Privacy Policy

Last updated: October 20, 2026. This policy describes how Guidly ("we", "us") handles personal data when you use our websites, marketing pages, and the Guidly product. Processing is subject to EU GDPR and to Bulgarian personal data law where applicable.

Who we are

Guidly is developed by the same team as Bulgarit. Privacy, commercial, and company-formation coordination for Guidly go through contact@bulgarit.com (Bulgarit). When Guidly's Bulgarian trading company is registered in the Commercial Register, we will add its legal name, Unified Identification Code (UIC), and registered address here and on About-the company will typically act as data controller for Guidly thereafter.

Under the GDPR and Bulgarian law (including the Personal Data Protection Act), whoever determines why and how personal data is processed must be identifiable. Until registration is complete, the controller may be the natural person(s) operating Guidly; you can still exercise all applicable rights at the email above, and we respond within GDPR timelines (usually within one month, extendable where the law allows).

Who this applies to

This policy applies to visitors of Guidly web properties, trial users, paying customers, and anyone who interacts with our services where we act as a data controller. Where Guidly processes data on behalf of a customer (for example, end users of a customer's product), our customer is responsible for their own notices; we describe processor commitments in our agreements and security materials.

Data we may collect

  • Account and billing: name, email, and organization for accounts. If we introduce paid plans, payment-related information will be handled by a payment processor-we do not intend to store full card numbers on Guidly servers.
  • AI chat and walkthroughs: messages you submit and a browser-built snapshot of the page, including its URL path, title, visible text, headings, links and descriptions of interactive controls. This can contain personal data displayed on the page. Do not submit confidential, sensitive or unnecessary personal information.
  • Product usage: technical logs, configuration, and usage needed to operate, secure, and improve the service, including pseudonymous IP-based or visitor-ID-based quota records for the public demo.
  • Optional site analytics: if you accept analytics cookies, random browser and session identifiers, known public page paths, demo workspace selections, successful AI-reply and generated-guide counts, screen-width category, and broad referral categories (direct, search, social or other). Analytics events do not contain chat messages, page snapshots, names, email addresses, raw IP addresses, full referrer URLs, query parameters or URL fragments. Random cookie identifiers are pseudonymous, not anonymous.
  • Support and contact: information you send when you email us or submit forms (including the contents of your message).
  • Browser storage: authentication and security cookies, demo quota cookies where needed, and local or session storage for widget placement, demo selection and navigation preferences.

How the AI feature works

This website includes an investor showcase with sample workspaces, illustrative metrics and a fictional testimonial. Its AI chat makes real requests: when you send a message, the message and page context are sent to Guidly's backend and then to Anthropic's Claude API to generate an answer or guide. Workspace FAQ and knowledge-base content may also be included. Customer integrations use the customer's configured Anthropic or OpenAI API account and selected supported model.

Page context can include full URLs, including query parameters and fragments, and text or personal data displayed in the interface. The current snapshot feature is not an automatic redaction tool. Use sample information in the public showcase, avoid URLs containing secrets, and do not enter personal or confidential data. Before deploying the widget in a customer product, assess which information is exposed on its pages and agree appropriate safeguards. AI answers can be inaccurate; review suggested actions before following them.

The open widget keeps its conversation in memory. Full chat transcripts and assistant answers are not saved in Guidly's application database. Growth and Scale customer embeds can store short question samples and performance records as described below. This does not mean providers keep no data. Anthropic describes its standard API retention as up to 30 days, subject to contractual, safety and legal exceptions. See its data-retention information.

If you enable the microphone, your browser's speech-recognition service may process audio under its own terms. Guidly receives the resulting text when you send the message. You can use chat without enabling the microphone.

Customer chatbot performance reports

Growth and Scale customer embeds can collect a temporary session identifier, short question samples, task labels, page-path labels, viewport category, selected model, request timings, reported token usage and estimated cost, answer ratings and walkthrough actions. Scale customers can additionally supply coarse audience labels and explicit task outcomes from their application. Reports do not store assistant answers, full page snapshots, IP addresses or provider keys. Question samples use basic masking for common emails, links, numbers and keys; this cannot guarantee that all personal information is removed. Customers should avoid submitting personal or confidential information.

This reporting uses no analytics cookies or persistent visitor identifier. Customers can disable collection through the embed configuration and connect their own consent flow. Monthly service usage counting continues when optional performance reporting is disabled. Records expire after 90 days and reports exclude expired records while database cleanup finishes. Opt-in email summaries go to the workspace owner through our configured email provider; summaries contain aggregate metrics, not question samples. Customer platforms should explain their use of the widget and provide appropriate notices and choices for their users.

Why we use data

We use personal data to answer chat and contact requests, provide walkthroughs, authenticate users, enforce usage limits, secure the service and meet legal obligations.

With your consent, we also measure site traffic and demo engagement to understand and improve the showcase. Declining analytics does not prevent you from using the site or demo.

Legal bases (EEA/UK and Bulgaria)

Account and agreed service delivery rely on contract or steps requested before a contract. Handling general inquiries, providing requested public-demo help and preventing abuse rely on legitimate interests in responding to visitors and operating a secure demonstration, balanced against individual rights. We rely on legal obligation where a particular law requires processing, and consent for optional processing where required.

Retention

  • Optional analytics events are retained for up to 90 days, with automatic database expiry. Reporting excludes expired events while database cleanup finishes.
  • Marketing-site quota records use a daily identifier to enforce daily limits. A limit resetting does not delete the previous database record.
  • Public-demo quota records enforce a cap across visits. The current application does not automatically expire quota database records; they remain until deleted by an operator. Contact us to request deletion or a review of continued retention.
  • The fallback guidly_demo_vid browser cookie expires after up to 400 days. Removing a cookie does not automatically delete its related server-side quota record.
  • Contact correspondence is retained while handling the inquiry, an ensuing business relationship or a relevant legal obligation or dispute. It is held in the receiving email account and is subject to mailbox deletion procedures.
  • Account configuration is retained while the workspace is active or needed to fulfil an agreement, legal obligation or dispute. Contact us to request closure or deletion.
  • Hosting logs, email-provider data and backups have separate provider retention settings. Contact us for the settings relevant to your request.

Cookies and local storage

Authentication cookies maintain signed-in sessions and protect sign-in requests. The current session policy expires sessions after 24 hours at most; session validation can require signing in sooner. Where the public demo cannot infer an IP address, it uses the HttpOnly guidly_demo_vid cookie to enforce its usage limit. Hashed identifiers are pseudonymous, not anonymous.

Session storage remembers the selected demo and navigation state for a browser tab. Local storage remembers widget placement and demo-introduction preferences until cleared. You can remove this information using browser controls; clearing it can reset preferences or sign you out. We do not use advertising trackers.

Optional site analytics remain off until you choose “Accept all” or enable analytics in Manage preferences and save. The guidly_cookie_consent cookie remembers your accept or decline choice and its date for 180 days. After acceptance, guidly_analytics_visitor identifies a browser for up to 90 days, and guidly_analytics_session groups activity into sessions with a 30-minute inactivity window. These are first-party cookies; analytics are stored in Guidly's MongoDB database and are not sent to an advertising network.

Open “Cookie settings” in the site footer or demo controls to change your choice. Choosing “Reject all,” or disabling optional analytics and saving, removes the analytics cookies and disables future site-analytics collection. Requests already sent may finish. Previously collected events remain until their retention period ends; withdrawal does not affect earlier consent-based processing. A short-lived in-memory IP rate limit protects the collection endpoint against abuse; IP addresses are not saved in analytics events.

Sharing

The public showcase uses Anthropic for AI inference. Customer integrations use the Anthropic or OpenAI provider configured for the workspace's selected model. Contact submissions are sent through Google's Gmail service when email delivery is configured; otherwise you may choose to send the inquiry through your own email application. Infrastructure providers run the web application and MongoDB data store. We do not sell personal information or share it for behavioural advertising. Contact us for the current infrastructure providers, locations and applicable processing terms.

Business customers (processors)

Where Guidly processes personal data on behalf of a business customer (for example, end users interacting with an embedded widget), the customer normally determines the purposes and remains responsible for its own privacy notices and lawful basis. A written data-processing agreement is required before any such processing that falls under GDPR Article 28, regardless of the customer's pricing tier. Contact us to arrange this before deploying on pages containing personal data.

International transfers

AI, hosting and email services may process data outside the EEA. The relevant provider, location and transfer mechanism must be assessed for the deployment, such as an applicable adequacy decision or Standard Contractual Clauses and any necessary additional safeguards. Contact us for the arrangements and a copy of relevant safeguards. We do not promise EEA-only hosting.

Security

We implement administrative, technical, and organizational measures designed to protect personal data. No method of transmission or storage is 100% secure; see also our Security page.

Your rights

Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You can object to processing based on legitimate interests. We do not use the public chat to make solely automated decisions producing legal or similarly significant effects about you.

Depending on your location, you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. To exercise rights, contact contact@bulgarit.com.

You may lodge a complaint with a supervisory authority-for Bulgaria this is the Commission for Personal Data Protection (CPDP); elsewhere in the EEA, with the authority where you live or work. This does not affect your right to seek a judicial remedy.

United States (California and similar states)

If you are a California resident, you may have rights under the CCPA/CPRA, including to know, delete, and correct certain personal information, and to opt out of certain types of sharing. We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising as defined under California law. To submit a privacy request, contact contact@bulgarit.com. Residents of other U.S. states with comprehensive privacy laws may have similar rights; we honor applicable requests where required by law.

Children

Guidly is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies in your jurisdiction, such as certain EEA countries).

Changes

We may update this policy from time to time. We will post the updated version on this page and adjust the "Last updated" date.

Contact

Privacy questions: contact@bulgarit.com.