1. Who we are
Guardy is an anti-money-laundering compliance service for estate and letting agents. It is run by [Legal name of the business, e.g. "Your Name, trading as Guardy" or "Guardy Ltd (company no. …)"], of [Registered or trading address in the UK] (“we”, “us”). We are registered with the Information Commissioner’s Office under number [ICO registration number].
For anything about this policy or your personal data, email [[email protected]].
2. Two different roles
Where we decide how data is used (we are the controller). This covers people who use Guardy: agency owners, compliance officers and staff with accounts, people who try the demo, and people who contact us. This policy explains that processing.
Where an agency decides (we are the processor). Agencies use Guardy to keep records about their own clients, such as buyers, sellers, landlords, tenants, company owners and the other parties to a transaction. For those records the agency is the controller and we act only on its instructions, under our data processing agreement. If you are an agency’s client and want to know what is held about you, contact the agency. If you contact us, we will pass your request to them.
3. What we collect about users
- Account details: your name, work email, agency name and role.
- Sign-in and security data: your password, stored only as a one-way hash; your two-factor authentication secret, stored encrypted; recovery codes, stored hashed; when you last signed in; failed sign-in attempts and lockouts.
- Activity records: an audit log of actions taken in your agency’s account, with the time, the user and the IP address the action came from. Agencies need this log as evidence for their supervisor.
- Training records: which modules you completed, your answers and your scores.
- Notification records: which emails we sent you and when, and your email notification preference.
- Billing details: handled by Stripe. We keep the Stripe customer and subscription reference and the subscription status. We never see or store card numbers.
- Correspondence: anything you send us by email.
Demo: each visit to the demo creates a temporary sandbox agency filled with invented sample data. It is deleted automatically after 24 hours. Demo accounts use addresses that are never emailed.
4. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing your account and the service your agency signed up for | Contract with your agency, and our legitimate interest in providing the service to its staff |
| Keeping accounts secure, preventing misuse and keeping the audit log | Legitimate interests (security, and supporting agencies’ record-keeping duties) |
| Sending service emails such as alerts, reminders, password resets and billing notices | Contract and legitimate interests |
| Billing and keeping accounting records | Contract and legal obligation (tax law) |
| Answering your questions | Legitimate interests |
We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.
5. Cookies
Guardy only uses cookies that are strictly necessary to sign you in and to protect forms against cross-site request forgery. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. Turning these cookies off will stop you signing in.
6. Who we share it with
We use these service providers (“subprocessors”). Each one is bound by a contract that protects the data.
| Provider | What for | Where |
|---|---|---|
| [Hosting provider, e.g. Hetzner Online GmbH] | Servers that run Guardy and store its database and uploaded documents | [Data centre country, e.g. Germany] |
| Cloudflare, Inc. | DNS, TLS and network protection; all web traffic to Guardy passes through it | Global network; company in the United States |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscription billing and card payments | Ireland and the United States |
| Brevo (Sendinblue SAS) Only once email sending is switched on | Sending account and compliance alert emails | France (EU) |
| OpenSanctions Datenbanken GmbH Only if automated PEP screening is switched on | Automated politically exposed person (PEP) screening | Germany (EU) |
Sanctions lists (UK, UN, EU and US) are downloaded to our own servers and screening runs there, so no client details are sent to any list provider. Companies House lookups send only the company name or number being searched.
We may also disclose data where the law requires it, for example to a court, regulator or law enforcement agency, or to protect our rights. If a business transfer happens, data would pass to the new owner under the same protections.
7. International transfers
Some providers process data outside the UK, as the table above shows. Where a country does not have UK adequacy regulations, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework. You can email us for details.
8. How long we keep it
- We keep account details for as long as the account exists. After your agency closes its account, we delete them within 30 days, and from backups within a further 35 days.
- Audit log and training records are part of the agency’s compliance records. They are kept and deleted with the rest of the agency’s data, as the agency instructs.
- Invoices and billing records are kept for 6 years after the end of the financial year they relate to, because tax law requires it.
- Demo sandboxes are deleted after 24 hours.
- Emails you send us are kept for up to 2 years after the matter is closed.
9. Your rights
You can ask us for a copy of your data. You can also ask us to correct it, delete it, restrict how we use it, object to how we use it, or transfer it to someone else. Some rights have limits, for example where your agency needs a record for its legal duties. Email [[email protected]]. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to sort it out first.
10. Security
All traffic is encrypted with TLS. Passwords are hashed with bcrypt. Accounts lock after repeated failed sign-ins, and two-factor authentication is available. Signing out ends the session on the server. Each agency’s records are kept apart from every other agency’s, and staff permissions are limited by role. The database refuses any edit or deletion of audit log entries. The data processing agreement lists our security measures in full.
11. Changes
If we change this policy, we will update the version date above. If a change is significant, we will tell account owners by email before it takes effect.