Privacy Notice

This privacy notice explains how Vertas AI Ltd ("we", "us", "our") collects, uses, stores, and shares personal data in connection with the guardbook website, application, and related services.

This notice is important because we may act in two different roles depending on the data involved:

• We act as controller for personal data relating to account holders, billing contacts, website users, prospective customers, and marketing recipients.
• We act as processor for personal data that a customer uploads to guardbook or otherwise asks us to process through the service on the customer's behalf.

Where we act as a processor, the relevant customer firm is usually the controller and is primarily responsible for explaining that processing to the individuals concerned.

1. Who is responsible for your personal data?

For personal data covered by this notice where we act as controller, the data controller is:

Vertas AI Ltd, a company registered in England and Wales under company number 17392826.

Email: hello@guardbook.ai

2. The two roles we play

A. Where we are the controller

We are the controller for personal data we use for our own business purposes, such as:

• creating and managing guardbook customer accounts;
• verifying account ownership and managing logins;
• communicating with account holders and admins about the service;
• providing support;
• managing subscriptions, invoicing, and payment administration, where applicable;
• handling sales enquiries, demos, and onboarding;
• sending marketing communications where consent has been given;
• maintaining security, preventing misuse, and improving the guardbook platform; and
• complying with legal, regulatory, tax, and record-keeping obligations.

B. Where we are the processor

We act as a processor when a customer firm uses guardbook to upload, store, manage, or organise personal data for that firm's own purposes.

This may include records relating to:

• the firm's staff, surveyors, directors, and administrative personnel;
• named individuals recorded in the firm's people records, including named reviewers, account holders, and individuals assigned AI oversight responsibilities;
• training, competency, and compliance records entered by the firm;
• records of AI tool use, suitability assessments, risk entries, and oversight decisions;
• the firm's client contacts; and
• the firm's supplier or subcontractor contacts.

In those cases:

• the customer firm decides why the personal data is being used and is the controller;
• we process that data only to provide the guardbook service; and
• requests about that data should usually be directed first to the relevant customer firm.

3. What personal data we collect as controller

Where we act as controller, we may collect and use the following categories of personal data:

• identity data, such as name and job title;
• contact data, such as email address, telephone number, and business address;
• account data, such as username, login details, password reset records, and account preferences;
• transaction and billing data, such as subscription plan, invoices, payment contact details, and payment status;
• communications data, such as support messages, demo requests, onboarding information, and email correspondence;
• marketing data, such as consent preferences, campaign interactions, and suppression records;
• technical data, such as IP address, browser type, device information, and service logs;
• usage data, such as activity within the website or app, feature usage, and diagnostic information; and
• any other information voluntarily provided to us in connection with an enquiry, support request, or account.

We do not intentionally seek to collect special category personal data through standard account signup or marketing processes.

4. How we use personal data and the legal bases

Where we act as controller, we use personal data for the following purposes and legal bases:

Where we rely on legitimate interests, those interests generally include operating, securing, supporting, and improving guardbook, communicating with business users, and growing the business in a proportionate way.

We may also create and use irreversibly anonymised data, which does not identify any firm or individual and cannot reasonably be used to re-identify them, to operate, secure and improve the service and to produce aggregated insights and benchmarks, relying on our legitimate interests. Once data has been irreversibly anonymised it is no longer personal data.

5. Where personal data comes from

We may collect personal data directly from:

• the individual;
• the individual's employer or firm;
• account administrators;
• communications through the website, app, email, or support channels; and
• automated technical collection through use of the guardbook website or application.

Where we act only as processor, the personal data is generally provided by the relevant customer firm or entered into guardbook by that firm's users.

6. Who we share personal data with

We may share personal data with service providers that support guardbook and our business operations, including:

• Supabase for database, storage, authentication, and related infrastructure;
• Vercel for application hosting, deployment, delivery, and related technical services;
• Amazon Web Services (Amazon SES) for transactional email delivery and related email infrastructure;
• Cloudflare for bot-protection (Turnstile) and related security infrastructure;
• Anthropic for the AI model behind Guidance, which receives the questions you ask in Guidance and earlier messages in that conversation, but not your firm's records; and
• Sentry for error monitoring, hosted in the EU, which receives technical details of errors but not names, email addresses or IP addresses.

We may also share personal data where necessary with:

• professional advisers, such as lawyers, accountants, or insurers;
• payment providers and financial institutions, where applicable;
• regulators, law enforcement, courts, or public authorities where required by law; and
• a purchaser, investor, or successor entity in connection with a merger, acquisition, investment, restructuring, or sale of assets, subject to appropriate confidentiality safeguards.

Where third parties process personal data on our behalf, we take steps to ensure that they are subject to appropriate contractual and security obligations.

7. International transfers

We aim to host and manage guardbook using infrastructure chosen to support UK data protection compliance. However, some suppliers or onward sub-processors may process data outside the UK or permit remote access from outside the UK.

Where we transfer personal data outside the UK, or permit processing outside the UK, we will seek to ensure that an appropriate safeguard is in place, such as:

• adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under UK data protection law.

More specific transfer information can be provided on request where appropriate.

8. How long we keep personal data

Where we act as controller, we keep personal data only for as long as necessary for the purpose for which it was collected, including to satisfy legal, accounting, tax, contractual, and reporting requirements.

Retention periods may vary depending on the type of data, but broadly:

• account data is kept for the life of the account and a reasonable period afterwards;
• support and communications records are kept for as long as needed to manage the relationship and resolve issues;
• billing and financial records may be retained for the period required by law;
• Guidance conversations are deleted 30 days after they were last used, or sooner if you delete them; and
• marketing data is kept until consent is withdrawn, an objection is received, or the data is no longer needed.

Where we act as processor, customer data is retained in accordance with the customer's instructions, the relevant customer contract, and our deletion and return obligations under our Data Processing Agreement.

9. Your rights

Where we act as controller for your personal data, you may have the following rights, subject to the conditions and limits set by UK data protection law:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object;
• the right to withdraw consent; and
• rights relating to automated decision-making and profiling.

If you want to exercise any of these rights, please contact us using the contact details above.

If your request relates to data that a customer firm controls within guardbook, we may direct you to that firm because it is usually the controller for that data.

10. Marketing and withdrawing consent

Where we rely on consent for marketing, consent can be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

You can opt out of marketing communications at any time from the Email preferences section of your account settings, or by contacting us.

11. Complaints

If there is a concern about how we handle personal data, please contact us first at hello@guardbook.ai. We will acknowledge your complaint within 30 days and aim to resolve it without undue delay.

Individuals in the UK also have the right to complain to the Information Commissioner's Office (ICO) at any time. Information about how to contact the ICO is available at www.ico.org.uk.

12. Automated decision-making

We do not currently use personal data covered by this notice to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals.

13. Cookies and similar technologies

We use Cloudflare Turnstile on our sign-up, sign-in and password reset forms to check that a person, not an automated bot, is using them. Turnstile does not set cookies on the settings we use.

To run the check, Turnstile reads technical signals from your browser, such as your IP address and browser type. It does not read what you type into the form. Cloudflare processes these signals for us to protect the Service. Cloudflare also uses the same signals, as its own controller, to improve its bot detection, as set out in its Turnstile privacy addendum.

Because this check is needed to keep sign-in to the Service secure, we do not ask for separate consent for it.

We do not currently use cookies or similar technologies for advertising or non-essential analytics. If that changes, we will update this notice and ask for consent where the law requires it.

14. Security

We use technical and organisational measures designed to protect personal data, including measures relating to access control, authentication, secure transmission, supplier management, and incident response.

No method of transmission over the internet or method of electronic storage is completely secure, but we seek to apply security measures appropriate to the risks involved.

15. Changes to this notice

We may update this privacy notice from time to time to reflect changes in the law, the guardbook service, or business operations.

Where appropriate, the updated notice will be published on the guardbook website or otherwise notified to relevant individuals.