Privacy Policy — GuardrailX
This policy explains how we process the personal data of those who sign up for and use GuardrailX (the "Service"), available at https://guardrailx.ai (presentation), https://app.guardrailx.ai (dashboard) and https://agent.guardrailx.ai (agent calls), under Regulation (EU) 2016/679 ("GDPR").
Two different roles. For your account data (who you are, how you log in, how you pay) we are the controller and this policy applies. For the data contained in the calls your agents make to artificial intelligence providers through the Service, the controller is you (or your organisation) and we act as processor, under the Data Processing Agreement (DPA) that is part of the Terms of Service.
1. Controller
- WebbergatePlus+ s.r.l. — Strada Farnesiana 45, 29122 Piacenza (PC), Italy
- VAT no. IT03871830166 — share capital € 10,000
- Email: support@guardrailx.ai — PEC (certified email): webbergateplussrl@legalmail.it
2. What data we process
| Category | Data | Where it comes from |
|---|---|---|
| Account | email, name, password (stored only as a bcrypt hash, never in clear text), language, alert preferences | you enter it |
| Login with Google | Google identifier, email, name | from Google, if you choose "Continue with Google" |
| Login with Microsoft | Microsoft identifier (organisation and user), email, name | from Microsoft, if you choose "Continue with Microsoft" |
| Payments | plan, subscription status, Stripe customer and subscription identifiers, billing period | from you and from Stripe; card data is processed only by Stripe, we never see it |
| Projects and configuration | names of projects and keys, limits, rules, webhook addresses, providers' API keys (encrypted with AES-256-GCM) | you enter it |
| Technical call log | date and time, provider, model, tokens, cost, outcome, duration, and the values of the optional X-GuardrailX-Agent, X-GuardrailX-Customer, X-GuardrailX-Session, X-GuardrailX-Step, X-GuardrailX-Feature (formerly X-GuardrailX-Tag), X-GuardrailX-User headers | from your agents' calls |
| Technical browsing data | IP address, browser, pages requested, times (server log); technical cookies (§ 8) | from your browser |
| Communications | emails we send you (email confirmation, welcome, password recovery, alerts) and their outcome | generated by the Service |
The content of the calls to the providers (questions and answers of the models) passes through the Service but is not stored, with two exceptions: if you turn on a Model comparison, for the calls picked as a sample we store the full request (instructions, conversation, tools and parameters) and the answers, encrypted, to show you the differences and to be able to repeat the same requests on another model; and, if you turn on Autopilot, for the calls picked as a sample we store question and answers, encrypted, to measure quality, and they may be sent, with your key, to the model of your provider that acts as judge (see point 5 and the DPA). If you turn on Privacy Guard, the personal data it recognises becomes placeholders before being forwarded to the provider, without being stored; only the entries you add to the project dictionary are stored, encrypted.
The optional headers (X-GuardrailX-Agent, -Customer, -Session, -Step, -Feature, -User) are designed and provided exclusively for pseudonymised technical identifiers. Should the User voluntarily enter personal data or special categories of data in those fields, they act in breach of the instructions of WebbergatePlus+ s.r.l., which declines all responsibility for the related processing and reserves the right to delete non-compliant logs.
Turning on the 'Model comparison' feature constitutes an explicit instruction by the User to store, temporarily and encrypted (AES-256-GCM), the texts forwarded. It is the User's sole responsibility to ensure a suitable legal basis for the temporary processing of the content forwarded through that feature.
3. Why we process it and on what basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Creating and managing the account, providing the Service, computing costs and limits, sending you the alerts you configure | performance of the contract (point b) |
| Invoicing and payments, tax and accounting obligations | contract (point b) and legal obligation (point c) |
| Security: protection against unauthorised access, limits on login attempts, technical logs | legitimate interest (point f) in protecting the Service and its users |
| Service emails (email confirmation, password recovery, alerts, communications about the contract) | contract (point b) |
| Newsletters or commercial communications | consent (point a), which can be withdrawn at any time |
We do not take automated decisions with legal effects on you and we do not profile you for advertising purposes.
4. Who we share the data with
WebbergatePlus+ s.r.l. acts as a mere technical routing intermediary (proxy/gateway). Third-party AI providers are not sub-processors of WebbergatePlus+ s.r.l.; the controllership, safeguards, terms of use and any transfers outside the EU connected with the use of the AI providers' APIs are governed exclusively by the direct contractual relationship between the User and each Provider.
We share the data exclusively with the parties needed to provide the Service, which act, depending on the case, as processors under Article 28 GDPR or as independent controllers:
| Supplier | What it does | Where |
|---|---|---|
| Server Plan S.r.l. | servers and database of the Service | Italy |
| Cloudflare, Inc. | delivery and protection network for the website and the dashboard: the pages and their data (including your IP address) pass through its servers; agent calls do not | worldwide network, headquartered in the USA; EU-US Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe Ltd. | payments and invoices | EU (Ireland), with possible transfers to the USA |
| Microsoft Ireland Operations Ltd. (Microsoft 365, provided through GoDaddy) | sending emails | EU, with possible transfers to the USA |
| Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) | sending alerts through the official bot, only for customers who connect it | outside the EEA (United Arab Emirates), standard contractual clauses |
| Google Ireland Ltd. | login with Google (only if you choose it) | EU, with possible transfers to the USA |
| Microsoft Ireland Operations Ltd. | login with Microsoft (only if you choose it) | EU, with possible transfers to the USA |
| Register S.p.A. | encrypted off-site copy of the backups | Italy |
Artificial intelligence providers (OpenAI, Anthropic, Google Gemini, Mistral AI, DeepSeek, OpenRouter and the others you connect) receive your agents' calls with your API key and under your contract with them: you choose and configure them. They are not our suppliers for your account.
We may disclose data to the authorities when the law requires it.
5. How long we keep it
| Data | Retention |
|---|---|
| Account and configuration | When the account is closed, the active personal data in the production databases is deleted or made irreversibly anonymous within 30 days. Residual copies in the technical backup systems are deleted or overwritten automatically when their rotation cycle expires (at most 60 days after deletion). |
| Detailed call log | according to the plan: 90 days with Free, in trial and with Base, 365 with Agency; after that only monthly totals without details remain |
| Texts of Model comparisons | up to 30 days after the end of the comparison, then deleted (only the numbers remain) |
| Texts collected by Autopilot | 30 days after each pair is collected, then deleted (the numbers and the verdicts remain) |
| Privacy Guard dictionary | until you remove the entries or delete the project |
| Placeholders of conversations stored by the provider (Privacy Guard) | in memory only, encrypted, 24 hours after the last turn |
| Spend counters | daily 62 days, monthly 13 months |
| Invoicing data | 10 years, as required by tax law |
| Technical server logs (IP) | 14 days |
| Backup copies | 14 days on the server, 60 days in the encrypted off-site copy; deleted data disappears from the backups when they expire |
| Password recovery links | 1 hour, single use |
| Email confirmation links | 48 hours, single use |
| Sign-ups with an email never confirmed | deleted after 7 days |
6. Where the data is
The data is stored on servers in Italy. If a supplier processes data outside the European Economic Area, it does so on the basis of an adequacy decision of the European Commission (for the USA, the EU-US Data Privacy Framework for certified companies) or of the standard contractual clauses.
7. Security
Encrypted connections (HTTPS), providers' keys, texts of Comparisons and Autopilot and the Privacy Guard dictionary encrypted (AES-256-GCM), passwords stored only as a hash (bcrypt), protection against repeated login attempts, server access restricted to authorised staff, regular backups. Details in Annex A of the DPA.
8. Cookies
We use only technical cookies, needed to log you in and to protect your account:
gr.sid(7 days from the last visit): keeps you logged in to the dashboard.gr_noto(1 year): remembers that you have already logged in from this browser. If someone tries many passwords on your account, you can still log in from here.gr_dispositivo(30 days): only if you choose «Don't ask again on this browser for 30 days» in two-step verification; for 30 days we do not ask you for the code on this browser.
The cookies contain only technical data (account number, expiry and a signature that prevents forging them). We do not use profiling cookies or third-party analytics tools: that is why no consent banner is needed. During payment, Stripe's pages use their own cookies (see Stripe's privacy policy). Cloudflare may set technical cookies to protect against automated attacks (e.g. __cf_bm, 30 minutes).
9. Your rights
You can ask us at any time for access, rectification, erasure, restriction, portability of your data and object to processing based on legitimate interest, by writing to support@guardrailx.ai. We reply within one month. You can export the call log to CSV from the dashboard and request the deletion of your account and the related data from the Account page ("Delete account"), except for the data we must keep under legal obligations and the residual copies in the backups until their retention cycles expire. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
10. Changes
If we change this policy in a significant way we will tell you by email or in the dashboard before the changes take effect.
Last updated: 27 October 2026