Privacy Policy

1. INTRODUCTION

UMANITEK AG ("Guardian," "we," "us," "our") operates Guardian, a digital identity protection service, and the Guardian Browser Extension. The terms "you," or "your," are used herein to refer to the individual, the represented legal entity, the principal, and any user of the Account, all of whom are considered a "User".

Company details:
UMANITEK AG
Untermüli 7
6300 Zug, Switzerland
Company Registration Number: CHE-171.163.797

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use Guardian or install the Guardian Browser Extension (collectively, the "Service").

UMANITEK AG acts as the data controller for personal data processed in connection with the Service.

By using Guardian or installing the Extension, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Service.

2. WHAT DATA WE COLLECT

Personal data is primarily obtained directly from you in connection with the use of the Service, in particular when creating and operating an account, linking external accounts using authentication mechanisms (e.g., OAuth), using the functionality, communicating with the support team, and interacting with the Extension.

In certain cases, personal data may also be collected indirectly, in particular in connection with the processing of publicly available content or data relating to third parties, when this is necessary for the performance of the Service, such as detecting impersonation, misinformation, or other harmful activities.

We also process technical and usage information related to the use of the platform, such as data on interactions, system events, information stored in cookies or similar technologies, and statistical and analytical data.

2.1 Account and Contact Data

We collect: name, email address, correspondence address, login credentials (OAuth access tokens for social media login or hashed password for email/password registration), registered social media accounts, account preferences and settings.

If you utilize our Automated Takedown Service on behalf of another individual or entity, we additionally collect: name of the represented individual or entity, the legal name of the agency or guardian, the company registration number.

2.2 Social Media Profile Information

We collect: usernames, profile URLs, platform-assigned public IDs, OAuth access tokens (stored encrypted), encrypted image fingerprints: encrypted representations of profile images for identity verification.

2.3 Social Media Feed Content (Extension)

We collect: social media feed content as it appears to you while browsing, including text, images, and videos.

2.4 User Actions (Extension)

We collect: flagging signals, interaction patterns with Extension features.

2.5 Impersonation Alerts and Detection Logs

We collect: internal records of detection matches, risk scores, confidence assessments, alerts and notifications issued.

2.6 Evidence Packs

We collect: reports containing your verified identity information combined with threat data (information about fake profiles, harmful posts, AI-generated misinformation) and automated screenshots of detected threats.

2.7 AI Queries and Outputs

We collect: inputs submitted to AI systems through the Service, generated outputs related to threat detection, summarization, deepfake scan results, or analysis. This includes the audiovisual and visual files you upload for deepfake detection or TrueSeal verification (including images, video, and audio), any metadata associated with those files, the analysis we generate, and the resulting TrueSeal result or certificate. Uploaded files are stored on our systems and retained as described in the Data Retention section below. Uploaded media is screened for child sexual abuse material (CSAM) on ingestion. Any content identified or suspected to be CSAM is not placed into ordinary storage, is not transmitted to our third-party detection providers, and is instead routed to and handled under our CSAM-response and preservation protocol described in Section 2.13, solely for mandatory reporting to competent authorities.

2.8 Support Correspondence

We collect: email messages, support tickets, chat transcripts.

2.9 Technical Logs and Analytics

We collect: IP addresses, device type and operating system, usage analytics (anonymized), error logs, crash reports, performance metrics, cookies and similar tracking technologies.

2.10 Payment Transaction Records

We collect: transaction IDs, amounts, dates, subscription status.

Payments are processed by third-party payment providers. Guardian does not store full payment card details.

2.11 Identity Verification Data

We collect: images of government-issued identity documents and facial images. In accordance with data minimization principles, we do not collect this data by default. We only request this data conditionally when it is strictly required by a third-party hosting platform to execute a content takedown on your behalf, or or when we need to verify a documented claim you have made.

2.12 Guardian Response Unit Data

As part of the Guardian Response Unit initiative, we collect information to provision your limited Guardian account and process emergency takedowns. This includes your email address, first and last name, URL(s) of reported content, any description you choose to provide, your IP address, and your legal attestation confirming your age, standing, and authorization to report the content.

2.13 Child Sexual Abuse Material (CSAM) and Non-Consensual Intimate Imagery (NCII)

We do not collect, view, download, retain, or store underlying image or video files constituting child sexual abuse material (CSAM), except to the limited extent required to meet our mandatory reporting and preservation obligations. For these purposes, CSAM means any depiction of a child, or of a person who reasonably appears to be a child, in a sexual context, including material that is generated, altered, enhanced, or synthesised by artificial means, and material that does not depict a real, identifiable child. A child is any person under the age of 18. This Section also applies to non-consensual intimate imagery (NCII), including AI-generated or "nudified" imagery.

This Section applies whether a matter is submitted to us by a user, parent, or legal guardian, or is identified by us on our own initiative in the course of providing the Service.

Where CSAM is reported to us as a URL or link, we process only the text-based URL, case metadata, and submitter information for the purpose of URL-level takedowns and mandatory reporting. Where media is uploaded to our scanning or TrueSeal features, uploads are screened for CSAM on ingestion; any content identified or suspected to be CSAM is not placed into ordinary storage and is not shared with our third-party detection providers, but is instead routed into our CSAM-response and preservation protocol and handled solely for mandatory reporting to, and at the direction of, competent authorities.

No case is determined by automated means alone; content flagged as high-risk or reported by a user is reviewed by a trained person before any report is made. We report confirmed CSAM to the National Center for Missing & Exploited Children (NCMEC) as soon as reasonably possible, and in any event within twenty-four (24) hours of confirmation, consistent with 18 U.S.C. § 2258A, and, where appropriate, to law enforcement and - for matters connected to a jurisdiction outside the United States - to the relevant national hotline or local law enforcement.

Where a file has been captured or preserved, access is restricted to Umanitek Legal Counsel within an access-controlled, encrypted environment; it is not moved into shared or ordinary storage; and it is retained solely for mandatory reporting and at the direction of the competent authority. Such material is preserved for not less than one (1) year following the date of the report, consistent with 18 U.S.C. § 2258A(h) and 2258B (as amended by the REPORT Act of 2024), and is deleted after that period unless an authority directs, or applicable law requires, otherwise.

CSAM and NCII are never used to develop, test, train, fine-tune, or evaluate any product or model, and are never retained for research, analytics, or any purpose other than the review, reporting, and preservation described here. These reporting and preservation obligations override any request for erasure or deletion for as long as preservation is required (see Section 8). Our handling of CSAM and NCII is governed by our Child Safeguarding & Image Abuse Policy, which prevails in the event of any conflict.

2.14 Third-Party Data (Non-Users)

For the purposes of delivering the Service, Guardian may process limited information derived from publicly available content relating to individuals who are not Users of the Service.

We process such information solely for the purposes of detecting impersonation, misinformation, abuse, or other harmful activity and supporting User reports. The data processed is limited to publicly available data and does not include private messages or non-public content.

We apply appropriate technical and organizational safeguards and take reasonable steps to ensure that such processing does not override the rights, freedoms, or legitimate interests of the individuals whose content is processed, in accordance with applicable data protection laws.

Umanitek processes such limited publicly available information in good-faith reliance on its legitimate interests and on User reports. To the fullest extent permitted by law, Umanitek is not liable to any non-User for good-faith processing, detection, flagging, or reporting carried out in connection with the Service.

Biometric and Special-Category Data (Uploaded Media): Images, video, and audio that you upload may contain biometric identifiers (such as facial geometry or voiceprints) relating to you or to third parties. Where our processing of uploaded media involves biometric data or other special-category data, we process it only where a valid legal basis applies, including your explicit consent under GDPR Article 9(2)(a) and the corresponding provisions of the Swiss FADP, and, where applicable United States state biometric laws apply, in accordance with those laws. Our image and video deepfake detection does not rely on, extract, or store biometric identifiers. Our audio and voice analysis, however, involves the processing of voiceprints, which are biometric identifiers and special-category data; where we process such data we obtain your distinct, explicit consent at the point of upload, apply a defined retention and destruction schedule, and comply with applicable United States biometric laws, including the Illinois Biometric Information Privacy Act (BIPA) and, where applicable, the Texas Capture or Use of Biometric Identifier Act and the Washington biometric-privacy statute. Biometric identifiers of third parties depicted in uploaded media are processed only as necessary to perform the requested detection and for no other purpose.

2.15 Automation Preferences: Default Criteria, Custom Instructions, and Safe List

We collect: the Default Criteria settings applicable to your account, any Custom Instructions you submit in natural language, and the entries on your Safe List (including designated accounts, groups, posts, or URLs). We process this information to determine which detected content is moved into the takedown queue described in Section 3.3.4 of the Guardian Agent Terms and Conditions, to apply your Custom Instructions, and to exclude Safe List entries from automated detection, evidence pack generation, and takedown action.

If you believe your publicly available content has been flagged and wish to exercise your privacy rights, contact us at [email protected] with the specific content URL.

3. HOW WE USE YOUR DATA

We use personal data to:

Provide the Service: verify your identity, monitor for impersonation and threats, query AI systems for misinformation, analyze media for deepfake manipulation, generate alerts and risk scores, create evidence packs and certificates, process payment transactions, manage subscriptions, detect harmful content and enable reporting of impersonation or misinformation and, where requested, act as your authorized representative to execute automated content takedowns (which involves submitting your data, Evidence Packs, and Authorization Certificates to online platforms, web hosts, publicly accessible imageboards, forums, and archive sites, and search engines to manage removal requests, DMCA/DSA notices, and privacy complaints) and issue cease-and-desist communications. As part of the Guardian Response Unit initiative, and where required by law, we additionally report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and other competent authorities.

Improve the Service: Improve the Service: analyze usage patterns, improve detection accuracy, develop new features, and train AI models. We never use child sexual abuse material (CSAM), suspected CSAM, or non-consensual intimate imagery (NCII) to develop, test, train, fine-tune, or evaluate any product or model.

Communicate: send alerts and notifications, provide customer support, send account-related emails, marketing communications (with consent where required).

Security and Compliance: prevent fraud and abuse, enforce our Terms, comply with legal obligations, protect rights and safety.

Research: statistical analysis, industry reporting.

Marketing: reference you as a customer using your name, company name, and logo on our website, in sales presentations, press releases, and marketing materials subject to our Terms and Conditions, and utilize findings, insights, and data derived from your account for marketing purposes on a strictly aggregated or anonymized basis that cannot identify any individual user.

The provision of certain personal data is necessary in order to enter into and perform a contract with us and to use the Service. This includes, in particular, data required to create and manage an account, verify identity, connect social media accounts via OAuth, deliver core Service functionalities, process payments, and comply with legal obligations.

Providing such personal data is therefore a contractual requirement and, in some cases, a statutory requirement (for example, for accounting, tax, or regulatory compliance purposes).

You are not legally required to provide your personal data; however, if you choose not to provide data that is necessary for the performance of the contract or required by law, we may be unable to provide the Service in whole or in part, process your subscription or payments, or comply with our legal obligations.

Where personal data is requested on an optional basis (for example, for marketing communications or certain features), you are free to decline or withdraw your consent without affecting your ability to use the core functionality of the Service.

4. LEGAL BASIS (FOR EU/EEA/UK/SWISS USERS)

We process your data based on:

Contract Performance (GDPR Art. 6(1)(b)): We process personal data as necessary to provide and operate the Service you have requested, including account creation, threat monitoring, alert delivery, evidence pack and certificate generation, deepfake scanning, subscription management, and customer support.

Legitimate Interests (GDPR Art. 6(1)(f)): We process personal data where it is necessary for our legitimate interests, including maintaining the security and integrity of the Service, ensuring the proper operation and reliability of the Service, preventing fraud and abuse, improving functionality and performance, conducting internal analytics, and protecting the rights and safety of Users and third parties and establishing, exercising, or defending legal claims.

Consent (GDPR Art. 6(1)(a)): We process your data based on your consent for OAuth authorization, marketing communications, external marketing (including promotional references using your name and logo, and aggregating anonymized account data), non-essential cookies, and similar optional features.

Legal Obligations (GDPR Art. 6(1)(c)): We process personal data where necessary to comply with legal and regulatory obligations, including tax, accounting, and record-keeping requirements, our mandatory reporting and preservation obligations relating to child sexual abuse material (including under 18 U.S.C. § 2258A), and to respond to lawful requests from courts, regulators, or public authorities.

Explicit Consent for Special-Category Data (GDPR Art. 9(2)(a)): Where we process biometric or other special-category data, including in connection with media you upload for deepfake detection or TrueSeal, we rely on your explicit consent, which you may withdraw at any time. Contract performance and legitimate interests are not, by themselves, a sufficient basis for processing special-category data. This basis applies in particular to voiceprints and other biometric identifiers processed in connection with audio and voice uploads, for which we obtain a distinct, unbundled explicit consent at the point of upload. Our image and video deepfake detection does not rely on special-category data.

5. DATA SHARING AND DISCLOSURE

In connection with the processing, personal data may be transferred to entities authorized to obtain it under applicable law. Data sharing will be carried out in accordance with applicable laws and will only include the minimum amount of information necessary to achieve the purpose for which the data is being processed.

5.1 No Sale of Personal Data

We never sell, rent, or trade your personal data.

5.2 Service Providers

We share data with trusted service providers who help us operate, maintain and improve the Service, including providers of cloud hosting, payment processing, email and customer support, analytics, legal, compliance, postal and courier services, AI services, deepfake detection providers and data access. If you utilize our fully managed Automated Takedown Service, we may share necessary case materials (including your identity data, Evidence Packs, and dynamically generated Authorization Certificates) with vetted third-party specialist takedown partners to execute removal requests on your behalf. These providers are contractually required to protect your data, use it only as instructed, and comply with applicable privacy laws. You can request information about our current service providers by contacting [email protected]. Our specialist deepfake and synthetic-media detection providers currently include Reality Defender (image and video analysis) and Resemble AI (audio and voice analysis), which process uploaded media on our behalf as data processors and rely on their own infrastructure sub-processors, including Amazon Web Services. We do not disclose child sexual abuse material (CSAM) or non-consensual intimate imagery (NCII) to any service provider, takedown partner, or other third party. Such material is disclosed only through lawful reporting channels to competent authorities, including NCMEC.

5.3 Decentralized Technology

We use blockchain-based technology (OriginTrail Decentralized Knowledge Graph) for distributed searches and identity verification. Some encrypted data is stored on a decentralized network of nodes across multiple global locations. This encrypted data cannot be reversed to reveal your original information. These elements cannot be used, alone or in combination, to identify an individual. Any personal data processed in connection with the Service can be modified or deleted in accordance with applicable data protection laws.

5.4 Legal Requirements

We may disclose data when required by law or to comply with legal obligations, respond to government requests, enforce our Terms and policies, protect rights and safety, or prevent fraud or illegal activity.

We are subject to mandatory reporting laws regarding child sexual abuse material and cases involving minors or credible threats of violence. In such instances, we report to the National Center for Missing & Exploited Children (NCMEC) and/or law enforcement and other competent authorities, and may share the submitted URLs, case metadata, submitter and contact information, and any preserved material, to the extent required for mandatory reporting. For these purposes, references to minors include any person who reasonably appears to be a child, and material generated or altered by artificial means.

5.5 Business Transfers

If we are involved in a merger, acquisition, or sale, your data may be transferred. We will notify you before transfer and give you options if the new privacy policy differs.

5.6 Aggregated Data

We may share anonymized, aggregated data that cannot identify you (industry statistics, research findings, usage trends).

6. INTERNATIONAL DATA TRANSFERS

Guardian operates globally. Your data may be transferred to Switzerland, the EU, the US, and other countries where our service providers operate. We use Standard Contractual Clauses (SCCs) approved by EU/UK/Swiss authorities, transfer impact assessments, and encryption and security measures.

We do not transfer personal data internationally in the absence of a valid transfer mechanism or required safeguards.

7. DATA SECURITY

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include, among others: encryption in transit (TLS/SSL) and at rest (AES-256 or equivalent), access controls and multi-factor authentication, regular security audits and testing, employee training on data protection, and incident response procedures.

No security system is perfect. We cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

Nothing in this Privacy Policy expands Umanitek's liability beyond the limitations set out in the Umanitek Guardian Agent Terms and Conditions, which govern all liability arising out of or relating to the Service.

7.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable data protection laws. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay. Such notifications, where required, will include a description of the nature of the breach, the categories and approximate number of individuals and data records affected (where feasible), the likely consequences of the breach, and the measures taken or proposed to address and mitigate its effects.

8. YOUR PRIVACY RIGHTS

Depending on your location and subject to applicable data protection laws, you may have the following rights in relation to your personal data:

Right of Access
You have the right to request confirmation as to whether we process your personal data and, if so, to request access to that data and receive information about how it is processed.

Right to Rectification
You have the right to request correction of inaccurate personal data and completion of incomplete personal data.

Right to Erasure ("Right to be Forgotten")
This right does not apply to material that is, or may be, child sexual abuse material (CSAM), or that is otherwise the subject of a mandatory report. Where we are required by law and by our Child Safeguarding & Image Abuse Policy to preserve such material, those reporting and preservation obligations override any right of erasure or deletion for as long as preservation is required (not less than one year following the date of the report, unless an authority directs or applicable law requires otherwise).

Right to Restrict Processing
You have the right to request a restriction of the processing of your personal data in situations permitted by law, for example while we review a request you have made.

Right to Object
Where we process personal data based on our legitimate interests, you have the right to object to such processing on grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for legal claims.

Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request transmission of that data to another controller where technically feasible.

Right to Withdraw Consent
Where we rely on your consent to process personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and obligations. Depending on the nature and scope of your request, we may not be able to continue providing our services to you. In such circumstances we shall notify you before completing the processing of your request.

Right to Lodge Complaints
You have the right to lodge a complaint with a competent data protection authority in your country of residence, place of work, or where an alleged infringement of data protection law occurred.

To exercise your rights, contact us at [email protected] with "Privacy Rights Request" in the subject line. We will respond within 30 days (or as required by applicable law). Some rights may be subject to limitations and exceptions under applicable law.

9. DATA RETENTION

We process personal data only for the period necessary and required for the purposes for which the data is processed. We store your data on Amazon Web Services (“AWS”), specifically utilizing their Relational Database Service (RDS) and S3 cloud storage environments. We encourage you to review their data protection practices and agreements here:
AWS: https://aws.amazon.com/agreement/

We operate within the industry-standard Shared Responsibility Model: our cloud provider (AWS) is responsible for securing the underlying infrastructure, while we are responsible for securing your data within our environment. This section provides the retention schedule.

9.1 Retention Periods by Data Type

Payment and Legal: payment transaction records: 7 years; data subject to legal hold: until legal matter resolved.

Support and Technical Data: support correspondence: 3 years; technical logs: 12 months (detailed logs), 24 months (security logs); usage analytics (anonymized): indefinitely.

Service-Generated Data: impersonation alerts and detection logs: 2 years; evidence packs: 2 years; AI and deepfake detection queries and outputs: 2 years.

Uploaded Media (TrueSeal and Deepfake Scanning): user-uploaded images, video, and audio, and any biometric data derived from them: uploaded source media (images, video, and audio) is retained only for as long as necessary to perform the scan and generate the result, and is deleted promptly thereafter (as a target, within 24 to 72 hours), and in any event no longer than the retention term applicable under our detection provider's processing terms. This deletion does not apply to content identified or suspected to be child sexual abuse material (CSAM), which is not placed into ordinary storage and is instead preserved under our CSAM-response and preservation protocol (see Section 2.13) for not less than one (1) year following the date of the report, consistent with 18 U.S.C. § 2258A(h) and 2258B. Any biometric voiceprint data derived from audio is subject to a defined destruction schedule and is destroyed when the purpose for which it was processed is satisfied or within three (3) years of the individual's last interaction with the Service, whichever is earlier. The resulting TrueSeal result or certificate and minimal associated metadata are retained for 2 years.

Extension Data: social media feed content and User actions stored on decentralized network for harmful content detection and impersonation reporting. The moment this data is processed and committed to the decentralized network (DKG) for harmful content detection and impersonation reporting, that specific decentralized record is entirely decoupled from User identity and retained indefinitely as anonymous data.

Account and Profile Data: account information (name, email, login credentials, preferences): duration of account plus 30 days after closure; social media profile information (usernames, URLs, public IDs, OAuth tokens): duration of connection plus 30 days after disconnection or account closure; encrypted image fingerprints: duration of account plus 30 days after closure; Digital Authorization and Letters of Authority (including the embedded data contained within them, such as your name, address, represented entity details, company registration numbers, and digital authorization timestamps/IPs): duration of account plus 30 days after closure.

Identity Verification Data: Images of government-issued IDs and facial images are deleted within 24 hours of all active takedown procedures requiring verification being completed

All data listed above may be retained indefinitely in anonymized and aggregated form for research, analytics, service improvement, and ML training. If you withdraw your consent or if your objection to processing is accepted, your personal data will be deleted, unless another legal basis for retention applies. In a situation where the processing of personal data is based on specific legal provisions, the data retention period will be adjusted to the requirements of those provisions (e.g., tax law provisions).

9.2 Your Control

You may request deletion of your data at any time by contacting us or using account settings. Account closure triggers deletion of your account data within 30 days. Some data may be retained where required by law, such as payment records retained for tax compliance, or data subject to legal hold.

9.3 After Retention Periods

After retention periods expire, data is anonymized and may be retained for research and analytics. This does not apply to child sexual abuse material (CSAM) or non-consensual intimate imagery (NCII), which are not retained for these purposes.

10. COOKIES AND TRACKING

We use cookies and similar tracking technologies to operate and improve the Service, enhance user experience, and support security and analytics functions. Cookies are small text files placed on your device when you visit our website or use the Service:

Types of Cookies We Use:

Essential cookies (required): these cookies are required for the operation of the Service and cannot be disabled in our systems. They enable core functionality such as authentication, security and service delivery.

Functional cookies: these cookies allow us to remember your preferences and settings, such as language selection and personalization choices, to enhance your experience.

Analytics cookies: these cookies help us understand how Users interact with the Service, measure performance, identify errors, and improve functionality.

Marketing cookies: where applicable and subject to your consent, these cookies may be used to measure the effectiveness of marketing campaigns or deliver relevant communications. We do not use marketing cookies without consent where required by law.

You can manage your cookie preferences at any time through your browser settings, available cookie preference tools within the Service (where provided), or applicable third-party opt-out mechanisms. Please note that disabling or blocking certain cookies, particularly essential cookies, may affect the availability or functionality of the Service

Cookies from other entities (third parties) may also be stored on the devices used. The platform contains redirects to the social networking sites, which connect you directly to our profiles on these sites. Our website automatically intercepts and enforces Global Privacy Control (GPC) signals. Our application does not currently process GPC requests, but it contains no built-in user tracking mechanisms. We do not respond to legacy "Do Not Track" (DNT) browser signals as there is no universal industry standard.

11. AUTOMATED DECISIONS AND AI

We use artificial intelligence and automated systems to support threat detection, risk scoring, alert prioritization, evidence pack generation, AI hallucination detection, deepfake scanning and content flagging suggestions provided through the Extension. Automated assessments, including risk scores and threat indicators, are used for informational and prioritization purposes only. They do not produce legal effects or similarly significant effects on you within the meaning of applicable data protection laws.

Human oversight: where automated processing may significantly affect you, human oversight is applied. You have the right to request human review of any automated assessment, to express your point of view, and to contest the outcome.

Your rights: Not be subject to solely automated decisions with significant effects; contest automated decisions; express your point of view; request human intervention. Contact [email protected] with "Automated Decision Review Request" for review.

12. CHILDREN'S PRIVACY

Guardian is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us immediately at [email protected] with "Child Privacy Concern" in the subject line. We will delete the data and terminate the account.

13. THIRD-PARTY SERVICES

Your use of TikTok, X/Twitter, and other social media platforms is governed by their privacy policies. We are not affiliated with any social media platform. We do not control and are not responsible for the data collection, privacy practices, or content moderation decisions of these third-party platforms We use third-party services for payments, analytics, AI, and data access. Each has its own privacy policy. The Service may contain links to third-party websites governed by their own privacy policies.

14. JURISDICTION-SPECIFIC INFORMATION

14.1 EU/EEA Supervisory Authorities

You can lodge complaints with your local data protection authority. List available at: https://edpb.europa.eu/about-edpb/board/members_en

14.2 UK Information Commissioner's Office (ICO)

Website: https://ico.org.uk
Helpline: 0303 123 1113
Email: [email protected]

14.3 Swiss Federal Data Protection Commissioner (FDPIC)

Website: https://www.edoeb.admin.ch
Email: [email protected]
Phone: +41 58 462 43 95

14.4 California Privacy Protection Agency

Website: https://cppa.ca.gov
Phone: (916) 650-5188

14.5 Other Jurisdictions

For Users in other jurisdictions, you have rights under local privacy laws. Contact us at [email protected] for information on your specific rights.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in practices, laws, or features. We will notify you via email, in-app notification, or updated "Last Updated" date. For significant changes, we may require re-consent. Your continued use after changes means you accept the updated policy. If you do not agree, close your account before changes take effect.

Version history: Contact [email protected] with "Privacy Policy Version History" to request previous versions.

16. CONTACT US

Privacy questions or requests:

Email: [email protected]

Subject: "Privacy - [Your Request Type]"

Mail:
UMANITEK AG
Attention: Privacy Team
Untermüli 7
6300 Zug, Switzerland

Data Protection Officer: We have designated Jonathan Lutzky as a person responsible for data protection matters. For data protection inquiries, email: [email protected]

Website: https://umanitek.ai/

17. ACCESSIBILITY

If you need this Privacy Policy in an alternative format (large print, audio, Braille, etc.), contact us at [email protected] with "Privacy Policy Accessibility Request" in the subject.