Privacy Policy

Our privacy policy and how we use your data

Last updated: February 16, 2025

BarGuard ("we," "us," or "our") operates the BarGuard platform and website (the "Service"). This Privacy Policy explains how we collect, use, share, and protect your information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address, firm or organization name, practice area niche, and target jurisdictions. This information is necessary to provide the Service and tailor compliance analysis to your practice.

1.2 URLs and Page Content

When you submit URLs for compliance scanning, we retrieve and store the text content of those web pages. This includes the full visible text extracted from the page, which is necessary for AI-powered compliance analysis. We also store a content hash (fingerprint) to detect changes between scans.

1.3 Scan Results and Reports

We store the results of compliance scans, including compliance scores, detected violations, severity assessments, rule citations, evidence quotes, remediation guidance, AI confidence scores, and the raw AI response data. This data is retained to provide your scan history, generate reports, and enable trend tracking.

1.4 Free Scan Data

If you use the free scan feature without an account, we collect the URL submitted and your IP address to enforce usage limits. Free scan data is automatically deleted after 30 days.

1.5 Payment Information

Payment processing is handled entirely by our third-party payment processor. We do not store your credit card number, bank account details, or other sensitive payment information on our servers. We receive only a subscription status and billing identifiers from the payment processor.

1.6 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, scan frequency, and alert configurations. This data helps us improve the Service and diagnose issues.

1.7 Integration Data

If you configure integrations such as Slack alerts or email notifications, we store the webhook URLs, channel configurations, and alert rule preferences you provide.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service, including running compliance scans, generating reports, and delivering alerts.
  • Process your subscription and manage your account.
  • Send you scan results, compliance alerts, weekly digests, and service notifications.
  • Detect unchanged pages to avoid unnecessary re-analysis and optimize your usage allowance.
  • Enforce usage limits and prevent abuse of the Service.
  • Improve AI accuracy and reduce false positives through aggregate analysis of scan patterns (without sharing your specific data with other users).
  • Comply with legal obligations and enforce our Terms of Service.

3. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

3.1 Service Providers (Sub-processors)

We use the following categories of third-party service providers to operate the Service. Each processes data only as necessary to perform their function:

  • Cloud Infrastructure & Database — Supabase (hosted on AWS) stores your account data, URLs, scan results, and violations. Supabase also provides authentication services.
  • AI Analysis Providers — Page text and compliance rules are sent to AI model providers (such as Google Gemini, Anthropic, or OpenAI, depending on configuration) to generate compliance analysis. These providers process page content to produce scan results.
  • Web Scraping — We use third-party scraping services to retrieve the text content of URLs you submit for scanning.
  • Workflow Orchestration — Inngest manages scan scheduling, alert delivery, and background processing tasks.
  • Payment Processing — Your payment processor (Stripe, Lemon Squeezy, or Paddle) handles subscription billing and payment data.
  • Email Delivery — Email service providers deliver scan alerts, weekly digests, and account notifications.

3.2 Shared Reports

If you generate a shareable compliance report, anyone with the unique report link can view that report's contents. You control whether and with whom you share report links.

3.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or government request, or to protect the rights, safety, or property of BarGuard, our users, or the public.

4. Data Retention

  • Free scan data is automatically deleted approximately 30 days after creation.
  • Paid account data (scans, violations, reports) is retained for the duration of your active subscription and for a reasonable period thereafter to allow for reactivation.
  • Account information is retained until you delete your account or request deletion.
  • Page content is retained to enable change detection between scans and to provide historical compliance tracking.

You may request deletion of your account and associated data at any time by contacting us at support@barguard.ai.

5. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption of data in transit (TLS/HTTPS) and at rest.
  • Row-level security (RLS) policies ensuring users can only access their own firm's data.
  • Secure authentication via Supabase Auth.
  • Access controls limiting employee access to production data.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access — Request a copy of the personal data we hold about you.
  • Correction — Request correction of inaccurate or incomplete data.
  • Deletion — Request deletion of your personal data, subject to legal retention requirements.
  • Data Portability — Request an export of your data in a structured, machine-readable format.
  • Opt-Out — Unsubscribe from marketing emails and configure or disable scan alerts at any time.

To exercise any of these rights, contact us at support@barguard.ai. We will respond within 30 days.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, contact us at the email above.

8. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country of residence.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page with an updated "Last updated" date. Your continued use of the Service constitutes acceptance of the revised policy.

11. Contact

If you have questions or concerns about this Privacy Policy or our data practices, contact us at support@barguard.ai.