1. Scope and Roles
This Privacy Notice covers GuidMe account holders, workspace users, invited users, prospects, newsletter subscribers, support contacts, billing contacts, API users, and end users who interact with a GuidMe widget embedded in a customer application.
GuidMe may be a controller for its own account, billing, support, marketing, security, analytics, legal-notice, and website operations. GuidMe may be a processor or service provider when processing customer-controlled widget sessions, uploaded documentation, URLs, screen context, audio, transcripts, prompts, outputs, or similar content on behalf of a customer. Final role wording needs owner/lawyer review.
2. Data We Process
- Account and workspace data: name, email, organisation, role, tenant/workspace, invites, preferences, authentication events, OAuth profile data, and security settings.
- Billing data: plan, subscription, currency, invoice, Stripe customer/subscription identifiers, usage, overage, tax and billing metadata. Payment card details are handled by Stripe.
- Customer content: uploaded documents, file metadata, web links, widget configuration, app/project data, API keys or key prefixes, knowledge-base records, and support content.
- AI and session data: audio streams, screen or screenshot context, transcripts or conversation history where enabled, AI prompts, AI outputs, citations, feedback, session events, analytics aggregates, and operational telemetry.
- Website, cookie, and marketing data: consent choices, newsletter email consent, contact form data, page events where analytics consent is given, status page interactions, and communication preferences.
- Technical and security data: IP address or hashed IP where implemented, user-agent hash, device/browser data, logs, error reports, rate-limit data, audit logs, and fraud/abuse signals.
3. Purposes and Legal Bases
- Provide and secure the Service, authenticate users, manage workspaces, process content, operate the widget, generate AI assistance, and maintain API access.
- Process subscriptions, invoices, usage records, taxes, chargebacks, and billing support.
- Send transactional, security, legal, service, billing, and support notices independently of marketing opt-in status.
- Send newsletters or direct marketing only where the relevant consent or lawful basis applies and unsubscribe rights are honoured.
- Run consent-gated analytics, experimentation, and functional SDKs where required; run necessary operational telemetry for security and reliability.
- Respond to DSAR/privacy requests, account deletion requests, legal obligations, disputes, fraud prevention, abuse reports, and security incidents.
4. AI Processing
GuidMe uses Google Gemini Live for voice, vision, and screen-aware guidance. Gemini can call GuidMe's backend to retrieve project-scoped content from customer documentation and crawled URLs. The current live-session configuration does not enable Gemini File Search, Google Search or Maps grounding, or provider URL Context.
AI features may process customer-provided documents, URLs, prompts, audio, screenshots, transcripts, and outputs. Customers should not submit sensitive or regulated data unless their configuration, agreement, and notices support that use.
Google states that Gemini API Paid Services prompts and responses are not used to improve Google products, and applies the same data-use terms to EEA, UK, and Swiss use even with free quota. Google may retain content for abuse monitoring and a 24-hour implicit cache. GuidMe must verify the production paid tier and must not claim zero data retention unless Google approves the project for that program.
5. Cookies, Consent, and Marketing
The web app includes a cookie consent manager with necessary, functional, analytics, and marketing categories. Browser analytics, OpenTelemetry browser telemetry, Amplitude, and GrowthBook client-side use are consent-gated in the observed code. Email marketing consent is separate from cookie marketing consent.
GuidMe honours Global Privacy Control or browser Do Not Track signals by suppressing analytics, marketing, and email-marketing consent in the client state. Referly referral scripts are classified as marketing and should not load or receive user email unless marketing consent is active.
No Google Analytics, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, Hotjar, FullStory, LogRocket, Segment, Intercom, or HubSpot browser tracking was found in the reviewed code. Future additions should update this notice, the Cookie Policy, the consent banner, and the vendor register before launch.
Email open or click tracking for marketing or one-to-one emails should remain disabled unless the recipient has given legally sufficient consent for that tracking in the relevant jurisdiction. Transactional token links must not be rewritten in a way that breaks security or privacy expectations.
6. Recipients and Service Providers
The observed code and configuration reference Supabase, Vercel, Railway, Google AI/Gemini, Stripe, Postmark, SendPortal/newsletter service, Cloudflare Turnstile, Upstash Redis, New Relic, Sentry, Better Stack, Checkly, Amplitude, GrowthBook, Userback, Referly, Fides, GitHub, and Infisical/Cloudflare Access for internal operations. Some providers are optional or environment-dependent.
A current subprocessor list, DPA status, regions, retention, and international transfer safeguards should be maintained and reviewed before customer publication or enterprise sales.
7. International Transfers
GuidMe is operated from Scotland and serves global B2B users. The architecture prefers UK/EU regions where available, but several providers may process data in the United States or other regions. Transfers from the UK, EEA, Switzerland, or other regulated regions may require adequacy decisions, UK IDTA/addendum, EU SCCs, transfer impact assessments, DPAs, or equivalent safeguards.
8. Retention and Deletion
- Account, workspace, and customer content are generally retained while the account or workspace is active, unless deleted earlier by the customer or by account deletion workflows.
- The root policies and code reference 90-day session/conversation retention, 7-year billing retention, 3-year DSAR and consent record retention, and provider-configured operational log retention. These periods require owner confirmation against actual production settings and backup retention.
- The app includes account deletion and DSAR request routes. Third-party deletion may depend on the provider and the type of data.
9. Your Rights and Choices
Depending on your location and relationship to GuidMe or a GuidMe customer, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent where processing relies on consent.
Use the Data Request page for access, deletion, correction, and portability requests. Use the Privacy Complaint page for complaints about how personal data has been handled. If your data is controlled by a GuidMe customer, GuidMe may need to refer the request or complaint to that customer or act on the customer instruction.
Workspace administrators can request a portable tenant/workspace metadata export through the backend tenant export endpoint. This supports customer portability and vendor-exit due diligence without exposing secrets such as API-key hashes.
10. Children
GuidMe is intended for adults using the Service for business or professional purposes. It is not child-directed. If you believe a child has provided personal data to GuidMe, contact support@guidme.ai with the subject "Child Data".
11. AI Transparency
GuidMe provides an AI assistant experience. Users should understand that they may be interacting with AI-generated guidance, summaries, transcriptions, citations, or outputs. AI outputs can be wrong or incomplete and should be reviewed before use.
For EU users, GuidMe should continue preparing for AI Act transparency obligations that apply from August 2026, including clear disclosure when users interact with AI systems and appropriate labelling of synthetic or AI-generated content where relevant.
12. Contact and Complaints
Privacy requests: support@guidme.ai with the subject "Privacy Inquiry". Privacy complaints can also be submitted through /privacy-complaints. Security issues: support@guidme.ai with the subject "Security Issue". Legal entity details, registered address, privacy email, DPO status, and supervisory-authority wording remain owner/lawyer inputs.