Privacy Policy
Last updated: February 24, 2026
Your AI data never reaches us
The Universal Guardrail software runs entirely within your own infrastructure. We have zero access to the prompts, responses, or audit logs processed by the Software. This policy covers only data we collect through our marketing website and sales process.
Universal Guardrail Ltd ("Company", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect personal data in connection with our marketing website (universalguardrail.io) and sales activities. It does not apply to data processed by the Software itself, which remains within your own infrastructure.
1. Data We Collect
| Category | What we collect | Why |
|---|---|---|
| Contact data | Name, email, company name, phone | Respond to sales inquiries and trial requests |
| Account data | Email, company, license tier | Manage your subscription and deliver license keys |
| Usage analytics | Page views, referral source (anonymised) | Improve our marketing website |
| Payment data | Billing address, card last 4 digits | Invoice processing via our payment provider (Stripe) |
2. Data We Do NOT Collect
- Prompts or user inputs sent to AI models through the Software
- LLM responses or outputs processed by the Software
- Audit log events generated by the Software in your environment
- Contents of your
guard_config.yamlfile - Any personal data of your end users
3. Legal Basis for Processing (GDPR)
We process personal data under the following lawful bases:
- Contract performance — billing, license delivery, and support
- Legitimate interests — marketing analytics and fraud prevention
- Consent — for marketing emails (you may unsubscribe at any time)
4. Data Retention
- Contact form submissions: 24 months from last interaction
- Customer account data: Duration of subscription + 7 years (legal obligation)
- Payment records: 7 years (financial regulation)
- Marketing analytics: 26 months (Google Analytics default cycle)
5. Third-Party Services
We use the following sub-processors for business operations:
- Stripe — Payment processing (PCI-DSS certified)
- Google Analytics — Anonymised website analytics
- HubSpot — CRM and email communication
- AWS — Hosting of our marketing website
All sub-processors are bound by Data Processing Agreements and operate in compliance with GDPR.
6. International Transfers
We are based in the United Kingdom. Where personal data is transferred outside the UK/EEA, we use Standard Contractual Clauses (SCCs) or other appropriate safeguards.
7. Your Rights
Under GDPR and UK GDPR, you have the right to:
- Access, rectify, or erase your personal data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the ICO (UK) or your local supervisory authority
To exercise your rights, email: privacy@universalguardrail.io
8. Cookies
Our marketing website uses:
- Essential cookies — required for site functionality. Cannot be disabled.
- Analytics cookies — anonymised usage data (Google Analytics). You may opt out.
No tracking or advertising cookies are used.
9. Security
We apply technical and organisational measures including TLS encryption in transit, access controls, and regular security reviews of systems that hold your personal data.
10. Changes
We may update this policy periodically. We will notify subscribers of material changes by email. The latest version is always available at this URL.
11. Contact
Data Controller: Universal Guardrail Ltd
Email: privacy@universalguardrail.io