Privacy Policy
Version of 2026-11-03. The Portuguese version prevails in case of doubt.
1. Controller
SafeGuard. Privacy contact: equipa@safeguardac.online.
SafeGuard processes data in two roles:
- Controller of account, billing and website/dashboard usage data (this policy).
- Processor of the data of the players of our customers' servers. There, the server owner is the controller; we process that data only on their behalf, under the Data Processing Agreement. If you are a player, talk to the server you play on first.
2. Data we process as controller
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail and password (stored hashed) | Create and protect the account | Performance of contract |
| Organization, members and roles | Provide the Service to the team | Performance of contract |
| Audit log, IP and browser of sessions | Security, abuse prevention | Legitimate interest |
| Plan, subscription and invoices; Stripe customer reference | Billing | Contract and legal obligation |
| Support messages (e-mail, Discord) | Answer you | Contract / legitimate interest |
| Visitor count: random id of the open tab and site section, without cookies and not linked to an IP or account | Know how many people are on the site at any moment and how many visits it gets per day | Legitimate interest |
We do not sell data, advertise or build marketing profiles.
3. Cookies
We only use necessary cookies: safeguard_session (signed-in session, 7 days) and sg_lang (chosen language, 1 year). The dashboard also keeps interface preferences in your browser (for example a collapsed sidebar). We use no analytics or advertising cookies, so we do not ask for consent.
4. Who receives data (subprocessors)
| Company | Why |
|---|---|
| Vercel Inc. | Hosting of the website and dashboard |
| Supabase Inc. | Database and file storage (screenshots) |
| Northflank Ltd (UK) | API hosting |
| Stripe Payments Europe, Ltd. | Card payments (card data is only processed by Stripe) |
| Resend, Inc. | Transactional e-mail |
| Discord Inc. | Only if you set up alerts or the bot in your Discord |
Some of these providers are in the USA. Transfers rely on the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework.
5. How long
- Account and organization: while active; when you delete the account, personal data is deleted or anonymised within 30 days.
- Invoices and billing data: 10 years (tax obligation).
- Audit log: per the organization's retention setting (365 days by default).
- Visitor count: tab ids for about one day at most. Daily totals, which contain no personal data, are kept.
- Player data: per each customer's retention settings (see the Data Processing Agreement).
6. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Write to equipa@safeguardac.online; we answer within one month. You can also complain to the Portuguese supervisory authority, CNPD (www.cnpd.pt).
7. Security
Argon2 password hashing, revocable sessions, license and API keys stored only as hashes, encrypted webhooks, signed server requests, player identifiers pseudonymised by default, and role-based access with an audit log.
8. Changes
If we change this policy in a relevant way, we tell you by e-mail or in the dashboard.