Privacy Policy

Last updated: 7 November 2026

GuardStance is a data security platform built around protecting sensitive data. We apply the same care to the data of people who visit our website and contact us. This policy explains what data GuardStance (“we”, “us”) processes when you use guardstance.com (the “Site”), fill in one of its forms or write to us, how, and why.

1. Data we collect

1.1 Data you send us

The Site has four forms: book a demo, contact, partner application and security document request. Each asks only for what we need to answer:

• name and work email address,
• company and country,
• the topic you choose, and your message.

You can also write to us by email instead. Please do not send special categories of personal data (for example health data) or sensitive content belonging to your organization through the forms or by email.

A hidden field on each form catches automated spam; people never fill it in.

1.2 Data recorded automatically

When you visit the Site, our hosting provider keeps a standard access record for each request: IP address, browser type, version and operating system, date and time, requested page and referring address. These records are used for security, troubleshooting and compliance with legal obligations.

1.3 Cookies and similar technologies

See our Cookie Policy.

2. How we use your data and lawful bases

Where the EU or UK General Data Protection Regulation (“GDPR”) applies, we rely on these lawful bases:

Purpose	Lawful basis (GDPR Art. 6)
Answering demo, contact and document requests	Art. 6(1)(b), steps prior to entering into a contract
Evaluating partner applications and managing partnerships	Art. 6(1)(b), contract; Art. 6(1)(f), legitimate interests
Protecting the forms from bots and abuse	Art. 6(1)(f), legitimate interests
Site security, stability and aggregate visit counts	Art. 6(1)(f), legitimate interests
Marketing communications	Art. 6(1)(a), consent
Compliance with legal obligations	Art. 6(1)(c), legal obligation

We do not sell your personal data.

3. Bot protection and analytics

On pages with a form, Cloudflare Turnstile checks that a person, not an automated program, is sending it. It runs from challenges.cloudflare.com and only on those pages. See Cloudflare’s Turnstile privacy addendum for what it processes.

We use Cloudflare Web Analytics to count visits. It works without cookies and without building a profile of you; the figures we see are aggregate.

4. Sharing with third parties

Recipient	Purpose
Cloudflare	Hosting the Site, security, Turnstile bot protection and aggregate visit counts
Resend	Delivering form submissions to our mailbox by email
Our email provider	Storing and answering the emails we receive
Authorized partners	Handling your request through an authorized partner in your region, only where necessary
Managed hosting sub-processors	Infrastructure operation and technical resolution for Managed edition customers, only where applicable
Public authorities	Where legally required, in response to valid requests

We keep contracts with our service providers that include data protection obligations.

5. International transfers

Some of these providers may process data outside your country, including outside the European Economic Area. Where the GDPR or other data protection law applies, such transfers rely on appropriate safeguards, such as adequacy decisions or the European Commission’s standard contractual clauses.

6. Retention

Data	Retention period
Form submissions and correspondence	For as long as needed to answer and follow up on your request, and as required by applicable law
Partner application records	For as long as needed to decide on and manage the partnership, and as required by applicable law
Access records kept by our hosting provider	As set by the provider for security purposes, and as required by applicable law
Marketing consent and opt-out records	As required by applicable law

At the end of these periods, data is deleted, destroyed or anonymized.

7. Security

• TLS encryption for all Site traffic, with HTTPS enforced,
• a strict Content Security Policy on every page,
• access restricted on a need-to-know basis,
• authentication and authorization controls on our systems,
• patch and update management,
• logging of access and administrative operations.

8. Your rights

Depending on where you are, you may have the right to:

• access the personal data we hold about you,
• ask for inaccurate data to be corrected,
• ask for your data to be erased,
• restrict or object to processing,
• receive your data in a portable format,
• withdraw consent at any time, without affecting earlier processing,
• lodge a complaint with your local supervisory authority.

To exercise these rights, write to support@guardstance.com. We answer within the time required by applicable law (one month under the GDPR, extendable where permitted).

9. Changes to this policy

We may update this policy when the law, our services or our processing change. Material changes are reflected in the “Last updated” date above.