Privacy policy

Our approach

The privacy of your data, and it is your data, not ours, is a big deal to us. This policy sets out what we collect and why, how it is handled, and your rights. We never sell your data: never have, never will.

It covers Guardella, operated by Issam Yahiaoui Designing Computer Systems and Programs, Al Reem Island, Abu Dhabi, United Arab Emirates (“we”, “us”), and applies to visitors to our website and to the businesses and people who use Guardella (“you”).

Comments and the people who write them

Guardella moderates comments on the Instagram accounts and Facebook Pages that a business connects. We process those comments, and the names of the people who wrote them, on behalf of that business and under its instructions: the business chooses which accounts to connect and which rules apply.

If you wrote a comment and have a question about how it was handled, contact the business that owns the account. You can also write to us at hello@guardella.com; we will pass your request on, or act on it where the law requires.

What we collect and why

Our guiding principle is to collect only what we need.

Identity and access. When you create a workspace we ask for your name, your email address and a password, which we store only as a hash. If you sign in with Google, Google gives us your name and email address. We use them to run your account and to send the service emails you choose to receive. We won’t use your name or company in marketing without your permission.

Connected accounts. When you connect an Instagram professional account or a Facebook Page through Meta’s login, Meta gives us an access token and the account’s id, username or name, and profile picture. We then read your posts (ids, captions, thumbnails) and the comments on them (the text, the commenter’s username or name, and the time). That is what lets us check comments against your rules and hide, allow or queue them.

Billing information. Card details go directly to our payment processor, Stripe, and never reach our servers. We keep your plan, a Stripe customer reference and your invoices, for account history and billing support.

Product interactions. We store your rules, your settings, the decision made on each comment and the actions you take, so the service works and you can see what happened and why.

IP addresses. We use IP addresses to limit abuse and keep accounts secure. We do not keep them as part of your account.

Anti-bot checks. The try-a-comment demo on our home page is protected by Cloudflare Turnstile, which evaluates signals from your browser to tell people from automated programs and gives us only the result. The text you type into the demo is checked and not stored.

Product analytics. We use PostHog to understand how the product is used, for example which setup steps people complete. It receives ids and event names only, never comment text or usernames. Our website analytics are cookieless.

Cookies. We use first-party cookies to keep you signed in and to remember your language. We use no advertising cookies and run no ad-network scripts.

Correspondence. When you write to us, we keep the conversation, including your email address, so we have the history if you get in touch again.

How comments are judged

Comments are checked by AI models that run on Cloudflare’s network (Workers AI) and keep no data. They go nowhere else. Comment text is not used to train any model, ours or anyone’s. If a language ever needs an outside model, that provider will be named on this page before it is switched on.

When we access or disclose your information

To provide the service. We use a small number of subprocessors to run Guardella:

Cloudflare, Inc.: hosting, database (D1), file storage, queues, AI models with zero data retention (Workers AI), email delivery and bot protection.

Stripe, Inc.: payments, invoices and subscriptions.

Meta Platforms, Inc.: the platform behind Instagram and Facebook, whose official APIs we use for the accounts you connect.

PostHog, Inc.: product analytics, with ids and event names only, never comment text or usernames.

Resend: backup email delivery, used only if Cloudflare’s email service is unavailable. Google: only if you choose to sign in with Google.

No person at Guardella looks at your comments except with your permission, for example to help with a support request, or when an error stops an automated process and needs a person to fix it. When that happens we look at as little as possible and work to fix the root cause.

To investigate abuse. If we have reason to believe the service is being used against our terms or the law, we may access the account concerned, as a last resort.

Aggregated and de-identified data. We may use aggregated or de-identified data, which cannot identify you or anyone who commented, to understand and improve the service.

When the law requires it. We disclose information to authorities only when compelled by a valid legal order, and we tell affected customers first unless the law forbids it or it is an emergency. If a tax authority audits us, we share only the minimum billing information needed.

If Guardella is ever acquired by or merges with another company, we will tell you before your information is transferred or becomes subject to a different privacy policy.

Your rights

We apply the same rights to every customer, wherever they are.

To know and to access: what we collect, how it is used and shared, and a copy of it.

To correction and erasure: you can correct your information and ask us to delete it. Deleting some data may mean the service can no longer run for you, in which case your workspace is closed.

To portability: you can export your workspace data as CSV from Settings at any time.

To restrict processing and to object: you can ask us to limit or stop how we use your information. (We never sell it.)

On automated decisions: comments are moderated automatically, by rules the business sets. Every decision shows its reason and can be reversed in one click, and deleting is off unless the business turns it on.

To complain to the data protection authority where you live.

Many of these can be done in the app. For anything else, write to hello@guardella.com. We may need to confirm your identity before acting on a request.

How we secure your data

Data is encrypted in transit with TLS. Access tokens for connected accounts are encrypted at rest, never sent to your browser and never written to logs. Comment text and usernames are never written to logs or analytics.

Deletion and retention

Comment text and usernames are kept for 90 days by default (you can choose 30, 90 or 365), then erased; only counts and decisions remain.

Disconnecting an account stops processing at once, and that account’s comment data is deleted within 30 days, or immediately if you ask.

Deleting your workspace can be undone for 7 days. Then its data is deleted, and it leaves our database backups within a further 30 days.

Invoices are kept as long as tax law requires. The Data deletion page explains every way to delete your data.

Where your data is

We are a company in the United Arab Emirates. Your data is processed on Cloudflare’s global network and stored by the subprocessors above, which may be in a country other than yours. By using Guardella, you understand that your information may be transferred there.

Changes and questions

We may update this policy to comply with regulations and to reflect new practices. When we make a significant change, we update the date at the top and email workspace owners.

Questions about this policy, your data or your rights? Write to hello@guardella.com.