They can mention database users, for example the user name of a database session, but they have no legal or similarly significant effect on them. The Application does not use an artificial-intelligence service.
13. Children
13.1 The Application does not ask for your age. The Website, the Documentation, the Demo and the Application are not intended for or directed at children, and an Account is only for a person who is at least 18 years old (Terms, clause 5.2). We do not intentionally collect personal data from children. If you believe that a child has given us personal data, write to us (clause 16.1) and we will delete it.
14. Security
14.1 We protect personal data with technical and organisational measures that exist today, among them:
- encryption of data in transit (HTTPS) and of our database backups;
- passwords, session tokens and API refresh tokens stored as hashes;
- access to our production systems only for the people who need it;
- regular backups, with a test that restores a backup scheduled every week.
These measures reduce risk. They do not remove it. Annex II of the DPA describes the measures for Customer Data.
15. Changes to this policy
15.1 When we change this policy in a way that matters to you, for example a new purpose, a new recipient or a new transfer, we announce the change by e-mail to the address of your Account at least 30 days before it takes effect. During that time you can write to us with an objection (clause 16.1), and you can delete your Servers and your Account (clauses 10.3 and 10.4).
15.2 We publish each version of this policy at https://guardioz.com/privacy with its "Last updated" date, and we send earlier versions on request. Visitors to the Website and readers of the Documentation have given us no e-mail address. A visitor who made a choice about analytics is asked again when the policy changes in a way that matters, and the Website then says that the policy has changed (clause 6.9). For other visitors and for readers of the Documentation, the published version is the notice.
15.3 Section 2 of the Service Provider List says how we announce a change to that list. The DPA sets out the Customer's right to object to a new sub-processor.
16. Contact and complaints
16.1 For support, complaints and requests about your personal data, write to contact@guardioz.com. You can also write to our Data Protection Officer (clause 1.2). For requests about your personal data the time limit in clause 10.7 applies. Complaints about the Service follow clause 17 of the Terms.