# Privacy Policy

July 28, 2025

Guideless (“ **Guideless**,” “ **we**,” “ **us**,” or “ **our**”) provides an AI-powered platform that converts on-screen user actions into narrated video guides (the “ **Service**”).

This Privacy Policy explains how we collect, use, disclose, and secure personal data when you visit **guideless.ai** (the “ **Site**”) or use the Service, and it describes your choices and rights.

## Scope

This policy applies to:

- **Site visitors**
- **Customers** who create an account or use the Service
- **Viewers** who watch guides hosted on Guideless

It does **not** cover data processed by Customers outside Guideless.

## Personal Data We Collect

| Category        | Examples                                          | Source                                        |
|-----------------|--------------------------------------------------|-----------------------------------------------|
| **Account Data**| Name, email, hashed password, organization       | You                                           |
| **Billing Data**| Card token, billing address, VAT/Tax ID         | You / Stripe                                 |
| **Content Data**| Screen recordings, audio, generated guides      | Captured or created at your request         |
| **Usage Data**  | IP, device, browser, feature usage, logs        | Automatic cookies / analytics                 |
| **Comms**       | Support tickets, feedback, surveys               | You                                           |
| **Marketing Prefs**| Email opt-in / opt-out status                  | You                                           |

_No intentional collection of sensitive data or children’s data._

## Legal Bases (GDPR / UK GDPR)

1. **Contract** – to provide the Service
2. **Legitimate Interests** – improve security & performance
3. **Consent** – cookies, marketing emails
4. **Legal Obligation** – compliance with tax, accounting, etc.

## How We Use Personal Data

- Provide and operate the Service
- Improve, debug, and develop new features
- Communicate: support, security, product updates
- Marketing with consent (unsubscribe anytime)
- Security, fraud prevention, legal compliance

We **never sell** your personal data or use it for automated decision-making with legal effect.

## Cookies & Similar Tech

- **Essential cookies** – login session, CSRF
- **Analytics cookies** – privacy-centric product metrics
- **Preference cookies** – UI settings

You may block cookies, but some features may break.

## Sharing & International Transfers

| Recipient           | Purpose             | Safeguard                           |
|---------------------|---------------------|-------------------------------------|
| **Cloudflare**      | Hosting & storage   | Data centers in 🇪🇺 / 🇺🇸 + SCCs     |
| **Stripe**          | Payments            | PCI-DSS, SCCs                      |
| **Intercom**        | Support             | SCCs                                |
| **Analytics vendor** | Usage insights      | IP anonymization                    |
| **Advisors**        | Legal, audit        | NDAs                                |
| **Authorities**     | Legal requests      | Valid subpoena/court order only     |

Transfers outside your region use **Standard Contractual Clauses** or equivalent.

## Data Retention

| Data                  | Retained                              |
|-----------------------|---------------------------------------|
| Account & billing     | Active + 6 yrs (tax/audit)           |
| Guides & recordings    | Until you delete, or 90 days after account deletion |
| Analytics logs        | 14 months (then aggregated)           |
| Support tickets       | 2 yrs or until closed                 |

## Your Rights

- Access, correct, delete, or export your data
- Restrict or object to processing
- Withdraw consent without affecting prior processing
- Lodge a complaint with a regulator

California users: CCPA/CPRA rights to know, delete, and opt-out of “sharing.”

_Request via_ [_**privacy@guideless.ai**_](mailto:privacy@guideless.ai) _– response within 30 days._

## Security

- TLS 1.2+ in transit; AES-256 at rest
- Role-based, least-privilege access
- Annual penetration tests & continuous monitoring
- Breach notification within 72 h where legally required

## Children

Service not directed to children under 16; we do not knowingly collect their data.

## Changes

Material changes posted on this page or emailed to Customers. Continued use = acceptance.

_Last updated_ date reflects current version.

## Contact

**Santa Monica Interactive, Inc.**

43 Product Way, Suite 500 San Francisco, CA 94105, USA ✉ [**privacy@guideless.ai**](mailto:privacy@guideless.ai)