Privacy Policy

1. Introduction

Policy Guard ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Personal Information

• Email address (for account creation and communication)
• Name (optional, for personalization)
• Google account identifier (if you sign in with Google — we verify this server-side and never store your Google password)
• Payment information (processed securely via Razorpay — we never see or store your full card details)
• Most recent successful-login IP address (stored for security auditing and fraud prevention)

2.2 Company Information

• Company name (used in policy generation)
• Industry type (for policy customization)
• Company size (for appropriate policy recommendations)
• Compliance targets (SOC 2, HIPAA, etc.)

2.3 Usage Data

• Policies generated and downloaded
• Most recent successful-login timestamp
• Terms of Service acceptance timestamp and version

3. How We Use Your Information

• To provide and maintain our Service
• To generate customized security policies
• To process payments and manage subscriptions
• To send transactional emails (receipts, policy ready notifications)
• To improve our templates and service quality
• To respond to support inquiries

4. Data Sharing

We do NOT sell your personal data. We share data only with:

• Razorpay: For payment processing — see Razorpay Privacy Policy
• Google: If you use Google Sign-In, your ID token is sent to Google's servers for server-side verification only — we store only your Google user ID, not your Google credentials
• OpenAI: When AI generation is enabled, company information supplied for policy generation may be included in the prompt; no account password is sent
• Resend: For transactional email delivery (password reset, receipts)
• Hosting and monitoring providers: Where configured, to operate, secure, and monitor the Service

5. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Encrypted database storage
• Secure password hashing (bcrypt)
• Regular security audits
• Limited employee access to user data

6. Your Rights (GDPR)

Under GDPR and similar regulations, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a portable format via "Download My Data" in your dashboard
• Objection: Object to certain processing of your data

To exercise these rights, contact us at: support@policyguardhq.com

6a. Your Rights Under India's Digital Personal Data Protection Act (DPDP Act, 2023)

If you are located in India, or your data is processed by us in connection with offering our Service to you, you have the following rights as a Data Principal under the DPDP Act:

• Right to Access: Obtain a summary of your personal data being processed and the identities of parties with whom it has been shared
• Right to Correction and Erasure: Correct inaccurate data and request erasure once the purpose for which it was collected has been fulfilled
• Right to Grievance Redressal: Raise a complaint with our Grievance Officer below, and escalate to the Data Protection Board of India if unresolved

Grievance Officer contact: support@policyguardhq.com

7. Data Retention

We retain your data for as long as your account is active. Upon account deletion:

• Personal data is deleted within 30 days
• Generated policies are permanently deleted
• Payment records are retained for 7 years (legal requirement)
• Account data is first anonymized and deactivated when deletion is requested, then permanently purged under our retention process

8. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

9. Children's Privacy

Our Service is not intended for users under 18 years of age. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service.

11. Governing Law and International Users

This Privacy Policy is governed by the laws of India. Personal data may be transferred to and processed in countries other than your country of residence, including India and the countries where our service providers (Razorpay, Resend, Google Cloud) operate. If you are located in the European Economic Area, the United Kingdom, or elsewhere outside India, the rights described in Section 6 above apply to you regardless of this governing-law clause, in accordance with applicable local law.

12. Contact Us

For privacy-related inquiries: