1. About this page
1.1 "Guardioz", "we" and "us" mean Clouds On Mars Sp. z o.o. Section 1 of the Terms gives our company details.
1.2 Words with a capital letter have the meaning given in the Terms (https://guardioz.com/terms).
1.3 Table A lists the sub-processors: the providers that can process for us the personal data that the DPA covers, which is Customer Data and the material in DPA clause 2.4. For Customer Data, the Customer is the controller, or a processor for its own clients, and we are its processor (DPA clause 4.1). Annex III of the DPA (C2) says which part of this page forms part of the DPA, and in which version. We keep each earlier version of this page and send it on request.
1.4 Table B lists the providers that process, on our behalf, the personal data for which we are the controller, as the Privacy Policy describes, including Account Data, request logs, correspondence and data about visitors to the Website, the Documentation and the public demo at demo.guardioz.com. We send no Customer Data to a service that appears only in Table B or Table C. No other company of the Clouds On Mars group receives personal data processed for Guardioz.
1.5 Table C lists the sign-in services of Google and GitHub. They act as their own controllers, not on our behalf (5.1).
1.6 This page covers the Service at app.guardioz.com, the public demo at demo.guardioz.com, the Website and the Documentation.
2. How we announce a change
2.1 Each of these events is a change to this page:
- we add or replace a provider;
- the legal entity, country or place of processing of a provider changes;
- more kinds of data can reach a provider;
- the transfer mechanism or Data Privacy Framework status of a provider changes, or the decision in 7.2 stops applying.
2.2 We announce each change to Table A by e-mail to the address of your Account, at least 30 days before it takes effect. A change that a provider or an authority decides, or an urgent replacement needed to protect the security or continuity of the Service, is announced as soon as reasonably possible after we learn of it, and we say what we do about the transfer (DPA clause 10.2). A change shown only on this page is not a notice, and we do not ask you to check this page.
2.3 Clause 10 of the DPA gives the Customer the right to object to a change to Table A, and says what happens next.
2.4 We announce a change to Table B or Table C as clause 15 of the Privacy Policy describes: a change that matters to you, such as a new recipient or a new transfer, by e-mail to the address of your Account. Visitors of the Website and the Documentation have no Account, so for them a change to Table B or Table C appears on this page and in the Privacy Policy, with its date.
3. Table A - Sub-processors under the DPA
| Provider | What it does for us | Personal data under the DPA that can reach it | Legal entity, place, contract, transfer mechanism |
|---|---|---|---|
| A1. Microsoft (Azure) | Hosting of the Application, its database and the database backups. | All Customer Data, in the database and the backups, including what the Agent reads about current database sessions (pg_stat_activity): database user names, client addresses and host names, application names and the text of SQL statements, from which the Agent removes only a password written right after the word PASSWORD. The Azure agent on the production machine also sends the operating system's log files to Microsoft every hour; they hold copies of the Application's log entries, with the IP addresses of Agent hosts. | Microsoft Ireland Operations Limited, Ireland, under the Microsoft Products and Services Data Protection Addendum, which forms part of our Azure subscription terms. The production machine and the backup storage are in the Poland Central region. Microsoft receives the log files that its agent sends and processes them under the same addendum. Where Microsoft transfers data to the United States, it relies on the EU-U.S. Data Privacy Framework and on standard contractual clauses. |
| A2. Brevo | Delivery of every e-mail that the Application sends. | Parts of Customer Data in notification e-mails about findings: the Server name (by default the host name of your server), the names of affected replication slots, and measured values, such as setting values, free disk space and the volume of transaction logs that a replication slot holds. Today they carry no names of databases, schemas, tables or indexes and no SQL text. Annex I of the DPA (A2.3) lists the content. | Sendinblue SAS, Paris, France, the contracting party for a company incorporated in Poland under the Brevo terms of use of 1 October 2025 (https://www.brevo.com/legal/termsofuse/). A data processing agreement under Article 28 GDPR forms part of Brevo's General Conditions of Use and applies to our account. Our account deletes the record of each e-mail after 1 month and stores no copy of its content. The same terms name hosting servers in France and Belgium. They allow processing outside the European Economic Area and state that Brevo then protects the data with standard contractual clauses and supplementary measures, and may rely on the EU-U.S. Data Privacy Framework for transfers to the United States of America. Their list of sub-processors includes Brevo group companies in the United States of America and India, for customer support and maintenance, and service providers based in the United States of America. |
| A3. Sentry | Error reports that the Application sends when it fails on our server. | Technical data about a failed request, and parts of Customer Data in error text (3.2). | Functional Software Inc., United States of America. Our organization is in the EU region of Sentry, which stores error reports in Frankfurt, Germany. On our plan, the data retention period at Sentry is 30 days. We accepted the Sentry Data Processing Addendum, version 5.1.0, on 24 September 2026 (https://sentry.io/legal/dpa/). Under it, transfers to the United States of America rely on the EU-U.S. Data Privacy Framework, and on standard contractual clauses where the Framework does not apply. |
| A4. Microsoft 365 | Mailboxes in the guardioz.com domain that receive your messages to contact@guardioz.com. | Personal data from your databases that you include in a message to us, for example SQL text, database user names or client addresses in lines from the Agent's log (DPA clause 2.4). We delete it when your request is handled, and a deleted message can stay recoverable in Microsoft 365 for a limited time after that. The Agent sends nothing here. | Microsoft Ireland Operations Limited, Ireland, under the Microsoft Products and Services Data Protection Addendum. Where Microsoft transfers data to the United States, it relies on the EU-U.S. Data Privacy Framework and on standard contractual clauses. |
3.1 Brevo also delivers technical alerts about our own machines to our staff, not to Customers. An alert can contain the host name of our machine and lines from its system journal, and those lines can contain parts of Customer Data, such as the name of a Server.
3.2 An error report to Sentry describes one failed operation of the Application, such as handling a request, analysing a Snapshot or sending an e-mail. Production sends no traces of requests that did not fail. A report can contain:
- (a) the IP address of the caller; for the Agent or the installer, the address from which your server connects;
- (b) the URL, the method and other headers of the request, such as the user agent (browser or program details);
- (c) technical data about the error, including log lines written before and at the error;
- (d) text in error messages and log lines, as written, which can include personal data and Customer Data, such as the Server name, an e-mail address, database user names, client addresses and SQL text.
The request data leaves out the request body (for the Agent, the Snapshot), cookies, the query string and the previous page. The Application does not attach the values of variables in the code or the identity of the signed-in person to a report.
3.3 The Agent sends data only to the Application and has no telemetry. The pages of the Application load nothing from other hosts. While it handles requests, the Application connects to no third party other than Sentry, Brevo and the sign-in services of Google and GitHub, and it has no other telemetry and no analytics.
4. Table B - Providers that process Account Data and visitor data for us
| Provider | What it does for us | Data that can reach it, or that it sends us | Legal entity, place, contract, transfer mechanism |
|---|---|---|---|
| B1. Microsoft (Azure) | As in row A1, and hosting of the public demo at demo.guardioz.com. | All Account Data, in the database, the server logs and the backups, including the operating-system log files that the Azure agent sends to Microsoft every hour (row A1), which hold IP addresses of visitors and the addresses and subjects of e-mails sent. For the public demo: the IP address and user agent of its visitors and the address of each page they open, in the server logs of the demo machine, including the operating-system log files that the Azure agent there also sends to Microsoft every hour. The public demo sends no data to Brevo, Sentry, Google or GitHub. | As in row A1. The public demo is hosted in the Poland Central region. |
| B2. Brevo | As in row A2. | The sender, the recipient's address, the subject and the full body of each e-mail, including the display name in a password reset e-mail and, in e-mails that confirm an address or reset a password, a personal link with the user's identifier and e-mail address. Brevo records opens and clicks and ties them to the recipient's address; to record clicks it replaces each link with a link to its own address, so the personal links above also pass through Brevo. The Application keeps no record of these, and our Brevo account holds no contact lists or campaigns. | As in row A2. |
| B3. Sentry | As in row A3. | For an error during a request of a person (3.2): the IP address, the user agent and other request headers, and the page address. An e-mail address can appear in error text. | As in row A3. |
| B4. Microsoft 365 | Mailboxes in the guardioz.com domain: contact@guardioz.com and the mailbox that receives replies to the welcome e-mail. | The sender's address and the message. For support, the Documentation asks for the Server name, installer output and Agent log lines, so a message can contain data about your server. | Microsoft Ireland Operations Limited, Ireland, under the Microsoft Products and Services Data Protection Addendum. Where Microsoft transfers data to the United States, it relies on the EU-U.S. Data Privacy Framework and on standard contractual clauses. We keep correspondence as clause 3.30 of the Privacy Policy says. |
| B5. Microsoft (Azure App Service, Azure Static Web Apps) | Hosting of the Website and the Documentation. | The IP address and user agent of their visitors, and of people who open an e-mail from the Application, because its logo loads from guardioz.com. The Documentation pages load nothing from other hosts. | As in row A1. The Website is hosted in the Poland Central region. The Documentation is served from points that Microsoft distributes around the world (https://learn.microsoft.com/en-us/azure/static-web-apps/overview). Neither host keeps request logs for us. |
| B6. Google Analytics 4 | Statistics about visits to the Website, loaded only after the visitor consents. | From the visitor's browser: the IP address, the user agent, the page address and an identifier kept in a cookie (the Privacy Policy describes the cookies). Our property keeps event data for 2 months and data tied to the identifier for 14 months after the last visit. We do not let Google use the data to improve its own products and services. | Google Ireland Limited, Ireland, under the Google Analytics terms for an account in Poland and the Google Ads Data Processing Terms, accepted on 1 June 2026. Google can process the data in the United States and in other countries where it has facilities; for transfers outside the European Economic Area its data processing terms include the standard contractual clauses, and Google LLC is certified under the EU-U.S. Data Privacy Framework. |
5. Table C - Sign-in services that act as their own controllers
| Provider | What it does | Data that can reach it, or that it sends us | Legal entity, place |
|---|---|---|---|
| C1. Google (privacy policy: https://policies.google.com/privacy?hl=en&gl=pl) | Sign-in with Google, when a person chooses it (5.1). | The person's browser goes to Google, so Google learns of the sign-in and receives the IP address and user agent. We read from Google the person's identifier at Google, the verified e-mail address and the name, and we keep no access to the person's Google account. | Google Ireland Limited, Ireland, as the Google privacy policy names it for the European Economic Area and Switzerland (5.1). |
| C2. GitHub (privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) | Sign-in with GitHub, when a person chooses it (5.1). | As in row C1, with GitHub in place of Google, and the login in place of the name when no name is set. | GitHub, Inc., United States of America, or GitHub B.V., the Netherlands, as GitHub names them in its privacy statement. The person's browser connects to GitHub directly, and we send GitHub no personal data. |
5.1 We treat Google and GitHub as their own controllers when a person signs in with them, not as our processors. They are also the source of the Account Data they send us.
6. Other services
6.1 These services work for us and receive no Customer Data and no Account Data.
6.2 We deploy the Service from GitHub. GitHub stores no Customer Data, but our deployments run on GitHub and reach the production machine.
6.3 Let's Encrypt issues our certificate. The Agent installer downloads software on your server from the Python Package Index (PyPI) and your operating system's repositories (Agent Licence, section 5).
6.4 The "Ask AI" links in the Documentation open OpenAI, Anthropic or Cursor with the address of the page, only when the visitor clicks.
7. Transfers outside the European Economic Area
7.1 Some providers can process data outside the European Economic Area (EEA). For each provider in Tables A and B, this page gives the place of processing and the transfer mechanism.
7.2 Commission Implementing Decision (EU) 2023/1795 covers only organisations on the Data Privacy Framework List (https://www.dataprivacyframework.gov/list). On 21 September 2026 the EU-U.S. certification of Functional Software Inc. (Sentry), Brevo, Inc., Google LLC and GitHub had the status "Active", and that of Microsoft Corporation "Active - Re-certification under Review".
7.3 Where this page names standard contractual clauses (Commission Implementing Decision (EU) 2021/914), anyone whose data they cover can ask us for a copy at the address in section 8.
8. Contact
8.1 For questions about this page, and to object under 2.3, write to contact@guardioz.com.