Privacy Policy

1Overview

This Privacy Policy ("Policy") applies to the Guidez website at guidez.io, the Guidez application at app.guidez.io, our browser extensions, our APIs, and all other services offered by Guidez, LLC (collectively, the "Service").

This Policy does not apply to third-party websites, applications, or services that may be linked from our Service. We encourage you to read the privacy policies of those third parties before using their services.

By using Guidez, you acknowledge you have read this Policy and consent to the collection and use of your information as described herein.

2Who We Are

Guidez, LLC is the data controller for information collected through our website and application. We are incorporated in Delaware, USA.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR), Guidez, LLC is the data controller of personal data we process directly. When you use our product within your own application, you are the data controller for your end users' data, and Guidez acts as a data processor on your behalf under the terms of our Data Processing Agreement (DPA).

Contact information:
Guidez, LLC
Email: privacy@guidez.io
For EU/UK data subjects, our EU representative can be reached at: eu-privacy@guidez.io

3Information We Collect

3.1 Information You Provide Directly

• Account registration: Name, email address, password (stored hashed), company name, job title, and company size when you sign up for an account.
• Billing information: Payment card details (processed and stored by our payment processor Stripe; we store only the last 4 digits, card brand, and expiration date), billing address, and VAT/tax identification number where required.
• Profile information: Profile photo, bio, timezone, and communication preferences you choose to provide.
• Content you create: Tour scripts, flow configurations, tooltip text, survey questions, user segment definitions, custom CSS, and any other content you input into the Service.
• Communications: Messages you send to us via email, our support chat, in-app feedback tools, survey responses, and any other forms of communication.
• Survey and research participation: Information you provide when you participate in user interviews, beta programs, or product surveys we may conduct.

3.2 Information Collected Automatically

• Usage data: Pages and features you access, actions you take within the platform, session duration, click patterns, feature adoption metrics, and navigation paths.
• Device and technical data: IP address, browser type and version, operating system and version, device type, screen resolution, language settings, time zone, and referring URL.
• Log data: Server logs including timestamps of requests, response codes, error logs, and API call metadata.
• Performance data: Page load times, API response times, and error rates associated with your use of the Service.
• Cookie and tracking data: See Section 11 for full details on our cookie use.

3.3 End-User Data (Your Customers)

When you install the Guidez snippet in your product, our SDK collects certain anonymized signals from your end users to power the Guidez Service. This includes:

• Anonymous or pseudonymous user identifiers (which you control and configure)
• Tour and flow interaction data (impressions, steps completed, dismissals, completions)
• Feature interaction signals (clicks, hover events used for targeting)
• User attribute data you explicitly choose to send to Guidez for segmentation
• URL and page context at the time of interaction

3.4 Information from Third Parties

• OAuth providers: If you sign up using Google, GitHub, or another OAuth provider, we receive your name, email address, and profile photo from that provider, subject to the permissions you grant.
• Payment processors: We receive confirmation of payment status and fraud risk scores from Stripe.
• Analytics providers: Aggregated, anonymized insights from analytics tools we use to understand overall platform usage trends.

4Chrome Extension Data

Guidez offers a browser extension for Google Chrome ("the Extension") that allows workspace members to build, preview, and publish Tours directly within your product without needing a separate dashboard tab. Because browser extensions operate with elevated permissions, we want to be fully transparent about what the Extension can access and why.

4.1 Permissions Requested and Why

4.2 What the Extension Does NOT Do

• The Extension does not read or transmit the content of any web page you visit other than to identify DOM elements you explicitly click on when building a Tour.
• The Extension does not run in the background when you are not actively using the Guidez builder. It is only active when you open the Guidez builder panel.
• The Extension does not capture screenshots or record your screen without your explicit action.
• The Extension does not track your browsing history across websites.
• The Extension does not collect or store passwords, form inputs, or any content you type.

4.3 Extension Data Storage

Data stored by the Extension (authentication tokens, preferences, draft states) is stored in your browser's local extension storage using Chrome's chrome.storage.local API. This data is device-specific and is not synced to Chrome's sync service unless you have configured Chrome to sync extension data.

4.4 Removing the Extension

You can remove the Extension at any time through Chrome's extension management page (chrome://extensions). Removing the Extension clears all locally stored Extension data from your device. Your Guidez account data stored on our servers is unaffected by removing the Extension.

5SDK and Behavioral Data Collection

When you install the Guidez JavaScript SDK (snippet) into your product, it enables passive behavioral data collection that powers targeting, segmentation, and analytics features. This section explains exactly what is collected and how it is used.

5.1 Passive Behavioral Signals

The SDK passively collects the following signals from your End Users to power Tour targeting and analytics. This collection happens automatically once the snippet is installed and is the core mechanism that enables features like "show this tour only to users who have not completed Step X":

• Page URL and path: The full URL (excluding query parameters and fragments that may contain sensitive data, which are stripped by default) of each page visited by an End User.
• Page visit timestamps: When each page was first visited and most recently visited by a given user identifier.
• Tour and step impressions: Which Tours were shown, which steps were viewed, and when.
• Tour interactions: Button clicks within Tours (Next, Back, Dismiss, Complete, CTA clicks), step completion events, and full Tour completion or abandonment.
• Feature click signals: When you configure Guidez to track specific feature interactions (e.g., "user clicked the Export button"), click events on those specific elements are recorded. This targeting must be explicitly configured by you; the SDK does not broadly capture all clicks.
• User identifier: A pseudonymous identifier that you provide to the SDK (e.g., your internal user ID, hashed email, or anonymous session ID) for the purpose of personalizing and targeting Tours. Guidez does not require you to send a real name or email address.
• User attributes for segmentation: Key-value attributes you explicitly pass to the SDK (e.g., plan type, account creation date, feature flag status). You control exactly which attributes are sent.
• SDK session identifiers: A per-session random identifier generated by the SDK for deduplication purposes.
• Browser and device metadata: Browser name and version, operating system, screen resolution, and language setting. Used for responsive Tour delivery.

5.2 What the SDK Does NOT Collect

• The SDK does not record keystrokes, form inputs, or free-text entered by End Users.
• The SDK does not capture screenshots or video recordings of End User sessions.
• The SDK does not capture financial data, health data, payment card numbers, or other sensitive personal information.
• The SDK does not track End Users across different websites or domains (it only operates within the domains where you install the snippet).
• The SDK does not set third-party tracking cookies or use fingerprinting techniques.

5.3 Data Minimization and Configuration

You have full control over what data the SDK collects. Guidez provides configuration options to:

• Disable passive page tracking and operate in event-only mode
• Suppress collection on specific pages (e.g., pages containing financial or health data)
• Use anonymous/session-only identifiers without persistent user tracking
• Mask specific DOM elements from any Guidez processing
• Configure automatic URL parameter stripping for sensitive query strings

You are responsible for configuring the SDK in compliance with your applicable privacy obligations and for obtaining any required End User consent before enabling behavioral data collection.

5.4 Data Separation

End User behavioral data collected by the SDK is logically isolated per workspace and is never commingled with data from other Guidez customers. Guidez employees access this data only when providing support services explicitly requested by you.

6Surveys, NPS, and In-Product Feedback

Guidez includes the ability to deploy in-product surveys, Net Promoter Score (NPS) surveys, and feedback widgets to your End Users. When these features are used, additional data is collected and handled as follows:

6.1 Survey Response Data

• NPS scores: Numeric scores (0-10) submitted by End Users in response to NPS surveys you deploy.
• Free-text survey responses: Open-ended answers that End Users type in response to your survey questions. This is the only context in which Guidez may process free-text input from End Users.
• Survey metadata: Which survey was shown, when it was shown, whether it was submitted or dismissed, and response timestamps.
• Linked user identifier: Survey responses are linked to the pseudonymous user identifier you supply to the SDK for attribution purposes.

6.2 Your Responsibilities for Surveys

As the data controller deploying surveys to your End Users, you are responsible for:

• Ensuring the questions you ask do not solicit sensitive personal data (health data, financial data, protected characteristics, etc.) unless you have appropriate legal basis and safeguards in place
• Providing appropriate privacy notice to End Users disclosing that survey responses will be processed by Guidez on your behalf
• Complying with applicable laws governing survey consent and data collection in jurisdictions where your End Users are located

6.3 AI-Assisted Survey Analysis

If you use Guidez's AI-powered survey analysis features, free-text survey responses may be processed by our AI provider (Anthropic) to generate summaries and sentiment analysis. Before enabling this feature, free-text responses are pseudonymized where possible. You may disable AI analysis of survey responses in your workspace settings.

7Third-Party Integration Data

Guidez integrates with a wide range of third-party analytics, CRM, and data platforms to enrich user segmentation, synchronize data, and reduce manual setup. This section describes how data flows when you connect third-party integrations.

7.1 Data Inbound to Guidez (from integrations)

When you connect tools such as Segment, Mixpanel, Amplitude, HubSpot, Salesforce, or Intercom to Guidez, you authorize Guidez to receive certain user attribute and event data from those tools. This data is used to:

• Enrich Guidez user profiles with additional segmentation attributes
• Trigger Tours based on events occurring in external tools (e.g., "show an upgrade Tour when a user creates their 3rd project in Mixpanel")
• Suppress Tours for users who have already completed a flow tracked in an external tool

7.2 Data Outbound from Guidez (to integrations)

Guidez can also push Tour interaction data to third-party tools you connect. For example, you can configure Guidez to send a "Tour Completed" event to Segment or HubSpot when a user finishes an onboarding flow. The data sent is limited to:

• The user identifier you supplied to the SDK
• Tour and step names and identifiers
• Interaction events (started, step_completed, dismissed, completed)
• Timestamps of interactions

7.3 Integration Data Governance

You are the data controller for all data flowing through integrations you configure. You are responsible for ensuring that data shared between Guidez and third-party tools complies with applicable privacy laws, including having appropriate data processing agreements in place with those third parties. Guidez does not share integration data with third parties beyond those you explicitly authorize through your integration configuration.

7.4 CRM and Identity Data

If you connect a CRM (such as HubSpot or Salesforce) and choose to sync contact-level data including real names and email addresses to Guidez, this data is treated as Customer Data under these Terms and is subject to the same security and retention controls described in this Policy.

8How We Use Your Information

We use the information we collect for the following purposes:

4.1 Providing and Operating the Service

• Creating and maintaining your account and workspace
• Delivering the core features of the Guidez platform
• Processing your payment transactions and managing your subscription
• Enabling collaboration features within your team workspace
• Generating and delivering Tour analytics and performance reports
• Providing customer support and responding to your requests

4.2 Improving the Service

• Analyzing usage patterns to understand which features are most valuable
• Identifying and fixing bugs, performance issues, and security vulnerabilities
• Conducting internal research and development
• Training and improving our AI models using anonymized, aggregated data. We never use identifiable personal data or your proprietary tour content to train AI models without your explicit consent.

4.3 Communication

• Sending transactional emails such as account confirmations, password resets, and billing receipts
• Notifying you of important security events or changes to the Service
• Sending product updates, release notes, and tips (you may opt out at any time)
• Sending marketing communications about Guidez products and features (only with your consent where required by law)

4.4 Safety and Legal Compliance

• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service and other agreements
• Complying with applicable laws, regulations, and legal processes
• Protecting the rights, property, and safety of Guidez, our users, and the public

4.5 What We Do NOT Do

• We do not sell your personal data to third parties
• We do not share personal data for third-party advertising purposes
• We do not use your end users' data to build advertising or tracking profiles
• We do not use your proprietary tour content to train AI models without explicit consent

5Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under one or more of the following legal bases as required by the GDPR:

Where we rely on legitimate interests, we have conducted a balancing test and concluded our interests do not override your rights and freedoms. You may object to processing based on legitimate interests at any time (see Section 10).

6How We Share Your Information

We do not sell, rent, or trade your personal data. We may share it only in the following limited circumstances:

6.1 Service Providers (Sub-Processors)

We share data with trusted third-party companies that help us operate our business. These companies are contractually required to: (1) only process data on our documented instructions, (2) implement appropriate security measures, and (3) not use the data for any other purpose. See Section 7 for a full list of our sub-processors.

6.2 Business Transfers

If Guidez is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We will notify you via email and a prominent notice on our website at least 30 days before any such transfer, and you will have the ability to delete your account before the transfer occurs.

6.3 Legal Requirements

We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law or legal process, including a valid court order or government request; (b) enforce our agreements; (c) respond to claims that content on our service violates third-party rights; or (d) protect the rights, property, or safety of Guidez, our users, or the public.

Where legally permissible, we will notify you before complying with such requests. We publish a Transparency Report summarizing government requests we receive.

6.4 With Your Consent

We may share your information with third parties in other cases where we have your explicit consent to do so.

6.5 Aggregated or Anonymized Data

We may share aggregate or de-identified information that cannot reasonably be used to identify you. For example, we may publish industry benchmarks or aggregate product usage statistics.

7Sub-Processors

The following third-party sub-processors may receive your personal data as part of our service delivery. All sub-processors are bound by contractual data protection obligations.

We review sub-processors regularly and will update this list when we add or remove providers. For customers with Data Processing Agreements (DPAs), we will provide advance notice of material sub-processor changes.

8Security

We implement administrative, technical, and physical security measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: AES-256 encryption for data at rest. TLS 1.3 for all data in transit. Database-level encryption with customer-managed keys available on enterprise plans.
• Access controls: Role-based access control (RBAC), principle of least privilege, mandatory MFA for all Guidez employees, and VPN-gated access to production systems.
• Infrastructure: Isolated VPC environments, private subnets, network access control lists, and no direct public access to database or internal services.
• Monitoring: 24/7 automated security monitoring, intrusion detection systems, and anomaly alerts. All access to production systems is logged and audited.
• Testing: Quarterly penetration testing by independent third-party security firms. Annual SOC 2 Type II audit. Vulnerability scanning on every deployment.
• Incident response: A documented incident response plan with defined escalation procedures. We commit to notifying affected users within 72 hours of becoming aware of a data breach that affects their personal data, in accordance with GDPR requirements.

Despite our best efforts, no method of transmission over the Internet or electronic storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at security@guidez.io.

12.6 HIPAA and Healthcare Data

Guidez does not knowingly collect Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA). If you operate in the healthcare industry, it is your responsibility to configure the Guidez SDK to exclude any pages or UI elements that display or collect PHI.

Enterprise customers in the healthcare sector who require a HIPAA BAA and additional safeguards including audit logging of PHI access, dedicated infrastructure, and encryption key management may contact security@guidez.io to discuss a healthcare compliance arrangement.

What "not HIPAA compliant by default" means in practice:

• We do not sign BAAs for standard or self-service accounts
• You must not use Guidez to display Tours on pages that show PHI to End Users without a BAA
• Our standard security controls (AES-256 encryption, SOC 2 Type II audit) are robust, but have not been validated for HIPAA compliance without a BAA

9Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law. Our specific retention periods are:

When you close your account, we will delete or anonymize your personal data within 90 days, subject to any applicable legal retention obligations and our 7-year billing record retention. You can request an export of your data before account closure.

10Your Rights

Depending on your location and applicable law, you have the following rights regarding your personal data:

10.1 Rights Available to All Users

• Access: Request a copy of the personal data we hold about you, including what data we process, why, and with whom we share it.
• Correction: Request correction of inaccurate or incomplete personal data. You can update most information directly in your account settings.
• Deletion: Request deletion of your personal data ("right to be forgotten"), subject to exceptions such as legal retention obligations.
• Opt-out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by contacting us. Note: You will still receive essential transactional communications.
• Data export: Download your account data in a machine-readable format (JSON or CSV) from your account settings or by request.

10.2 Additional Rights for EEA / UK Users (GDPR)

• Restriction of processing: Request that we limit processing of your data while a dispute about accuracy or legality is resolved.
• Data portability: Receive your personal data in a structured, commonly used, machine-readable format and have the right to transmit it to another controller.
• Object to processing: Object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.
• Withdraw consent: Where we process data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint: You have the right to lodge a complaint with your local supervisory authority. In the EU, this is your national Data Protection Authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.
• Automated decision-making: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal or similarly significant effects. We do not currently make such decisions.

10.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@guidez.io. We will respond to verified requests within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request. We will not discriminate against you for exercising your rights.

11Cookies and Tracking Technologies

We use cookies and similar technologies (local storage, session storage, pixel tags) to operate and improve our service. You can control cookies through your browser settings, but disabling certain cookies may affect the functionality of the Service.

11.1 Categories of Cookies We Use

11.2 Third-Party Cookies

Our marketing website may set cookies from Google Analytics, Google Tag Manager, and similar tools. These tools may place their own cookies subject to their own privacy policies. You can opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on.

11.3 Managing Cookies

Most browsers allow you to control cookies through their settings. You can also use browser extensions such as Privacy Badger or uBlock Origin to manage tracking. To opt out of interest-based advertising, visit NAI Opt-Out or DAA Opt-Out.

12International Data Transfers

Guidez is headquartered in the United States. If you are located outside the US, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country.

For transfers from the EEA, UK, or Switzerland to the US, we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): We use EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for all transfers of personal data from the EEA to the US.
• UK International Data Transfer Agreements (IDTAs): For transfers from the UK, we use UK IDTAs as approved by the UK Information Commissioner's Office.
• Swiss Federal Act on Data Protection: For transfers from Switzerland, we rely on the Swiss SCC equivalent approved by the FDPIC.

Upon request, we will provide you with a copy of the applicable SCCs. Copies of our transfer impact assessments are available to enterprise customers upon request.

We also offer EU-based data residency for enterprise customers who require their data to remain within the European Economic Area. Please contact privacy@guidez.io for details.

17Global Privacy Laws

In addition to GDPR and CCPA (covered in Sections 9 and 19), Guidez acknowledges and complies with privacy regulations in the following jurisdictions where we have customers or where applicable law requires compliance. If you are subject to any of these laws as a data controller, please review how they interact with your use of Guidez as a data processor.

17.1 Brazil - Lei Geral de Protecao de Dados (LGPD)

For customers and end users in Brazil, we process personal data in compliance with Brazil's Lei Geral de Protecao de Dados Pessoais (LGPD), Law No. 13,709/2018. We rely on the following legal bases under the LGPD: contract performance, legitimate interest, and consent as applicable. Brazil-based individuals have rights to access, correct, anonymize, block, delete, and port their personal data. Requests may be submitted to privacy@guidez.io.

17.2 Canada - PIPEDA and Quebec Law 25

For customers and individuals in Canada, Guidez complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec-based individuals, with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). We maintain a designated privacy officer and publish this Policy as our accountability mechanism. Quebec Law 25 requires us to conduct Privacy Impact Assessments (PIAs) for technology products that process personal information; our PIA is available to Quebec enterprise customers upon request.

17.3 Australia - Privacy Act 1988

Guidez complies with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs) for Australian residents. We do not disclose personal data to overseas recipients without ensuring comparable protections are in place. Australian residents may submit access and correction requests to privacy@guidez.io. Complaints that are not resolved to your satisfaction may be referred to the Office of the Australian Information Commissioner (OAIC).

17.4 Japan - Act on the Protection of Personal Information (APPI)

For data relating to individuals in Japan, we comply with the Act on the Protection of Personal Information (APPI) as amended. Cross-border transfers of Japanese personal data are governed by our data transfer agreements, which provide protections equivalent to those required under APPI. Japanese individuals may submit requests to access, correct, or delete their personal data at privacy@guidez.io.

17.5 Other Jurisdictions

We are committed to honoring privacy rights globally. If you are located in a jurisdiction not listed above and have questions about your data rights, please contact privacy@guidez.io and we will do our best to accommodate your request in accordance with applicable law.

18Children's Privacy

The Guidez Service is not directed to, and we do not knowingly collect personal data from, children under the age of 16 (or under 13 in the United States). If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at privacy@guidez.io. We will delete such information from our systems within 30 days of being notified.

If you are a Guidez customer whose product is used by or directed at children, you are responsible for complying with applicable laws including the Children's Online Privacy Protection Act (COPPA) and must ensure that you do not configure Guidez to collect personal data from children in violation of those laws.

14California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights.

14.1 Your CCPA Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is needed, but you may submit a request at privacy@guidez.io.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond providing our Service.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

14.2 Categories of Personal Information Collected (Last 12 Months)

To exercise your California rights, submit a verifiable consumer request at privacy@guidez.io or via our in-app settings. We will respond within 45 calendar days.

15Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make changes, we will:

• Update the "Last updated" date at the top of this Policy
• Notify registered users via email for material changes
• Display a prominent notice in the Guidez application dashboard for material changes
• Provide at least 30 days' notice before material changes take effect, giving you the opportunity to review the changes and, if you disagree, close your account

For non-material changes (such as corrections, clarifications, or updates to sub-processor lists), we will update the Policy without separate notification. We encourage you to review this Policy periodically.

Your continued use of the Service after any changes become effective constitutes your acceptance of the revised Policy.

16Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu. UK residents may contact the ICO at ico.org.uk.