GDPR Compliance

Last updated: March 2026 | UserGuide.me — European IT Company

GDPR COMPLIANT

UserGuide.me is fully compliant with the General Data Protection Regulation (GDPR). As a European company, data protection is not just a legal requirement — it is core to how we build and operate our platform.

Our GDPR Commitments

🇪🇺 EU Data Residency

All data is stored and processed on servers located within the European Union.

🔒 Data Minimization

We collect only the data strictly necessary to provide our service. Nothing more.

🛡 Encryption

TLS 1.3 in transit, AES-256 at rest. Your data is encrypted at every stage.

⏱ Data Retention

Conversation data is automatically deleted after 90 days. Account data is removed upon request.

📋 Lawful Basis

We process data based on contractual necessity and legitimate interest. Marketing requires explicit consent.

🤝 DPA Available

Data Processing Agreements are available for enterprise customers upon request.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access (Art. 15)

You can request a copy of all personal data we hold about you. We will respond within 30 days.

Right to Rectification (Art. 16)

You can update or correct your personal data at any time through your dashboard settings or by contacting us.

Right to Erasure (Art. 17)

You can request complete deletion of your account and all associated data. We process deletion requests within 30 days.

Right to Data Portability (Art. 20)

You can export your data (products, manuals, conversations) in machine-readable format from your dashboard.

Right to Withdraw Consent (Art. 7)

You can withdraw consent for marketing communications at any time via the unsubscribe link in every email.

Right to Object (Art. 21)

You can object to data processing based on legitimate interest. We will cease processing unless we demonstrate compelling grounds.

Sub-Processors

We use the following sub-processors, all with appropriate data protection agreements:

Google Cloud (EU) — AI processing (Gemini models)
PostgreSQL (EU server) — Database storage
Stripe (PCI DSS L1) — Payment processing
Resend — Transactional email delivery
Let's Encrypt — TLS certificates

Data Breach Notification

In the unlikely event of a data breach, we will:

Notify the relevant Data Protection Authority within 72 hours
Notify affected users without undue delay
Document the breach and remediation steps

Data Protection Officer

For GDPR inquiries, data access requests, or to exercise any of your rights: