Privacy Policy

Effective October 19, 2026

This policy explains what personal information [company] ("Guidely", "we", "us") collects when you use guidelytech.com, the Guidely dashboard, APIs and SDKs (together, the "Service"), how we use it, and the choices you have. It should be read with our Terms of Service.

Summary

• Two roles. For the people who sign in to Guidely (you and your teammates), we decide how your information is used and are the controller. For the people who use your product, whose data reaches us through the Guidely SDK, our customer is in charge and we act as a processor on their instructions.
• We only see what customers send us. The SDK collects what a customer configures it to: guide and analytics events, and, only when turned on, session recordings, heatmaps and error reports. Text people type into your forms is never recorded.
• We don't sell personal information or use it for advertising, and we don't use customer data to train AI models.
• You're in control. Customers set retention, can switch any kind of capture off, and can erase an end user's data in one step.

1. Who this policy covers

Account holders and visitors. If you visit our website, create an account, join a workspace or contact us, [company] is the controller of your personal information, and this policy describes how we handle it.

Our customers' end users. Businesses ("customers") install the Guidely SDK in their own websites and apps to show in-app guides, run the Scout support messenger, measure product usage and record sessions. The information collected about the people using those apps ("Customer Data") belongs to the customer, who decides what is collected and why. We process it only to provide the Service to that customer, under our Terms of Service and any data processing agreement we have with them. If you are an end user of one of our customers' products, please read that company's privacy policy and send requests about your data to them; if you contact us, we will pass your request on.

Self-hosted Guidely. Guidely can also be run on a company's own infrastructure. We don't receive any data from self-hosted deployments, and this policy doesn't apply to them.

2. Information we collect

Information you give us

• Account details: your name, email address, password (stored only as a one-way bcrypt hash) and, optionally, a profile picture.
• Sign-in with GitHub or Google: if you choose one, we receive your verified email address, name and avatar. From GitHub we also receive the organizations you belong to, and from Google your Google Workspace domain, so a workspace can let its own organization or domain join automatically.
• Workspace information: workspace and project names, your role and permissions, invitations you send (including the invitee's email address), and settings.
• Content you create: guides, checklists, surveys, help articles, how-tos (including the screenshots captured while recording them), uploaded images, videos and PDFs, feature flags, comments and any other content you add to the Service.
• Credentials for connected services: API keys or tokens you add for Anthropic, Linear, Jira, Confluence, Intercom or Slack. These are stored encrypted and never shown back in full.
• Communications: messages you send us, such as support requests or feedback.

Information collected automatically

• Sign-in sessions: when you sign in we store the IP address and browser user agent with your session so you can review and revoke sessions in your account settings.
• Audit and security logs: significant actions in a workspace (such as publishing, permission changes and deletions) are recorded in the workspace audit log. Our servers also keep operational logs, which include IP addresses and request details, to keep the Service secure and running.
• AI assistant connections: when you connect an AI assistant (see AI assistants you connect), we store the app's name, whether it may make changes, how you were signed in when you approved it, when it was created and last used, and hashes of its tokens (never the tokens themselves).
• Cookies: see Cookies and local storage. We don't use advertising or third-party analytics cookies.

Customer Data collected through the SDK

Depending on how a customer configures the SDK, it may send us the following about the customer's end users. We process all of it as a processor.

• Identifiers and traits: the user ID and any traits the customer passes to identify() (for example name, email or plan), and a random anonymous ID for visitors who aren't identified. Keys that look sensitive (such as password, token, card or ssn) are dropped automatically.
• Guide and product events: which guides, checklists and surveys were seen, completed or dismissed, survey answers, custom events, and, when the customer turns them on, autocaptured clicks and page views with the page URL. Customers can stop page URLs from being collected.
• Session recordings: off until a customer enables them. Recordings capture the structure and changes of the page so it can be played back. Everything typed into inputs is always masked in the browser and never sent; customers can mask or block any other element, or all text. Console messages and network request details may be included if the customer enables them, with authorization headers, cookies and sensitive values redacted.
• Errors: JavaScript errors and stack traces, with the page and browser they happened in.
• Scout conversations: messages end users send to the Scout support messenger and the replies from Scout or the customer's team.
• How-to recordings: when a customer's teammate records a how-to, screenshots of their screen with fields that look sensitive pixelated before upload.
• Device information: device type, browser, operating system, screen and window size and language. We see the IP address of each request and use it for security and rate limiting.

3. How we use information

We use personal information to:

• provide, maintain and secure the Service, including signing you in, enforcing workspace permissions and preventing abuse;
• process Customer Data on our customers' behalf to show guides, produce analytics, play back recordings and answer questions in Scout;
• send service emails, such as invitations, security notices and alerts you have set up (we don't send marketing email without your consent);
• respond to your requests and provide support;
• understand and improve how the Service performs, using aggregated or de-identified information where we can;
• comply with the law and enforce our terms.

We do not sell or rent personal information, share it for cross-context behavioral advertising, or use Customer Data for our own purposes beyond providing and securing the Service.

Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: contract, to provide the Service you signed up for; legitimate interests, to secure, support and improve the Service, which we balance against your rights; consent, where we ask for it, which you can withdraw at any time; and legal obligation, where the law requires us to process information.

4. AI features

Scout, Guidely's AI support messenger, and AI-assisted tools such as drafting articles from imported files, use large language models provided by Anthropic. When a customer turns these features on, we send Anthropic only what's needed to produce a response: the conversation, relevant published help content, and two details about the person chatting, their first name (never their email) and the path of the page they're on (with no domain, query string or IDs). Other traits, events and full URLs are not sent.

We use Anthropic under commercial terms that do not allow it to train its models on this data. We don't train AI models on Customer Data either. If a customer enables Scout's "learning", Scout drafts reusable answers from conversations that the customer's own team resolved; those answers are written without names or identifying details and are used only within that customer's project.

AI responses can be wrong. Customers decide whether to use these features and can review learned answers before they're used.

AI assistants you connect

You can connect an AI assistant, such as Claude, ChatGPT or Cursor, to Guidely through our Model Context Protocol (MCP) server. This works differently from the features above: you choose the assistant, and it works under your own account and terms with its provider.

• What it can reach. The assistant acts as you. It can read what you could read in the workspaces whose admins allow assistants, with your role and permissions: guides, analytics, session replays (with the View session replays permission), errors, Scout conversations, help articles, feature flags and end-user records. If you allow changes, it can also make the changes the AI assistants documentation lists, such as drafting and publishing guides, and they're recorded as yours.
• Where the data goes. What a tool returns, which can include personal information about your product's users, is sent to the assistant you connected and handled by its provider under your agreement with them, not by us. We don't choose the assistant or control what its provider does with that data. Decide what to ask accordingly, and use read-only access where you can.
• What we keep. The connection record described in Information collected automatically. For each request, our operational logs record which tool was called, by which user and connection, and how long it took. They don't record what the assistant asked or what the tool returned.
• Your controls. Settings → AI assistants lists your connections and when each was last used, and disconnecting one stops it at once. Workspace admins can turn assistants off for a whole workspace.

5. How we share information

We share personal information only as described here.

• Service providers that host and operate the Service for us, under contracts that limit their use of the data to providing services to us:

  Provider	Purpose	Location
  Amazon Web Services	Hosting, database, file storage and content delivery	United States
  Anthropic	AI responses for Scout and AI-assisted tools	United States
  Twilio SendGrid	Sending service email	United States
  Stripe	Card payments and invoices for paid plans	United States

• Sign-in providers (GitHub, Google), only when you choose to sign in with them.
• AI assistants you connect. When you connect an AI assistant to Guidely, the results of the tools it calls go to that assistant's provider on your instructions, as AI assistants you connect describes.
• Services a customer connects. When a workspace connects Slack, Linear, Jira, Confluence or Intercom, or uses its own Anthropic key, we send the relevant data to that service on the customer's instructions.
• Embedded media. If a guide or article includes a YouTube, Vimeo, Loom or Wistia video, the viewer's browser loads it from that provider, which receives the viewer's IP address and applies its own privacy policy.
• Within your workspace. Members of a workspace can see the content, activity and member list of that workspace according to their permissions. Content you choose to share publicly, such as a shared how-to link or uploaded article media, can be seen by anyone with the link.
• Legal and safety. We may disclose information if we believe in good faith it's required by law or legal process, or necessary to protect the rights, property or safety of Guidely, our customers or others.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy.

6. International transfers

The Service is hosted in the United States. If you are outside the United States, your information will be transferred to, stored and processed there. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism, for these transfers.

7. How long we keep information

• Account information: for as long as your account is active. When a workspace owner deletes a workspace, its content and data are deleted straight away. If you ask us to delete your account, we do so within 30 days. In both cases we may keep information we must hold to comply with the law or resolve disputes, and copies in backups expire as described below.
• Sign-in sessions: expire after 30 days, or sooner if you sign out or revoke them.
• AI assistant connections: until you disconnect them or they expire. An app's sign-in lasts 30 days from its last use, and a personal access token lasts for the period you chose when creating it, or until you revoke it.
• Operational logs: 30 days.
• Product events: 365 days by default; each customer can choose between 7 days and 10 years.
• Session recordings: 30 days by default; each customer can choose up to 365 days.
• Scout conversations: follow the customer's event retention once they are closed. Files uploaded for importing help content are deleted as soon as the import finishes.
• Backups: database backups are kept for 7 days and then overwritten.

Customers can also delete an individual end user's data, including recordings, at any time from the dashboard or API.

8. Security

We protect information with measures appropriate to its sensitivity, including encryption in transit (TLS) and at rest, hashed passwords and session tokens, optional two-step verification for password sign-in, encryption of stored API keys and tokens, role-based access control within workspaces, rate limiting and audit logging. Session recordings are stored in a private, encrypted bucket and are only served to signed-in workspace members. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected customers and authorities of a breach as the law requires.

9. Cookies and local storage

On guidelytech.com and the dashboard we set only cookies that are strictly necessary:

We don't use advertising cookies or third-party analytics. Our pages load the Inter typeface from rsms.me, which receives your IP address when the font is downloaded.

In our customers' apps the Guidely SDK sets no cookies. It uses the browser's local and session storage to remember an anonymous visitor ID, guide progress, unsent events and open Scout conversations. Customers can hold back analytics until a visitor gives consent, or turn analytics off entirely while still showing guides, and are responsible for getting any consent their visitors' local laws require.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that is inaccurate;
• delete your information;
• object to or restrict certain processing;
• receive your information in a portable format;
• withdraw consent where we rely on it;
• not be discriminated against for exercising these rights.

You can update most account details yourself in your account settings. To make any other request, email privacy@guidelytech.com. We'll respond within the time the law requires (usually 30 days) and may need to verify your identity first. You can use an authorized agent where the law allows.

If you are an end user of one of our customers, please contact that customer; they control your data and can access, export or delete it in Guidely.

EEA and UK residents can also complain to their local data protection authority. California residents: in the past 12 months we have collected the categories of information described in section 2 (identifiers, internet activity, and professional information such as your workspace), for the purposes in section 3. We have not sold or shared personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you.

11. Children

The Service is meant for businesses and is not directed to children under 16. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we'll delete it.

12. Changes to this policy

We may update this policy from time to time. We'll post the new version here and change the effective date at the top. If a change materially affects how we handle your information, we'll let workspace owners know by email or in the dashboard before it takes effect.

13. Contact us

Questions or requests about privacy: privacy@guidelytech.com

[company], [address]