Privacy policy

Effective October 21, 2026

Who we are

Guardation is operated by Abrovia s.r.o., náměstí 14. října 1307/2, 150 00 Prague 5, Czech Republic (company ID 04186974, VAT ID CZ04186974), the controller of your personal data. Contact us at [email protected].

What we collect

• Account data: your name, email address, organization name and a hashed password.
• Provider credentials: the admin keys you connect. They are encrypted before storage and are never displayed again.
• Usage and cost figures: token counts, amounts, model names, and API key, project and workspace identifiers and names returned by your providers’ usage and cost endpoints. We never receive prompts or model outputs.
• Technical data: IP address, browser user agent and session cookies needed to keep you signed in and to protect the service from abuse.

Why we use it

• To provide the service you signed up for: syncing usage, showing dashboards and sending budget alerts (performance of a contract).
• To send account emails such as verification, password resets and important service notices (performance of a contract).
• To keep the service secure and fix problems (legitimate interest).

We don’t sell your data, use it for advertising, or share it with third parties except the processors below.

Processors and location

Data is stored on servers in the European Union operated by Váš Hosting s.r.o., Czech Republic (EU). To fetch your data we call the APIs of the providers you connect (OpenAI, Anthropic), under your own agreements with them.

Cookies

We only use cookies that are strictly necessary: a session cookie and a security (CSRF) token. There are no analytics or advertising cookies.

Retention

We keep your data while your account is active. When you ask us to delete your account, we delete your account, credentials and usage data within 30 days, except where the law requires us to keep something longer.

Your rights

Under the GDPR you can request access to, correction, export or deletion of your personal data, and object to or restrict its processing. Email [email protected] and we’ll respond within 30 days. You can also lodge a complaint with your local data protection authority.

Changes

If we change this policy in a meaningful way, we’ll email account owners before the change takes effect.