Privacy Policy

1. Scope & who we are

Guardian AI is operated by [OculAI legal entity name, e.g. OculAI (Pty) Ltd], located at [Registered business address]. This Policy applies to our website, dashboard, APIs, and related services (together, the “Service”).

The Service is provided to businesses (“Customers” — the platforms that integrate Guardian AI). It is a business-to-business tool and is not directed to consumers or to children. Where we process the content and personal data of a Customer's own end-users (creators, viewers, chat participants), we do so on that Customer's behalf and under their instructions.

2. Our role: controller and processor

Depending on the data, we act in one of two capacities under data-protection laws such as the EU/UK GDPR:

• As a processor / service provider. For the content and end-user data a Customer sends us to moderate (stream frames, chat messages, uploads, creator and user identifiers, and the detection results and evidence we generate from them), the Customer is the controller. We process it only to provide the Service, under our agreement with the Customer.
• As a controller. For the data we determine the purpose of — Customer account and billing details, our own website analytics and security logs, and communications with us — we are the controller, and this Policy governs directly.

If you are an end-user of a platform that uses Guardian AI and have questions about how your data is handled, please contact that platform first; they control the moderation configuration and the underlying data.

3. Information we collect

a. Customer & account data

• Business contact details of Customer administrators and moderators (name, work email, role).
• Authentication data (hashed credentials, session tokens) and access-control settings.
• Billing and plan information.
• Configuration you set: detection thresholds, content-policy rules, webhooks, and API keys (which we store in hashed form).

b. Content processed on behalf of Customers

• Sampled frames from live streams; images, video, and voice from uploads; and text from chat, private inbox, and private-live messages that a Customer routes to us.
• Creator and user identifiers, display names, and stream metadata provided by the Customer.
• Detection outputs we derive: labels, confidence scores, flags, moderation decisions, and evidence artifacts (e.g., a preserved frame) stored to support the Customer's review and compliance obligations.

This content may contain personal data and, by the nature of moderation, may include sensitive categories. We process it strictly to deliver detection, review, and compliance functionality.

c. Technical & usage data

• Log data: IP address, device and browser information, timestamps, and actions taken in the dashboard.
• Cookies and similar technologies used for authentication, security, and basic analytics (see §7).

4. How we use information

• Provide the Service — run detection models across streams, chat, and uploads; surface flags in the review queue; generate alerts, reports, and evidence.
• Safety & legal compliance — identify suspected child-sexual-abuse material (CSAM) and other unlawful content, and support mandatory reporting (see §6).
• Security & integrity — authenticate users, prevent abuse, and maintain audit trails.
• Support & communications — respond to requests and send service and administrative messages.
• Service improvement — maintain and improve detection quality and reliability. We do not use a Customer's end-user content to train third-party foundation models, and we do not sell personal data.
• Billing and account management.

5. Legal bases (EU/UK GDPR)

Where GDPR applies and we act as a controller, we rely on: performance of a contract (providing the Service and managing accounts); our legitimate interests (securing the Service, preventing abuse, and improving our product, balanced against your rights); compliance with a legal obligation (including mandatory reporting and record-keeping); and consent where specifically requested. When we act as a processor, the Customer is responsible for establishing the legal basis for the underlying processing.

6. Child-safety content & mandatory reporting

Guardian AI is designed to detect apparent minors and suspected CSAM. Where such content is identified:

• We and/or the Customer may be legally required to preserve the content and associated data and report it to the U.S. National Center for Missing & Exploited Children (NCMEC) CyberTipline and/or other competent authorities.
• Legally-mandated preservation and reporting override deletion and erasure requests. We may retain the minimum data necessary to meet these obligations for as long as the law requires.
• We may disclose relevant data to NCMEC, law enforcement, and other authorities as permitted or required by law.

These obligations exist to protect children and are a core purpose of the Service.

7. Cookies & analytics

We use strictly-necessary cookies for authentication and security. We use privacy-conscious product analytics to understand aggregate usage of our website and dashboard. We do not use advertising cookies. You can control cookies through your browser; disabling necessary cookies may break sign-in.

8. How we share information

• Sub-processors — vetted vendors that host infrastructure and run detection on our behalf, under contract (see §9).
• With the Customer — end-user content and detection results are made available to the Customer that owns them.
• Legal, safety & authorities — where required by law, to report unlawful content, or to protect rights, safety, and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal data or share it for cross-context behavioral advertising.

9. Sub-processors

We rely on the following categories of sub-processors. Contact us for the current detailed list and to subscribe to change notifications.

10. International data transfers

We and our sub-processors may process data in countries other than yours, including the United States. Where required, we use appropriate safeguards for cross-border transfers, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), together with additional technical and organizational measures.

11. Data retention

We retain data for as long as needed to provide the Service and as instructed by the Customer, then delete or de-identify it, except where longer retention is required by law (for example, evidence subject to mandatory reporting, or records needed for legal, tax, or audit purposes). Retention periods for moderation evidence are configurable per Customer within legal limits.

12. Your privacy rights

Depending on your location (e.g., the EU/UK under GDPR, or California under the CCPA/CPRA), you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to be free from discrimination for exercising these rights.

• End-users of a Customer platform: please direct requests to the platform (the controller). We will assist that Customer in responding.
• Customer contacts and website visitors: contact us at [privacy@your-domain.com]. We may need to verify your identity before acting.

Rights are subject to legal exceptions — notably, we cannot delete data we are legally required to preserve and report (see §6).

13. Children

The Service is intended for businesses and is not offered to children. We do not knowingly collect personal data directly from children. The Service does process content in order to detect and report suspected child-safety violations on Customer platforms, as described in §6.

14. Security

We apply technical and organizational safeguards including tenant isolation (row-level security scoping records to each platform), encryption in transit, hashed API keys and credentials, access controls, short-lived signed links for evidence retrieval, HMAC-signed webhooks, and audit logging. No system is perfectly secure, but we work to protect data commensurate with its sensitivity.

15. Third-party links

Our website and dashboard may link to third-party sites and services we do not control. Their privacy practices govern your use of them.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice to Customers where appropriate.

17. Contact us

Privacy questions or requests: [privacy@your-domain.com]
Data Protection Officer: [dpo@your-domain.com]
[OculAI legal entity name, e.g. OculAI (Pty) Ltd], [Registered business address], [Governing jurisdiction — country / state].