Privacy Notice
Guardial AI
Effective Date: August 3, 2026 · Version 1.0
Predictive IRM, LLC, together with the Guardial AI platform, our affiliates, subsidiaries, additional products, and services (collectively, “PIRM,” “Guardial,” “we,” “us,” or “our”), wants to inform you about the ways we process your personal information. In this Privacy Notice we explain what personal information we collect, use, and disclose, and the choices and rights available to you.
“Personal information” (also referred to as “personal data”) means any information relating to an individual who can be identified, directly or indirectly, on the basis of that information. This may include information such as names, contact details, online identifiers, and other characteristics specific to that individual. It does not include information that is anonymized, de-identified, or aggregated such that it no longer identifies an individual, except where applicable law provides otherwise.
This Privacy Notice applies when you visit our websites, access or use the Guardial AI platform, or otherwise interact with any of our solutions, products, and services, including events, demonstrations, support channels, and communications that refer or link to this notice (collectively, the “Services”). It may be supplemented or replaced by additional privacy statements or terms provided to you from time to time for a specific Service.
Important note about business (B2B) use of the Guardial platform. Where an organization (for example, your employer or a Guardial customer) uses the Guardial AI platform and submits data to it under a customer agreement, we generally process that data as a service provider or processor on that organization’s behalf, and our processing is governed by that customer agreement rather than by this Privacy Notice. In that case, the organization is responsible as the controller of that data, and you should direct privacy questions and rights requests to that organization. This Privacy Notice governs personal information for which Guardial acts as the controller — such as information about visitors to our websites, account and billing contacts, prospective customers, and other individuals we deal with directly.
Who We Are.
Predictive IRM, LLC is the parent organization behind the Guardial family of solutions, which provide artificial-intelligence-enabled governance, risk, and compliance capabilities. Personal information provided to, or collected by, Guardial is controlled by Predictive IRM, LLC, and in certain circumstances jointly with, or on behalf of, one of its affiliates or subsidiaries offering the relevant Service.
As an example, data relating to the use of a product-specific web page or feature may be used by both Predictive IRM, LLC and the affiliate or subsidiary offering that product. Some product-specific pages may contain communication features (such as contact forms, chat, or support tools) that are specific to a particular affiliate or subsidiary; the controller of personal information collected through such a feature is the party identified there.
- We are committed to safeguarding the personal information of our customers, users, employees, and other stakeholders, and to processing it responsibly and transparently.
- If you wish to contact us about your personal information, including the identity of the specific controller that has processed it, please see the “How You Can Contact Us” section below.
What Personal Information Do We Collect?
The type of personal information we collect depends on your relationship with us and the Services we deliver to you. We may collect the following categories of personal information about you:
- Name and contact details, such as first and last name, email address, postal address, and telephone number.
- Work-related information, such as job title, employer, department, and other professional or organizational information.
- Account credentials, such as usernames, passwords, and other security information used for authentication and access.
- Financial information, such as billing details and payment card or bank account information used to process payments and manage subscriptions.
- Usage information, such as behavioral information about how you navigate and interact with the Services, the features you use most, and your preferences and interests.
- Computer, device, and connection information, such as IP address, browser type and version, operating system, device identifiers, and cookie or similar-technology identifiers and related information.
- Content and inputs, meaning information, files, prompts, documents, records, and other content that you or your organization submit to, upload to, or generate through the Guardial AI platform, together with the outputs produced in response.
- Any other information you choose to share through our websites, applications, support channels, and other products and services.
Children. The Services are intended for business and professional use and are not directed to children. If you are under 18 years of age, please do not use or access the Services. We do not knowingly collect personal information from children under 13 (as defined by the U.S. Children’s Online Privacy Protection Act). If we learn that we have collected such information, we will take appropriate steps to delete it.
How We Collect Personal Information.
We and our third-party service providers may collect personal information from the following sources:
- Direct interactions, such as when you register for or use the Services, request a demonstration, make a purchase, or communicate with us, including through our support and chat features.
- Data from third parties, such as information available on third-party websites, information you have made publicly available, or information provided by third-party sources including government entities, business partners, and data providers.
- Automated technologies, such as information automatically collected about your interaction with the Services and our websites using cookies, web logs, beacons, tags, and similar technologies.
How We Use Your Personal Information.
Personal information is used for the purposes for which it was collected and may be further used for compatible, statutory, or other legitimate purposes. Depending on how you interact with us and the Services, we may use your personal information to:
- Provide and administer the Services, including operating the Guardial AI platform, managing your access and account, processing transactions, and providing customer support. This processing is necessary for the performance of our relationship or in connection with a contract.
- Secure the Services, including authenticating users, monitoring for and preventing fraud, abuse, and security incidents, and protecting the rights, property, and safety of Guardial, our users, and others. This processing is necessary for our legitimate interests and to comply with legal obligations.
- Develop and improve our products and Services, including analyzing usage, conducting research, and enhancing existing and new features and the models that support them. This processing is necessary for our legitimate interests. We do not use Content submitted by customers to the Guardial platform to train models except as permitted by the applicable customer agreement.
- Communicate with you, including responding to your requests and sending administrative, transactional, and service-related messages. This processing is necessary for the performance of a contract or our legitimate interests.
- Marketing and advertising, such as sending you communications about products and services that may interest you and measuring their effectiveness. This processing is based on your consent or our legitimate interests, subject to your choices.
- Recruiting, such as assessing job applicants. This processing is to take steps prior to entering into a contract or is based on your consent.
- Other business-support and compliance purposes, including procurement, financial management, auditing, risk and compliance management, corporate governance, and external reporting. This processing is necessary to comply with a legal obligation or for our legitimate interests.
Legal bases. Where the applicable data protection laws require a legal basis for processing, we rely on one or more of the following: (i) processing necessary for the performance of a contract, or to take steps prior to entering into a contract; (ii) processing necessary for our legitimate interests, provided these are not overridden by your interests or fundamental rights; (iii) processing necessary to comply with a legal obligation; and (iv) your consent, which you may withdraw at any time.
Artificial Intelligence and Automated Processing.
The Guardial AI platform uses machine learning and other automated techniques to analyze information and generate outputs. You should be aware of the following:
- Accuracy. AI-generated outputs are produced by predictive models and may be incomplete or inaccurate. You should not rely on outputs as a substitute for professional, legal, or compliance advice, and you should review outputs before relying on them. If you believe an output contains inaccurate personal information about you, you may contact us to request review consistent with applicable law and the technical capabilities of our systems.
- Human oversight. The Services are designed to support, not replace, human decision-making. Where required by applicable law, we do not make decisions producing legal or similarly significant effects about you based solely on automated processing without appropriate safeguards, including the ability to obtain human review.
- Model improvement. We may use de-identified or aggregated information, and information for which we act as controller, to improve the performance and safety of our models and Services. We do not use customer Content submitted to the Guardial platform for model training except as expressly permitted by the applicable customer agreement or with appropriate consent.
Sharing Your Personal Information.
To provide the Services and further our business operations, we may share certain personal information internally or with selected third parties. We may also be required by law, or believe in good faith that we are required, to disclose personal information. Categories of parties we may share data with include:
- Our affiliates and subsidiaries, for example to support customer data management or to provide the technology underpinning the Services.
- Our service providers and processors, for example providers of hosting, cloud infrastructure, analytics, customer support, security, and payment processing, who act on our instructions and only to perform services for us.
- Our business partners, for example where you have purchased or expressed interest in a joint offering, or otherwise authorized the sharing of your information.
- Parties involved in corporate transactions, for example a purchaser or successor entity in the event of a merger, financing, reorganization, bankruptcy, or sale of some or all of our business, and their advisors during diligence.
- Professional advisors and other parties, for example as needed for audits, compliance, risk management, and corporate governance.
- Governmental authorities, regulators, and other third parties, in response to a lawful request or court order, or as otherwise necessary to comply with applicable law, enforce our terms, or protect our rights, property, or safety and that of others.
How Long Do We Retain Your Personal Information?
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to perform our obligations, to comply with legal, tax, and regulatory requirements, to resolve disputes, and to protect the security and integrity of the Services, in accordance with our data retention policies and applicable law. In determining retention periods, we consider the amount, nature, and sensitivity of the information, the purposes of processing, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements. When we no longer need personal information, we take reasonable steps to delete it or to keep it in a form that no longer identifies you, for example by anonymization.
How We Protect Your Personal Information.
We maintain an internal framework of policies and reasonable technical, administrative, and organizational security measures designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. We limit access to personal information to a ‘need-to-know’ basis among our personnel, service providers, and partners.
Despite these measures, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You also play an important role in protecting personal information: keep your credentials confidential, avoid reusing passwords across services, and contact us promptly if you believe your credentials have been compromised.
What Are Your Rights?
As an organization operating across jurisdictions, we honor the rights granted to you under applicable law. To the extent provided under your local data protection laws, your rights may include:
- Right of access: to obtain confirmation of, and an overview of, the personal information we process about you.
- Right to rectification: to have inaccurate or incomplete personal information corrected or completed.
- Right to erasure: to request deletion of your personal information, subject to legal exceptions. In some cases we may be unable to fully honor a request, for example where processing is necessary to comply with a legal obligation or to perform a contract.
- Right to data portability: to receive certain personal information in a structured, commonly used, machine-readable format, and, where technically feasible, to have it transferred to another party.
- Right to restrict processing: to request that we restrict processing of your personal information in certain circumstances.
- Right to object: to object to processing based on our legitimate interests, and an unconditional right to object to processing for direct marketing.
- Right to withdraw consent: to withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.
- Right to lodge a complaint: to file a complaint with your local data protection or supervisory authority.
To exercise your rights, or for any question about how we handle your personal information, please see the “How You Can Contact Us” section below. We will respond within the timeframes required by applicable law and may ask you to verify your identity before fulfilling a request.
The Use of Cookies and Similar Technologies.
Cookies are small text files stored on your computer or mobile device. Similar technologies may include pixels, beacons, tags, embedded scripts, and other tracers (collectively, “Cookies”). We use Cookies to operate and optimize our websites, facilitate browsing, analyze traffic, remember you and your preferences, personalize the Services, and, where applicable, deliver and measure marketing. We may use Cookies in the following categories:
- Strictly Necessary Cookies — required for the website to function, such as for security, logging in, and completing forms. Blocking them may affect the proper functioning of parts of the site.
- Functional Cookies — enable enhanced functionality, user experience, and personalization; if disabled, some features may not work properly.
- Performance Cookies — support analytics that help us understand and improve website functionality and user experience.
- Advertising Cookies — used to collect insights and to deliver relevant content and advertising on our own and other websites.
Most modern browsers let you block or delete Cookies through your settings. Where we provide a cookie preference tool, you can use it to manage your consent for Cookie categories (other than strictly necessary ones). Please note that opting out of interest-based advertising does not mean you will no longer see advertising, the ads may simply be less relevant to you.
Links to Other Websites.
Our websites and the Services may contain links to third-party websites or services that have privacy practices different from ours. We are not responsible for the collection, use, or disclosure of personal information by, or the content of, such third-party websites. Links are provided for convenience only, and your use of any linked site is subject to that site’s own policies. We encourage you to review the privacy notices of any third-party sites you visit.
Additional Information Based on Specific State Requirements.
California Residents
This section provides additional information required under California law and should be read together with the rest of this Privacy Notice. It describes the categories of “personal information” (as defined under California law) that we collect and the categories of third parties to whom we disclose that information for a “business purpose.” The inclusion of a category does not necessarily mean we hold information in that category about you. We do not “sell” personal information, and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under California law.
| Category of personal information collected | Categories of third parties to whom we disclose for a business purpose |
|---|---|
| Identifiers | Our affiliates and subsidiaries Our service providers and processors Cloud, hosting, and infrastructure providers Government authorities and regulators |
| Customer and business records (e.g., billing and account records) | Our affiliates and subsidiaries Our service providers and processors Payment processors and financial institutions |
| Commercial information | Our affiliates and subsidiaries Our service providers and processors Business partners as directed by you |
| Internet or other electronic network activity information | Our affiliates and subsidiaries Our service providers and processors Analytics and security providers |
| Geolocation data (general, from IP address) | Our affiliates and subsidiaries Our service providers and processors |
| Professional or employment-related information | Our affiliates and subsidiaries Our service providers and processors Government authorities and regulators |
| Audio, electronic, or visual information (e.g., support recordings) | Our affiliates and subsidiaries Our service providers and processors |
| Inferences drawn from the above | Our affiliates and subsidiaries Our service providers and processors |
Sensitive personal information. We may collect certain categories of sensitive personal information (as defined under California law), such as account log-in credentials in combination with any required security or access code, and financial account information. We use such information only to provide and secure the Services, process transactions, manage our business, and comply with law — and not for purposes of inferring characteristics about you. We do not use or disclose sensitive personal information beyond the purposes permitted under the California Privacy Rights Act.
Your California rights. Subject to certain exceptions, California residents have the right to request access to, correction of, and deletion of their personal information, the right to know what personal information we collect and how we use and disclose it, the right to opt out of any “sale” or “sharing” (which we do not engage in), and the right to be free from discrimination for exercising these rights. To submit a request, contact us using the details in the “How You Can Contact Us” section. We will verify your identity before fulfilling a request and may use identity-verification services or ask you to sign in to your account.
Other U.S. State Privacy Laws
Residents of other U.S. states with comprehensive privacy laws may have similar rights, including the rights to access, correct, delete, and obtain a portable copy of their personal information, to opt out of targeted advertising and profiling in furtherance of decisions producing legal or similarly significant effects, and, where available, to appeal a decision we make about a rights request. The following table summarizes the categories of personal information we collect and how we use and disclose it.
| Category of personal information | Purpose of use | Disclosure |
|---|---|---|
| Identifiers (name, email, IP address, device identifiers) Commercial information (transaction and subscription history) Network activity information (log data, usage data) Geolocation data (general area from IP address) Professional or employment-related information Account credentials and payment information Content you or your organization submit to the Guardial platform Inferences drawn from the above |
Provide, operate, secure, and maintain the Services Authenticate users and administer accounts Improve and develop features and models used in the Services Detect, investigate, and prevent fraud, abuse, and security incidents Communicate with you and provide support Marketing, subject to your choices Comply with legal obligations and enforce our terms |
Vendors, service providers, and processors assisting business operations Affiliates and subsidiaries Government authorities and other third parties for legal reasons Parties involved in a corporate transaction Business account administrators (for organizational accounts) |
Authorized Agents.
In some circumstances, you may designate an authorized agent to submit a rights request on your behalf. To do so, you must provide the agent with signed, written permission and may be required to verify your own identity directly with us. We may deny a request from an agent who does not submit proof of authorization. If we receive a request from an authorized agent, we may confirm with you directly that you want the requested action taken.
How You Can Contact Us.
If you have any questions about how we process your personal information, or if you want to exercise one of your rights, you can contact us as follows:
Predictive IRM, LLC — Privacy Team
Attn: Data Privacy Department
Email: privacy@predictiveirm.com
We will respond to your request in accordance with applicable data protection laws and within the timeframes those laws require. As part of our verification process, we may ask you to provide additional information or, if you have an account, to sign in. If we do not grant your request in whole or in part, we will explain why. We do not discriminate against individuals who exercise their rights. If you feel we are unresponsive or you disagree with our data practices, you also have the right, depending on applicable law, to file a complaint with your local data protection authority.
Updates to This Notice.
From time to time we may update this Privacy Notice or any specific privacy statement. When we make changes, we will revise the “Effective Date” and, where required by law, provide additional notice. We encourage you to review this notice periodically.