Privacy Policy

Last updated 9 November 2026

Draft document — to be reviewed by a qualified solicitor before the platform accepts paying customers.

1. Data controller

Guardian Defence Technologies Ltd (company number 17464693), registered office Flat 2, 90 Torridon Road, London, SE6 1RD, United Kingdom, is the controller of personal data about Merchants who use Guardian NexaCart AI.

2. Merchants' customer data

When Merchants store details of their own customers (for example names, emails and order details), the Merchant is the controller of that data and we act as their processor, handling it only on their instructions to provide the Platform.

3. What we collect

Account details: name, email, business name, country.
Business data you enter: products, suppliers, orders, research notes.
Technical data: log and device information needed to run and secure the service.

4. Why we use it (lawful basis)

To provide the Platform under our contract with you.
To keep the service secure and prevent misuse (legitimate interests).
To meet legal obligations, such as tax and accounting records.

5. AI processing

When you ask for an AI recommendation, the relevant product information is sent to our AI provider to generate the answer. We do not use your data to make decisions with legal effect about you.

6. Sharing

We use trusted processors for hosting, authentication, AI and (when enabled) payments. We do not sell personal data. Payment card details are handled by the payment provider and never stored by us.

7. International transfers

Where data is processed outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement.

8. Retention

We keep account data while your account is open and for up to 6 years afterwards where needed for legal or accounting purposes.

9. Your rights

You have rights to access, correct, delete, restrict or object to processing of your data and to data portability. You can also complain to the Information Commissioner's Office (ico.org.uk).

10. Security

Each account's business data is isolated so that only that account can access it, and connections are encrypted.