Privacy Policy

Last updated: May 29, 2026

This Privacy Policy explains how Guided ("Guided", "we", "us", or "our") collects, uses, discloses, and protects personal data when you access or use our website, applications, and related services (collectively, the "Service"). This policy applies to all users worldwide and is designed to comply with the General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK), the California Consumer Privacy Act (CCPA), and other applicable privacy laws. By using the Service, you acknowledge that your personal data will be handled as described here.

1. Data Controller

Guided is the data controller responsible for your personal data. For all privacy-related inquiries, including the exercise of your rights, you may contact us at privacy@guided.app.

2. Scope

This Privacy Policy applies to personal data we collect from users, visitors, and other individuals who interact with the Service. It does not apply to third-party websites, platforms, or services that may be linked to or integrated with the Service and that are governed by their own privacy policies.

3. Information We Collect

We may collect the following categories of information:

  • Account information: name, email address, profile picture, and authentication identifiers provided by third-party login providers (e.g. Google).
  • Transaction information: subscription plan, billing status, payment metadata, and customer identifiers provided by our payment processor. We do not store full credit card numbers on our servers.
  • User Content: messages, prompts, conversations, and other content you submit to the Service.
  • Usage information: features used, timestamps, session activity, token consumption, and interaction patterns.
  • Technical information: IP address, browser type and version, device identifiers, operating system, language preferences, and referrer URLs.
  • Communications: support requests, feedback, and other correspondence you send to us.

4. How We Collect Information

We collect information directly from you when you create an account, submit content, or contact support. We collect information automatically through cookies, log files, and analytics tools when you interact with the Service. We also receive information from third-party service providers used for authentication (Google), payments (LemonSqueezy), hosting infrastructure, and AI processing.

5. Purposes of Processing

We process your personal data for the following purposes:

  • To provide, operate, maintain, and improve the Service
  • To create and manage your account
  • To process subscriptions, billing, and account-related transactions
  • To authenticate you and prevent fraud, abuse, and unauthorized access
  • To monitor performance, debug issues, and ensure reliability and security
  • To respond to support requests and communicate with you
  • To enforce our Terms, policies, and legal rights
  • To comply with legal, regulatory, tax, and enforcement obligations

6. Legal Bases for Processing (GDPR / KVKK)

Where applicable law requires a legal basis for processing personal data, we rely on one or more of the following:

  • Contract: to provide the Service you have subscribed to.
  • Legitimate interests: to operate, secure, and improve the Service.
  • Legal obligation: to comply with applicable laws and regulations.
  • Consent: where consent is required, such as for certain cookies or marketing communications. You may withdraw consent at any time.

7. AI Processing

Guided uses artificial intelligence systems (currently provided by Anthropic) to analyze your inputs and generate responses, reflections, and other outputs as part of the Service. Your messages and conversation history are transmitted to our AI provider for processing in accordance with their data processing agreements with us.

We do not use your content to train third-party general-purpose AI models. Our AI providers process your data under confidentiality obligations and zero-retention or short-retention policies where applicable. AI-generated outputs may be inaccurate or incomplete, and we make no guarantee as to their accuracy.

8. Data Sharing

We do not sell your personal data. We do not share your personal data with advertisers. We may disclose personal data to:

  • Service providers and contractors supporting hosting (Vercel/Firebase), authentication (Google), payments (LemonSqueezy), AI infrastructure (Anthropic), analytics, and security
  • Professional advisers, auditors, and legal representatives where reasonably necessary
  • Authorities, regulators, courts, or law enforcement where required by law or where necessary to protect rights, safety, or security
  • A successor or acquirer in connection with a merger, acquisition, reorganization, asset sale, or similar corporate transaction

9. International Data Transfers

Your personal data may be processed and stored in countries outside your country of residence, including the United States. Where required by applicable law, we implement appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers of personal data.

10. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this policy:

  • Account data: retained while your account is active and for up to 12 months after deletion, unless longer retention is required by law.
  • User Content (conversations): retained until you delete it or close your account.
  • Billing records: retained for up to 10 years as required by applicable tax and accounting laws.
  • Server logs: retained for up to 90 days for security and debugging purposes.

11. Data Security

We implement technical, administrative, and organizational safeguards designed to protect personal data against unauthorized access, disclosure, loss, misuse, and alteration. These include encryption in transit (TLS), encryption at rest where applicable, access controls, authentication, and regular security review. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by law, and notify affected users without undue delay where the breach is likely to result in a high risk.

13. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure: request deletion of your personal data, subject to legal retention obligations.
  • Restriction: request that we limit how we process your data.
  • Portability: request a copy of your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interests.
  • Withdrawal of consent: where processing is based on consent, withdraw it at any time.
  • Complaint: lodge a complaint with your local data protection authority. In Turkey this is the Personal Data Protection Authority (KVKK Kurumu). In the EU, contact your national data protection authority.

To exercise these rights, contact us at privacy@guided.app. We will respond within 30 days. We may need to verify your identity before processing your request.

14. Cookies and Tracking

We use cookies and similar technologies to operate the Service, remember preferences, maintain sessions, analyze usage, and improve functionality and security. Categories of cookies we use:

  • Strictly necessary: required for authentication and core Service functionality. These cannot be disabled.
  • Functional: remember user preferences and settings.
  • Analytics: help us understand how the Service is used so we can improve it. These are used only with your consent where required by law.

You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

15. Children's Privacy

The Service is not directed to children under the age of 13, or a higher minimum age where required by local law (16 in most of the European Economic Area). We do not knowingly collect personal data from children in violation of applicable law. If you become aware that a child has provided us with personal data, please contact us so we can delete it.

16. Automated Decision-Making

The Service uses AI to generate responses, but we do not use automated decision-making that produces legal effects or significantly affects you within the meaning of applicable data protection law. Account-related actions such as suspension are reviewed by human staff.

17. Do Not Track

Some browsers offer a "Do Not Track" signal. Because there is no industry standard for honoring such signals, we do not currently respond to them. You may control tracking through cookie preferences and browser settings.

18. Third-Party Services

The Service relies on or integrates with third-party services, including but not limited to Google (authentication), Firebase (hosting and database), LemonSqueezy (payments), Anthropic (AI infrastructure), and Vercel (hosting). We are not responsible for the privacy practices of third parties beyond our contractual obligations with them. You should review the applicable privacy policies of these third parties.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be notified through the Service or by email at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acknowledgment of the revised policy.

20. Contact

For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact us at:
Email: nogptofficial@gmail.com