Privacy Policy

1. Who we are

GuardPilot (“GuardPilot,” “we,” “us”) provides dark-web credential monitoring and AI-guided incident response. This policy applies to our website at guardpilot.io and the GuardPilot application. If you have questions, contact us at privacy@guardpilot.io.

2. Information we collect

• Account information. When you create an account, our authentication provider collects your name, email address, and login credentials to identify you and secure your account.
• What you ask us to monitor. The email addresses, usernames, and domains you add so we can watch for their exposure.
• Exposure & incident data. When we detect that a monitored credential has appeared in a breach or infostealer log, we store metadata about that exposure — such as the affected login URL, the malware family, whether a session cookie was present, and a one-way hash of the leaked credential.
• Usage & technical data. Basic logs (such as IP address, browser type, and actions taken in the app) used to operate, secure, and improve the service.

3. What we deliberately do not store

• Your actual passwords. We detect exposure using one-way hashes and metadata. We do not store the plaintext passwords found in breach data, and we never ask you to give us your passwords.
• Credentials in AI prompts. Our AI incident responder is used to explain and guide. We never send your passwords or credential hashes to the AI model — only the non-sensitive context needed to describe an incident.

4. How we use your information

• To monitor for and alert you to credential exposure.
• To generate AI incident summaries, recovery plans, and answer your questions about an incident.
• To send you notifications and reminders about open incidents.
• To operate, secure, troubleshoot, and improve the service.
• To comply with legal obligations.

We do not sell your personal information, and we do not use your incident data to train third-party AI models.

5. Service providers we rely on

We share the minimum data necessary with trusted providers who help us run GuardPilot:

• Authentication — to manage sign-in and secure your account.
• AI processing — to generate incident explanations and guidance (without your credentials).
• Hosting & infrastructure — to run the application and store your data securely.

These providers are bound to use your data only to provide their services to us. We may also disclose information if required by law or to protect the rights, safety, and security of our users and the service.

6. Data retention

We keep your account and incident data for as long as your account is active. You can delete individual incidents, and you can delete your account at any time, after which we remove your personal data within a reasonable period, except where we are required to retain it by law.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these rights, email privacy@guardpilot.io. You can also manage most of your data directly in the app.

8. Security

We protect your data with encryption in transit, database-level isolation between customers, least-privilege access, and the practice of never storing plaintext passwords. Learn more on our Security page. No system is perfectly secure, but reducing what we hold is our first line of defense.

9. Children

GuardPilot is not intended for anyone under 16, and we do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we’ll update the “last updated” date above and, where appropriate, notify you in the app or by email.

11. Contact

Questions or requests? Email privacy@guardpilot.io.