Privacy Policy. Last updated May 2026.
This page is provided as a reference. The version that applies to your contract is the one signed in your order form or DPA. Contact [email protected] for the contract-specific version.
1. Who we are
Guardian Gaze is operated by Guardian Gaze Limited, a company registered in England & Wales. Our registered office is in London, United Kingdom. We are the data controller for personal data processed in connection with the public website and platform.
2. What personal data we process
For platform users, we process: name, work email, IP address at sign-in, and audit-log entries for actions taken in the dashboard. For visitors to the public website, we process: IP address, user-agent, referrer, and any data submitted via contact forms.
3. What we don’t process
We do not scan your internal systems or ingest customer personal data from your platforms. All Guardian Gaze scanning is performed from the public internet against assets you have attributed to your organisation, or via OAuth-scoped read access to cloud providers you have connected (AWS, Azure, GCP).
4. How we use it
Account management, audit logging, security monitoring of our own platform, compliance with legal obligations, and service-related communications. We do not sell personal data or use it for advertising.
5. Retention
Specific retention periods are set out in the customer order form and DPA. Public-website analytics and contact-form submissions are retained for the period reasonably necessary to respond and follow up.
6. Your rights (UK and EU)
Access, rectification, erasure, restriction, portability, and objection. Email [email protected] to exercise any of these.
7. Lawful basis
Legitimate interest for platform analytics and security monitoring. Contractual necessity for account management. Consent for marketing emails (you can withdraw at any time via the unsubscribe link).
8. Data location
Default region for the platform is the UK. Other regions are available for customers with specific data-residency requirements; this is agreed in the customer order form.
9. Sub-processors
The current sub-processor list is maintained in the customer DPA. Changes are notified to customers in advance via the contractual notice channel.
10. Contact
For privacy questions: [email protected]. For the UK supervisory authority: the Information Commissioner’s Office at ico.org.uk.