Guardrails Privacy Policy
Guardrails was created to help people reduce the amount of personal information they share with AI tools.
Privacy is therefore not only something we describe in this policy. It is part of how Guardrails is designed.
This Privacy Policy explains what information Guardrails processes, what we keep, what we do not keep, how organisation accounts work, and what choices you have.
1. Who we are
Guardrails is operated by Yalla Labs C.I.C., a Community Interest Company registered in England and Wales.
Company number: 16635902
Registered office: 113-115 Fonthill Road, London, England, N4 3HH
Privacy contact: [email protected]
In this policy, "Guardrails", "Yalla Labs", "we", "us" and "our" refer to Yalla Labs C.I.C.
If your organisation provides Guardrails to you, your organisation may also have responsibilities for how your personal data is handled. See the section on organisation accounts below.
2. The most important thing to know about prompts
Guardrails needs to examine your prompt to identify personal information before the prompt reaches the AI service you are using.
Your prompt is processed temporarily for this purpose.
Guardrails does not store your prompt text in its database.
When Guardrails checks a prompt:
- Your prompt is sent securely to Guardrails for detection.
- Guardrails checks it for supported types of personal information.
- Guardrails returns the detected items so you can review them.
- You decide whether to replace, remove, or keep the information.
- The prompt text used for the Guardrails check is discarded after the request is completed.
We do not keep a copy of the prompt or the personal information detected inside it as part of your Guardrails history.
We do not use your prompts to train an AI model.
We do not sell your prompts or personal information.
We do not provide your prompts to advertisers.
3. Guardrails does not send your prompt to an AI model for detection
Guardrails' personal information detection does not require your prompt to be sent to an external generative AI model.
The prompt is processed by Guardrails for the purpose of detecting supported types of personal information.
Once you have reviewed any detections and choose to submit your final prompt on ChatGPT, Claude, Gemini, Copilot or another supported service, that AI service will process the final prompt under its own privacy policy and terms.
Guardrails does not control how those AI providers process information you choose to submit to them.
Refine is different. If you choose to use Refine, only the prompt you choose to refine is sent to Thaura, an AI service, to suggest an improved version. Guardrails does not store it. We only record, anonymously, that Refine was used by your organisation. Thaura processes the prompt under its own privacy policy.
We encourage you to use AI services approved by your organisation and to avoid sharing personal or sensitive information that the task does not need.
4. What happens when you upload a file
Guardrails can also check supported file attachments for personal information.
When you use this feature, the file is sent to Guardrails infrastructure for scanning.
Guardrails does not store the uploaded file after the scan is completed.
The file is discarded after scanning and is not added to a Guardrails file library or retained as part of your account.
Files submitted to Guardrails for personal information detection are not forwarded to a generative AI model as part of the Guardrails scanning process.
After the Guardrails check, if you decide to upload or submit that file to an AI service yourself, the AI provider's own privacy terms will apply.
5. Information we collect
Although we do not store your prompts or scanned file contents, we need to keep some information to operate Guardrails.
Information we process but do not store
- Text you type into the chat box on supported AI sites
- Files you choose to scan
- Prompts you choose to refine
This is not stored (see sections 2–4).
Account information
If you create an account, we may process information such as:
- Your name
- Your email address
- Your password, stored only as a one-way hash
- Whether your account belongs to an organisation
Organisation information
If you use Guardrails through an organisation, we may process:
- Your organisation name
- Organisation membership
- Administrator and member roles
- Organisation settings
- AI tools enabled or permitted by the organisation
- Guidance or policies added by the organisation
- Learning resources created or edited by the organisation
- Prompt library content created by the organisation
Aggregated Guardrails usage information
Guardrails stores anonymised and aggregated information that helps organisations understand how Guardrails is being used.
This may include:
- The number of personal information items detected
- The types of information detected
- The number of detections users chose to resolve
- Whether file warnings were triggered
- Aggregated patterns of Guardrails use across an organisation
These analytics do not include:
- The text of your prompt
- The value of the personal information detected
- The contents of uploaded files
- A copy of what you submitted to the AI service
- Information showing an organisation administrator which individual created a particular detection
Technical and security information
Like most online services, Guardrails may need to process limited technical information to operate the service securely and diagnose problems.
This may include:
- IP address
- Browser and device information
- Date and time of requests
- Application errors
- Security and authentication events
6. How we use your information
We process personal data only where it is needed for a defined purpose.
These purposes include:
Providing Guardrails. To create and manage accounts, detect supported personal information, provide file scanning, apply settings, and deliver the features you request.
Managing organisation accounts. To allow organisations to manage membership, configure Guardrails, provide internal guidance and learning resources, and make shared prompt resources available to their teams.
Providing aggregated organisation insights. To show organisations anonymised patterns about how Guardrails is being used without giving administrators access to individual prompts or detected values.
Keeping Guardrails secure. To authenticate users, prevent misuse, investigate technical problems and protect the service.
Providing support. To respond when you contact us with a question, bug report or support request.
Meeting legal obligations. Where we need to keep or disclose information to comply with applicable law or a lawful request.
Improving Guardrails. We may use anonymised and aggregated information to understand how Guardrails is working and where the product can be improved. We do not need to store your prompt text for this purpose.
Chrome Web Store Limited Use
Our use of information received from the Guardrails extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide Guardrails features. We do not use it for advertising, we do not sell it, and no person reads it unless you ask us to, it is needed for security, or the law requires it.
7. Our legal bases for processing
Where UK or EU data protection law applies, we need a lawful basis for processing personal data.
Depending on the activity, we may rely on:
Contract. Where processing is necessary to provide Guardrails or an organisation account that you use.
Legitimate interests. Where necessary to operate, secure and improve Guardrails, administer accounts, prevent misuse and understand aggregated patterns of use, where those interests are not overridden by your rights.
Legal obligation. Where we need to process information to comply with a legal requirement.
Consent. Where we specifically ask for your permission, for example for optional cookies or optional processing where consent is appropriate.
If Guardrails is being provided by your employer or another organisation, that organisation may determine the lawful basis for its own use of personal data through Guardrails.
8. Free individual accounts and organisation accounts
Guardrails can be used through a free individual account or through an organisation.
Individual accounts
If you use Guardrails independently, Yalla Labs is responsible for the personal data needed to provide your Guardrails account and service.
Your prompts and scanned files are handled as described above and are not retained after scanning.
Organisation accounts
If you have been added to an organisation, the organisation can configure parts of your Guardrails experience.
Depending on its setup, your organisation may:
- Manage your membership
- Decide which supported AI tools Guardrails is enabled for
- Provide AI guidance and organisational policies
- Create and share learning resources
- Create shared prompt resources
- View anonymised and aggregated Guardrails analytics
Your organisation's administrators cannot use Guardrails analytics to read:
- Your individual prompts
- Uploaded file contents
- The actual personal information Guardrails detected
- Which individual generated a specific detection event
Organisation administrators may be able to see account information needed to manage membership, such as your name, email address, role and status (active, not active) and last activity.
Depending on the organisation's relationship with Guardrails and the data involved, Yalla Labs may act as a data processor on behalf of the organisation for some activities, while acting as a controller for information required to operate and secure the Guardrails service.
Organisations using Guardrails are responsible for giving their users appropriate information about their own processing of personal data.
9. Who we share information with
We do not sell personal data.
We do not share personal data with advertisers.
We share data only with these providers, and only so they can run part of Guardrails for us:
- Hetzner (EU): hosts our servers and database
- Cloudflare: hosts our website and stores database backups
- Resend: sends account emails (your email address and the email content)
- Sentry: error monitoring for the extension and servers (technical error details only; prompt text and file contents are excluded)
- Thaura: the AI service behind Refine (only the prompt you choose to refine)
- Contentsquare (Hotjar): analytics on our public marketing website only (not the account platform or the extension)
10. How and where we store information
Where: Our servers are hosted by Hetzner in the EU. Database backups are stored with Cloudflare.
In transit: All data sent between the extension, our website and our servers is encrypted with HTTPS.
On your device: The extension stores your sign-in status, organisation name, role, permitted AI sites, organisation policy links, guides and prompt templates in your browser's storage. Values you choose to ignore are kept only until you close your browser.
We try to keep personal data only for as long as we need it.
Different information has different retention periods.
Prompt text: processed temporarily and discarded after the Guardrails detection request is completed.
Detected personal information: returned for your review and not retained by Guardrails as prompt history.
Uploaded files: discarded after the Guardrails file scan is completed.
Aggregated analytics: retained in anonymised and aggregated form.
Account information: retained while your account is active and after account closure where necessary for account administration, security or legal obligations.
Backups: kept for 30 days, then deleted.
We may retain information for longer where required by law, necessary to resolve a dispute, or required to protect the security of the service.
To delete your account, email [email protected].
11. Security
Guardrails is designed to reduce unnecessary exposure of personal information.
We use technical and organisational safeguards appropriate to the nature of the information we process.
These include limiting access to systems and data to people who need it to operate Guardrails and designing the product so prompt content and scanned files do not need to be retained after detection.
No online service can guarantee absolute security. If we become aware of a personal data breach, we will respond in accordance with applicable data protection law.
12. Automated detection and your decisions
Guardrails uses automated methods to identify information that may be personally identifiable.
Detection is intended to assist you. It may sometimes identify information that is not personal, and it may not identify every piece of personal or sensitive information.
Guardrails does not automatically decide whether you are permitted to share something.
You decide whether to:
- Remove the detected information
- Replace or mask it
- Keep it
- Change your prompt
- Decide not to submit the information
Guardrails does not use this detection to make decisions about you that produce legal or similarly significant effects.
13. Your privacy rights
Depending on where you live and the data protection law that applies, you may have rights over your personal data.
These can include the right to:
- Ask what personal data we hold about you
- Request a copy of your personal data
- Correct inaccurate information
- Request deletion of personal data
- Ask us to restrict certain processing
- Object to certain processing
- Receive certain information in a portable format
- Withdraw consent where we rely on consent
Some rights depend on the circumstances and may not apply to every type of processing.
To exercise a privacy right, contact us at:
Because Guardrails does not store your prompt text or scanned files after processing, we will normally not have those contents available to retrieve later.
If your request relates to information controlled by an organisation that provides your Guardrails account, we may need to direct the request to that organisation or work with it to respond.
14. Complaints
If you have a concern about how Guardrails handles your personal data, we would like you to contact us first so that we can try to resolve it.
You may also have the right to complain to the data protection authority where you live.
In the UK, the supervisory authority is the Information Commissioner's Office (ICO).
If you are in the European Economic Area, you can contact the relevant data protection authority in your country.
15. Children
Guardrails is intended primarily for people using AI in professional and organisational settings.
Organisations that use Guardrails while working with information about children remain responsible for ensuring that their use of that information is appropriate and lawful.
16. Cookies and similar technologies
The Guardrails website and account platform may use cookies or similar technologies that are necessary for authentication, security and operation of the service.
We use basic authentication cookies for login.
On our public marketing website we also use Contentsquare (Hotjar), an analytics provider, to understand how visitors move through the pages. Contentsquare sets its own cookies and receives limited technical information such as approximate location, device and browser type, and the pages viewed.
Contentsquare does not run on the Guardrails account platform, and it does not run in the Guardrails browser extension. It therefore never receives prompt content, file content or detection results.
On our public marketing website we ask for your consent before setting any non-essential cookies. Analytics cookies are only set if you accept them, and rejecting them is a single click. You can change or withdraw your choice at any time using the "Cookie preferences" link in the footer of our marketing pages.
Your choice is stored in your own browser. We do not send it to a third-party consent service, and clearing your browser data will clear it, after which we will ask again.
A separate Cookie Policy may provide additional details.
17. Chrome extension permissions
The Guardrails Chrome extension needs access to supported AI websites in order to provide its detection features.
Guardrails currently supports:
- ChatGPT
- Claude
- Google Gemini
- Microsoft Copilot
An organisation administrator may restrict Guardrails to only some of these supported services.
The extension uses its access to provide Guardrails functionality, including checking the information you enter or files you choose to scan on supported AI services.
We do not use this access to build a browsing history or monitor unrelated websites.
Guardrails uses local browser storage for data processing within the session.
18. Changes to this policy
Guardrails will continue to develop, and our privacy practices may change as we introduce or change features.
We will update this Privacy Policy when necessary and change the "Last updated" date at the top.
If we make a significant change to how we use personal data, we will take reasonable steps to bring that change to users' attention before the new processing begins where required.
19. Contact us
If you have questions about this Privacy Policy or how Guardrails handles personal data, contact:
Yalla Labs C.I.C.
Contact: [email protected]