Last updated: 21 July 2026
Guardrail (useguardrail.co) is operated by Matt Williams, trading as Guardrail, a sole trader based in the United Kingdom ("Guardrail", "we", "us", "our"). For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Guardrail is the data controller for the personal data described in this policy. Contact: support@useguardrail.co
This policy explains how we collect, use, and protect personal data when you use the Guardrail obligations-tracking service, including our website and application at useguardrail.co.
| Purpose | Lawful basis |
|---|---|
| Providing the core obligations-tracking service (creating, matching, and surfacing obligations, contracts, and deadlines) | Performance of a contract with you |
| Processing payments and managing your subscription | Performance of a contract with you |
| Sending service emails (password resets, account notifications, obligation alerts) | Performance of a contract with you |
| Responding to support requests | Performance of a contract with you / legitimate interests |
| Improving and securing the service, preventing fraud and abuse | Legitimate interests |
| Complying with our own legal and tax obligations | Legal obligation |
We do not use your data for advertising, and we do not sell personal data to third parties.
We share personal data with the following categories of third-party processors, strictly to provide the service: our application hosting and database provider, Stripe (payment processing), Xero (accounting data integration, data flows both ways as directed by you), Google (Gmail integration, as directed by you), Companies House (a UK government public register, data flows from Companies House to us), our transactional email delivery provider.
We have agreements in place with our processors requiring them to protect your data and only process it on our instructions. We do not permit any of these providers to use your data for their own purposes. We will only disclose personal data to other third parties where required by law, to protect our legal rights, or with your consent.
Some of our service providers (including Stripe, Google, and our email delivery provider) may process data outside the UK, including in the United States. Where this happens, we rely on legally recognised safeguards such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or a provider's own adequacy/certification arrangements, to ensure your data continues to receive an appropriate level of protection.
We keep personal data only as long as we need it for the purpose we collected it for. Our current documented periods are: company records, obligations, evidence and document files for the life of the account; failed or abandoned document uploads 30 days; data exports 7 days; integration and sync run history 30 days; email delivery logs 90 days; expired or revoked invitations 30 days; marketing enquiries and prospect research 24 months from last contact. Billing records are kept for the statutory financial record-keeping period. We review these periods as the service develops.
When a company is deleted we remove its records, documents and integration credentials from the live service straight away, and we revoke Guardrail's access to any connected Gmail or Xero account. We keep a minimal deletion record — the company name, who requested the deletion and per-table counts — for fraud and dispute prevention; it contains no obligation, document or mailbox content. Encrypted platform backups roll off on our hosting provider's own schedule, so copies can persist there for a short period after deletion.
Under UK data protection law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to delete your data, in certain circumstances; object to or restrict certain processing; request a portable copy of data you've provided to us; and withdraw consent, where processing is based on consent. To exercise any of these rights, contact us at support@useguardrail.co. We will respond within one month.
Account owners can exercise the portability and erasure rights themselves in Settings: Your data provides a downloadable export of everything the company holds in Guardrail, and Delete this company erases it. Owners can also disconnect Gmail or Xero at any time, which revokes our access to those accounts.
We hope we never give you cause to complain, but if you're unhappy with how we've handled your personal data, please contact us first at support@useguardrail.co so we can try to put things right. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain directly to the UK's data protection regulator, the Information Commissioner's Office (ICO): Website: ico.org.uk/make-a-complaint, Helpline: 0303 123 1113
We use only essential cookies required to keep you signed in and to operate the service securely. We do not use advertising or tracking cookies.
Guardrail is a business tool intended for use by adults acting on behalf of a company. It is not directed at, and we do not knowingly collect personal data from, children.
We may update this policy from time to time. If we make material changes, we will notify you by email or via the application. The "last updated" date at the top of this page shows when it was last revised.
Matt Williams, trading as Guardrail. Email: support@useguardrail.co. Website: useguardrail.co