Who is responsible for your information
Alex Castle provides Gear Guardian and is the data controller for account, security, service-management and support information. Your company controls the business records and personal information it chooses to upload; we process those records to provide the service. This notice explains how we use information and the choices available to you.
Information we process and why
- Account and team information: names, email addresses, authentication records, company membership and roles are used to create accounts, authenticate users and enforce access permissions. Authentication credentials are handled by our authentication service; passwords are not readable through the app.
- Company content: equipment details, serial numbers, photos, uploaded spreadsheets/PDFs, task assignments, repair records, parts requests and comments are used to deliver warehouse-management functions and exports.
- Support and billing records: bug reports, account-closure requests, subscription identifiers, plan/status information and payment-review records help us provide support and administer subscriptions.
- Technical information: browser/device details, IP addresses and error or security logs may be processed to operate the service, diagnose faults and prevent abuse. Push subscription endpoints and device keys are used to send requested notifications.
- AI inputs: equipment search text and documents you submit to AI-assisted research/import tools are sent to AI service providers to return specifications or extracted records. Do not submit unnecessary personal or confidential information.
Legal bases
We rely on performance of our contract to provide accounts, company records, subscriptions and requested functionality; legitimate interests to secure, maintain and improve the service and respond to support enquiries; consent where required for optional notifications or non-essential tracking; and legal obligations for required business or compliance records. Your company is responsible for having a lawful basis for the personal information it uploads.
Who receives information
We use hosting, authentication, storage, security and diagnostic service providers, including Lovable Cloud, and AI providers accessed through Lovable’s AI services for requested AI features. Data sent to an AI provider is governed by that provider’s processing arrangements; this notice does not promise that all providers have identical retention practices. Company teammates see records according to their permissions. The platform owner can review bug reports across companies for support.
Paddle receives information needed for selling the service, subscription management, payment processing, tax compliance and invoicing as our Merchant of Record. Paddle handles payment-card details; Gear Guardian does not store full card numbers. See Paddle’s Privacy Policy. We may also share information with professional legal/accounting advisers or competent authorities where lawfully required.
Retention and account closure
Account and company records are retained while needed to provide the service. Expired subscribers retain existing stock read/export access, so subscription expiry does not automatically delete company data. Closure and deletion requests are reviewed; inactive membership and historical task/audit records may remain where needed for company continuity, security or legal obligations. We delete or anonymise information when it is no longer needed, subject to applicable retention requirements and backup cycles.
Security and international transfers
We use appropriate technical and organisational measures, including access controls, company-scoped permissions and encrypted communications. No online service can guarantee absolute security. Our providers may process information outside the UK or EEA. Where required, transfers use appropriate safeguards such as adequacy decisions or standard contractual clauses and applicable UK transfer arrangements.
Your rights
Depending on applicable law, you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent without affecting earlier lawful processing. For information controlled by your company, contact your company administrator. For Gear Guardian account/privacy requests, contact Alex Castle at alex@jamesbakerproductions.co.uk. We aim to respond to UK/EEA data-rights requests within one month, subject to lawful extensions, and may need to verify your identity. You may complain to the UK Information Commissioner’s Office at ico.org.uk or your local supervisory authority.
Cookies, browser storage and notifications
Essential cookies or browser storage support authentication, session persistence and requested service functions. Browser storage also remembers scanner status and notification preferences. We do not introduce advertising or marketing cookies through these pages. Hosting/security services may process essential technical data. If optional analytics or marketing tracking is introduced, consent will be requested where required. You can manage browser storage and permissions through your browser/device settings; clearing essential storage may sign you out. Push notifications require your permission, which you can revoke in your device settings.
Changes to this notice
We may update this notice as the service changes. The effective date appears above; material changes will be communicated where required.