GuardianFlow Privacy Policy

Last updated: 3 October 2026. Controller: Guardião D'Ónix Unipessoal Lda (Transfer Guardians), Portugal. Contact: support@transferguardians.com.

This policy is available in the 36 languages of the app. If the versions differ, the Portuguese (Portugal) version prevails.

Demo mode

Without an account the app keeps names, sample campaigns, chosen images and preferences only on your device (browser local storage or the app's local database). Nothing is sent to our servers. Demo reach and click figures are synthetic. You can export or delete this data in Settings.

Cloud account (optional)

When you create an account we process: e-mail, display name and language; workspaces, brands, campaigns, review comments and media references by link (we store only the address; the file stays in the service where it is) and the images and videos you choose to upload to GuardianFlow; notification preferences and e-mail consent; access authorisations for the social networks you connect, stored encrypted; publishing-queue, audit and plan-usage records; records of purchases, subscriptions, refund requests and payment disputes when you use the billing features, including the choice made before payment about starting the plan immediately and the right of withdrawal (option, wording version and time), kept as proof of consent.

We never store card numbers: payments on the web are processed by Stripe or PayPal; in the mobile app purchases go through the device's store, which also never gives us card data.

Legal bases and purpose

Performance of the contract (account, workspace collaboration, publishing you schedule, purchases and subscriptions); consent (notification e-mails, social connections); compliance with legal obligations (keeping tax and accounting records, answering privacy requests); and legitimate interest (security, audit, abuse prevention and defence against claims).

Sharing and processors

Supabase (database, authentication, files and functions), Cloudflare (site hosting), Resend (e-mail delivery), Stripe and PayPal (payments on the web), the app stores (purchases made on the phone) and the social networks you connect, only to carry out the actions you request. We do not sell data and use no advertising or third-party trackers.

Stripe, PayPal and the app stores keep transaction data on their own account, for the legal periods that apply to them. To exercise your rights over that data, contact them directly; purchases made through a store are managed in your store account.

Retention periods

We keep each kind of data only for the time stated below. When the period ends, the records are permanently deleted.

• Account, profile, preferences, workspaces, brands, campaigns, connections and social-network authorisations: while the account exists; deleted when you delete the account or the item.
• Images and videos uploaded to GuardianFlow: up to 180 days.
• Records of purchases, refunds, withdrawal (including the proof of consent) and payment disputes: the 10 calendar years following the year of the last movement, as a tax and accounting obligation (Portuguese VAT Code, Article 52; Corporate Income Tax Code, Article 123; Commercial Code, Article 40). After the account is deleted they carry no name, e-mail or account identification.
• Records of subscriptions and of entitlements obtained through store purchases: 5 years after the subscription or entitlement ends.
• Privacy requests, including the proof that a deletion was carried out: 3 years after completion.
• Administrative audit: 3 years; audit of refund decisions: 10 calendar years; workspace activity history: 12 months.
• E-mail delivery records: 90 days. Technical receipts received from the payment processors: 13 months. Payment attempts that were not completed: 90 days.
• Confirmation links for privacy requests made without signing in: valid for 24 hours, and the record is deleted within 7 days.
• Technical security logs kept by the infrastructure provider: up to 90 days.
• Backups: they follow the infrastructure provider's normal rotation cycle. Deleted data is not put back into use and, if a backup is restored, the deletions are applied again.

Your rights

You can ask for access, rectification, erasure, restriction or portability, or object to the processing. When signed in, use Account and cloud → Privacy, where you can also download a copy of your data. Without access to the account, use the Privacy request without signing in form on the sign-in screen of the site and the app: we send a confirmation link to the address you give and, once confirmed, the request is handled by our team. We also accept requests at support@transferguardians.com.

We answer within one month; in complex cases the period may be extended by two further months, with notice within the first month. You can also lodge a complaint with the data protection authority; in Portugal, the CNPD (cnpd.pt).

Account deletion (GuardianFlow)

To delete your GuardianFlow account: open the app (on your phone or on the web at guardianflow.transferguardians.com), sign in, go to Account and cloud → Privacy → Delete my account and confirm. Deletion is immediate and irreversible. If there is an active subscription, or a refund or dispute in progress, the app tells you what to settle first.

Without access to the account, use the Privacy request without signing in form on the sign-in screen, or write to support@transferguardians.com from the account address; we verify identity and complete within one month.

What is deleted and what is kept

Deleted immediately: login and e-mail, profile, language and preferences, workspaces only you use (with brands, campaigns, media references, images and videos uploaded to GuardianFlow and the publishing queue), authorisations of connected social networks (revoked at the network when it allows), invitations, notification read receipts and your other privacy requests.

Kept for the periods stated above: comments in other people's workspaces (without author identification); records of purchases, refunds, disputes, subscriptions and store entitlements, without name, e-mail or account identification and never with card data; and the record of the deletion request itself, without its message. Posts already published on social networks are not deleted by us.

Demo-mode data lives only on your device and is removed by uninstalling the app or from Settings. You can also delete part of your data (for example disconnecting a social network or deleting a campaign) inside the app without deleting the account.

Security

Each workspace is visible only to its members, with isolation enforced in the database, authorisations encrypted on the server, optional two-factor authentication, HTTPS transport and signature verification on every notice received from the payment processors.

Children

The service is not directed to children under 13.

Terms of use

The rules of use, plans, payments, the 14-day right of withdrawal and refunds are in the Terms of Service.