Privacy Policy

Applies to the guardian.gethigu.com site and application (the "Service"), operated by HIGU LLC, a Washington (USA) limited liability company, doing business as Guardian. It does not replace the draft privacy policies Guardian generates for its clients' own websites.

2.1 Data Controller

HIGU LLC ("we", "us"), a limited liability company organized under the laws of the State of Washington, United States, with its address at 12548 Lake City Way NE Apt A518, Seattle, WA 98125, United States, is the controller of the personal data described here. It operates this Service under the trade name Guardian. Contact: privacidad@gethigu.com or the in-app support panel at /settings.

2.2 What data we collect

• Account data: name, email, company, role, password (hashed).
• Platform connection data: access credentials to the client's platform(s) (WordPress, Shopify, WooCommerce, PrestaShop) — stored encrypted per tenant, never in plaintext.
• Google data (via OAuth): see section 2.4.
• Billing data: handled by Stripe, Inc. We do not store card numbers, only subscription/transaction identifiers.
• AI avatar/video add-on data (if enabled): the avatar's image/voice and the represented person's explicit consent, treated as sensitive.
• Minimal technical data: essential session/authentication/language cookies (section 2.9).

We do not collect sensitive data from end visitors of our clients' sites beyond what is strictly necessary (e.g., aggregated GA4 metrics).

2.3 Why we use the data (purpose)

Providing and maintaining the Service (autonomous auditing and remediation with human approval); authenticating accounts; processing subscriptions and metered usage; generating findings and proposing/executing fixes subject to the verification and approval steps in our Terms; support and operational communications; legal and security compliance. We do not use client data for advertising, and do not sell or transfer it to third parties for purposes other than providing the Service (see 2.4 for Google data).

2.4 Google Data / Google API Services User Data Policy (Limited Use)

Guardian uses Google OAuth to connect, with the client's explicit consent, certain Google tools to their account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy). Specifically:

• We use Google API data only to provide or improve user-facing features within the Service, described below per permission.
• We do not use or transfer it for advertising (retargeted, personalized, or interest-based).
• We do not use it to determine credit-worthiness or for lending.
• We do not transfer or sell it to third parties (ad platforms, data brokers, resellers).
• We do not use it to train generalized or non-personalized AI/ML models.
• Human access is restricted: only (a) with the user's prior affirmative consent for specific data, (b) for security, (c) to comply with law, or (d) internally, aggregated/anonymized, limited to Service maintenance.

Scopes Guardian may request:

Notes: analytics.readonly, webmasters, youtube.upload are part of the initial consent; spreadsheets.readonly and drive.file are requested incrementally, only if the client enables the social module, and only for that client. The client can revoke access from their Google account (myaccount.google.com/permissions) or /settings. No Google API data trains general-purpose language models.

2.5 Legal basis

• Colombia (Law 1581/2012, Decree 1377/2013 — Habeas Data): prior, express, informed authorization (Art. 9, Law 1581/2012), via a verifiable means (Art. 5, Decree 1377/2013) — never pre-checked boxes.
• EU (GDPR): contract performance, consent, and/or legitimate interest where applicable.
• California (CCPA/CPRA): rights in 2.6 where applicable.

Guardian is operated from the United States by HIGU LLC and is available to clients across jurisdictions. Data-protection rights and framework apply according to each data subject's residence (see 2.6).

2.6 Data subject rights

• Colombia (ARCO + Habeas Data): know, update, rectify, delete; revoke authorization; complaints to the SIC (https://www.sic.gov.co).
• GDPR (EU): access, rectification, erasure, restriction, portability, objection; complaint to the supervisory authority.
• CCPA (California): know, delete, opt out of sale/sharing — Guardian does not sell personal data.

To exercise them: privacidad@gethigu.com. We respond within applicable legal deadlines.

2.7 Retention and deletion

We retain personal data while the account is active and for the additional time needed for legal/accounting/defense obligations. Upon deletion request, we delete or anonymize within a reasonable period, unless a longer legal retention applies.

2.8 International transfers

HIGU LLC, the data controller, is based in the United States, and uses infrastructure providers (hosting, database, payments, AI services) located in the U.S. or other jurisdictions. Where a data subject resides outside the United States, processing involves an international data transfer. For data subjects in Colombia, this transfer to the United States (Art. 26, Law 1581/2012) relies, as applicable, on: (a) the SIC's designation of the United States as a country with an adequate level of protection (Circular Única, Título V, Ch. 3, per Circular Externa 05 of 2017 — list subject to change; verify at sic.gov.co); (b) the data subject's prior, express, informed authorization upon accepting this policy; and (c) the transfer being necessary to perform the contract. For data subjects in other jurisdictions, the safeguards their law requires apply.

2.9 Cookies

guardian.gethigu.com uses only strictly necessary cookies (session, authentication, language). No advertising or cross-site tracking cookies. (Distinct from the cookie banner Guardian generates for clients' sites.)

2.10 National Database Registry (RNBD, Colombia)

HIGU LLC will assess registration with Colombia's National Database Registry (RNBD) at the SIC to the extent Colombian law requires it for processing the data of data subjects in Colombia; most operations this size are not required to register.

2.11 Security

Reasonable technical and organizational measures: per-tenant credential encryption, access controls, audit logging, data isolation between clients (tenantId/siteId on every query), periodic review. No system is 100% secure; we will notify of incidents as required by law.

2.12 Children

Directed at businesses and professionals; not intended for minors; we do not knowingly collect their data.

2.13 Changes

We may update this policy; we will post the date and notify of material changes.

2.14 Contact

HIGU LLC — 12548 Lake City Way NE Apt A518, Seattle, WA 98125, United States — privacidad@gethigu.com. Supervisory authority for data subjects in Colombia: Superintendencia de Industria y Comercio (SIC) — https://www.sic.gov.co