Privacy Policy

We at Haus8 LLC (“Guidelane”, “we”, or “us”) are committed to respecting your privacy and keeping secure any information you share with us. This privacy policy (“Privacy Policy”) explains how we collect, use, disclose, and process your personal data when you use Guidelane’s software, platform, APIs, documentation, and related tools, including at the website at www.guidelane.io and all related software made available by Guidelane to create, manage, and share step-by-step guides with AI assistance (the “Service”). It also tells you how you can access and update your personal information and describes the data protection rights that may be available under your country’s or state’s laws. Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge you have been informed of and consent to our practices with regard to your personal information and data.

Please note that this Privacy Policy does not apply where Guidelane acts as a data processor and processes personal data on behalf of commercial customers using our commercial services—for example, if your employer has provisioned a Guidelane organization for you to use at work. Our use of that data is governed by our customer agreements covering access to and use of those offerings.

We collect the following categories of personal data:

A. Personal data you provide to us directly

We collect personal data if you create an account to use our Service or communicate with us. This includes:

Account Information. Guidelane collects identifiers such as your name and email address when you sign up for an account. If you sign in with Google OAuth (when enabled), we may also receive your profile image and related account identifiers from Google. If you sign up with email and password, we store a hashed version of your password; we do not store your password in plain text.

Organization and Collaboration Data. When you create or join an organization, we collect organization details (such as name and slug), membership roles (admin, editor, or viewer), team memberships, invites (including invitee email addresses), and related collaboration metadata.

Content You Create. The Service allows you to create and manage guides, steps, media (including images and annotations), comments, mentions, collections, categories, and related metadata. If you include personal data in that content, we will collect and store it as part of providing the Service.

AI Inputs and Outputs. Certain features allow you to submit prompts, guide context, images, questions, and conversation history (“Inputs”), which generate responses (“Outputs”) via third-party AI providers you or your organization configure (or, on limited free tiers, platform-provided providers). If you include personal data in Inputs, that information may be processed by those providers and may appear in Outputs. We also store AI run metadata such as model, status, token counts, and errors for billing, entitlements, and operational purposes.

Payment Information. If you subscribe to a paid plan, payment processing is handled by Stripe. We receive and store subscription-related identifiers (such as Stripe customer and subscription IDs, plan, status, and billing period), but we do not store full payment card numbers on our servers.

API Keys and Integrations. If you create API keys, we store a hashed form of the key, a hint, role, expiry, and usage metadata. If you connect optional integrations (such as Jira), we store encrypted credentials and related connection settings necessary to operate the integration.

Communication Information. If you communicate with us, we collect your name, contact information, and the contents of any messages you send.

B. Personal data we receive from your use of the Service

When you use the Service, we also receive certain technical data automatically. This includes:

Device and Log Information. We collect information about how our Service is performing, including IP address (as processed by our hosting and logging infrastructure), browser type and settings, request identifiers, error logs, and other operational signals. Where enabled, we use Sentry for error monitoring.

Usage Data. We collect information about your use of the Service, such as AI run activity, search and assistant usage, and organization-level insights aggregates (for example guide counts, membership counts, and AI usage). We do not use third-party marketing analytics cookies or advertising trackers in the Service as currently implemented.

Cookies and Similar Technologies. We use cookies that are necessary to operate the Service, including:

• authentication session cookies (authjs.session-token / __Secure-authjs.session-token);
• locale preference (GUIDELANE_LOCALE, used for English and German);
• short-lived cookies required for specific OAuth flows (for example Jira OAuth state).

We do not currently use advertising or cross-site tracking cookies.

Embeddings and Search Indexes. If semantic search is enabled for your organization, we generate and store embeddings derived from guide content (including chunked text representations) to power search and AI assistant features.

C. Information we do not knowingly collect

Guidelane does not knowingly collect sensitive or special-category personal information (such as genetic data, biometric data for uniquely identifying a natural person, health information, or religious information) as a category of product data. Additionally, Guidelane does not knowingly collect information from or direct any of our Service to children under the age of 18. If we learn or have reason to suspect that a user is under the age of 18, we will investigate and, where appropriate, delete or anonymize the personal data and/or restrict the account.

We may use personal data for the following purposes:

• To provide and maintain the Service, including guide authoring, sharing, embedding, search, comments, API access, and optional AI features.
• To create, manage, and administer your account and organization memberships, including invites, roles, and authentication.
• To facilitate payments, subscriptions, entitlements, trials, and billing support via Stripe.
• To operate AI features you or your organization enable, including sending relevant Inputs to the configured AI or embedding providers.
• To improve and develop the Service and conduct operational research, including debugging and identifying or repairing issues that impair functionality.
• To communicate with you about the Service, including account and security-related notices.
• To prevent, detect, and investigate fraud, abuse, security incidents, and violations of our Terms of Service.
• To enforce rate limits and protect Service availability.
• To comply with legal obligations and protect the rights, safety, privacy, and property of users, Guidelane, or third parties.
• To investigate and resolve disputes or security issues.

We may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above, such as analyzing how the Service is used and improving features. We will maintain de-identified information in its de-identified form and will not attempt to re-identify it, except as required by law.

AI processing note. Guidelane does not train its own foundation models on your Inputs or Outputs. When AI features are used, content may be processed by third-party AI providers (for example OpenAI, Anthropic, Google Gemini, Groq, and/or Hugging Face for embeddings), subject to those providers’ terms and your organization’s configuration. You should not submit content you are not authorized to process with those providers.

We may disclose your personal data in the following circumstances:

Service Providers and Business Partners. We may disclose personal data to third-party vendors who support our business operations and help us deliver the Service. Depending on configuration, this may include:

• hosting and infrastructure (for example Vercel);
• object storage (for example Vercel Blob);
• databases and related infrastructure;
• authentication providers (for example Google OAuth, when enabled);
• payment processing (Stripe);
• AI and embedding providers (as configured by you or your organization, and limited platform fallbacks where offered);
• rate limiting infrastructure (for example Upstash Redis / Vercel KV);
• error monitoring (Sentry, when configured);
• optional integrations you connect (for example Jira / Atlassian).

These parties process personal data only as necessary to perform services on our behalf or as directed by your organization’s integrations, consistent with applicable law.

Business Transfers. In the event of a merger, acquisition, restructuring, bankruptcy, or other corporate transaction, personal data may be disclosed to counterparties and advisers as part of due diligence or transferred as part of the transaction.

Legal Compliance and Protection of Rights. We may disclose personal data to government authorities or other third parties if we believe doing so is necessary to: (i) comply with applicable laws, regulations, or legal processes; (ii) respond to lawful requests or investigations; (iii) protect the safety, rights, or property of any person; (iv) prevent fraud, security incidents, or other unlawful activity; (v) enforce our Terms of Service or other legal rights; or (vi) protect Guidelane against legal liability.

Organization Administrators. If you are part of an organization account, administrators and other authorized members may access content and account-related information consistent with their roles (for example membership status, guide content, comments, and usage within that organization).

Other Users and Third Parties You Share Information With. Certain features allow you to share guides via organization access, public share links, embeds, or exports. Any information you voluntarily share through those features is accessible to recipients according to the visibility and link settings you choose, and may be subject to those recipients’ own practices.

With Your Consent. We may disclose personal data when you give us permission to do so, including through features of the Service designed to share information.

Guidelane retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, billing, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any applicable legal requirements.

If you delete your account through the Service, we anonymize your user record (for example by clearing name, email, image, and password credentials and deactivating the account). Content you created within organizations may remain available to those organizations and may be attributed to a deleted or anonymized user. Organization-level deletion is not currently offered as a self-service feature.

When personal data is no longer needed, Guidelane and its service providers will follow procedures to delete, erase, de-identify, or anonymize it in compliance with applicable laws.

We implement commercially reasonable technical and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Examples in the Service include hashed passwords, hashed API keys, encrypted organization AI keys and integration credentials, role-based access controls, request correlation and structured logging with secret/PII redaction, and optional error monitoring. However, no method of transmission over the Internet or method of electronic storage is completely secure. You should use caution when deciding what information to share with the Service. We are not responsible for any circumvention of privacy settings or security features on the Service or on third-party websites linked through the Service.

Depending on where you live and the laws that apply in your country of residence, you may have certain rights in relation to your personal data. These may include the right to access, delete, correct, or transfer your personal data; to object to or restrict how we process it; or to withdraw your consent where processing is based on consent. You may also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, you or your authorized agent may contact us at privacy@guidelane.io. We may request information to verify your identity before processing your request. Guidelane will not discriminate against you for exercising any privacy rights available under applicable law.

The rights available to you may include:

• Right to know what categories of personal data we collect, the purposes for which we use it, and the types of third parties with whom we share it.
• Access and portability, meaning you can request a copy of the personal data we hold about you and, where applicable, ask us to provide it in a portable format. (The Service currently offers guide JSON export; a full personal-data export package may require manual assistance.)
• Deletion of personal data collected from you in connection with your use of the Service, subject to certain exceptions. Self-service account deletion currently anonymizes your account rather than hard-deleting all historical content.
• Correction of inaccurate personal data we maintain about you.
• Objection / restriction / withdrawal of consent, where applicable under local law.
• No sale or targeted advertising. We do not “sell” or “share” personal data for cross-contextual behavioral advertising, and we do not process personal data for “targeted advertising” purposes as those terms are commonly defined under applicable US state privacy laws.
• No automated decisions with legal or similarly significant effects. Guidelane does not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you (for example healthcare or financial eligibility decisions).

Guidelane processes personal data for the purposes described in this Privacy Policy on infrastructure that may be located in various jurisdictions (including jurisdictions outside your country of residence, such as the United States, depending on hosting and vendor configuration). Where information is transferred internationally, we require an adequate level of data protection consistent with applicable law.

If you or your organization create a public share link or embed a guide, the content made available through that link or embed may be accessible to anyone with the link, without signing in. You are responsible for ensuring that publicly shared content is appropriate to disclose. Share links may include expiry settings where supported by the Service and your plan entitlements.

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date at the top of this page, unless another type of notice is legally required. Your continued use of the Service after any change in this Privacy Policy will constitute your acceptance of such change, to the extent permitted by law.

We encourage you to contact us at privacy@guidelane.io if you have any questions about this Privacy Policy.