Skip to content
Start free trial

Privacy policy

Last updated 9 October 2026

1. Who we are

Guildwise HQ ("the Service") is operated by Creativ360 (Pty) Ltd trading as Guildwise HQ, a company registered in South Africa under registration number 2018/313314/07, with its registered address at 43 Malva Street, Dana Bay, Mossel Bay, Western Cape, South Africa ("Guildwise HQ", "we", "us").

For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA") and the EU General Data Protection Regulation ("GDPR"):

  • we are the responsible party (POPIA) and controller (GDPR) for the personal information of people who hold an account with us, visit our website or write to us; and
  • we act as an operator (POPIA) and processor (GDPR) for the content a customer puts into its own organization on the Service (see section 4).

Our Information Officer is Pieter Jordaan. You can reach them at [email protected]. For any privacy question, access request or complaint you can also use the Contact us page.

2. What this policy covers

This policy applies to the Guildwise HQ website (guildwisehq.com), the web application, the runner and installer software that connects your own machines to the Service, and the e-mails we send. It does not cover third-party sites we link to, or the model providers and other services that your own agents connect to (section 6).

3. The information we hold

Account information. Your name, e-mail address, a hashed password (we never store your password itself), your role and membership of organizations, your settings, and, if you switch on two-factor login, an encrypted authenticator seed and recovery codes.

Organization data. What you and your colleagues create in the Service: organizations, projects, cards on the board, phases, schedules, agent definitions and their instructions, decisions and desk items, budgets and cost figures, review and test results, and the audit trail of who did what and when.

Agent transcripts and chats. The conversations between you and your agents, and the transcripts of the work the agents did. These can contain anything that you or your agents typed, read or produced, including personal information of third parties and source code. Please do not put information in them that you are not entitled to process.

Vault contents. A vault is a notes repository that lives on your own git repositories. The Service reads and writes it through your runner and keeps an index (titles, paths, change history and the text needed for search and conflict handling). We do not own, and do not need to see, the repositories themselves.

Runner and workstation data. For each workstation you link: its name, operating system, software version, the repositories and branches it works on, availability and heartbeat information, resource limits, and the logs and results of the shifts it runs. Your agents run on your own workstation, on a VPS that you rent, or in a GitHub Codespace in your own GitHub account, and the runner runs there; we do not have access to the rest of those machines or accounts.

Payment and subscription data. Guildwise HQ has paid plans, each starting with a 7-day free trial, and they are billed through our payment provider, Paystack (section 6). We receive and keep only what we need to run your subscription: the plan, the status, billing dates, the invoicing details you give us, a Paystack token reference that lets Paystack charge your subscription, and, for display and expiry reminders, the card brand, the last four digits and the expiry date. Card data is entered with and handled by Paystack. Guildwise HQ stores no full card number, only the Paystack token reference and those few display details.

E-mails and support. Messages you send through Contact us, the screenshots and technical context you attach (page, app version, browser, recent client errors), our replies, and the notification e-mails we send you (invitations, security, support and account notices).

Technical and security data. IP address, browser type, timestamps and request logs, kept for security, abuse prevention, rate limiting and fault finding. Where we need to detect abuse we store a one-way hash of an IP address rather than the address itself.

Cookies and local storage. See section 9.

4. Why we use it, and our legal bases

  • To create and run your account and organization and provide the Service (including running agents on your behalf, keeping the audit trail and enforcing budgets and approvals): performance of a contract, which is the Terms.
  • To secure the Service, prevent fraud and abuse and keep logs: our legitimate interests, and our customers' interest, in a secure Service.
  • To answer your requests and support cases: contract and legitimate interests.
  • To send service e-mails (invitations, security, trial and billing notices): contract and legitimate interests.
  • To bill you and keep financial records: contract and legal obligation (tax and company law).
  • To improve and fix the Service, using aggregated or de-identified figures: legitimate interests.
  • To send product news or marketing, if we do: your consent, which you can withdraw at any time. We send no marketing without it.

Customer content. For the content of an organization (organization data, transcripts, vaults, runner data) the customer decides why and how it is processed. We process it only to provide the Service, on the customer's documented instructions, and the customer's organization owner is responsible for having a lawful basis for it. If you are a customer and need a data processing agreement, ask us through Contact us.

5. What we do not do

We do not sell personal information. We do not use the content of your organization (transcripts, vaults, repositories, cards) to train any model. We do not read your organization data except where you ask us to for support, where it is necessary to keep the Service secure, or where the law requires it. The platform administration area shows organization metadata (plan, status, limits, dates) and accounts, not the content of projects or chats.

6. Who we share information with (sub-processors)

We use a small number of service providers to run the Service. They may process personal information only on our instructions and under confidentiality and security obligations.

  • Hosting and infrastructure providers that run the servers and database of the Service: Namecheap (hosting).
  • E-mail delivery provider for the messages we send: SendGrid (email).
  • Payment gateway: Paystack, for subscription payments and invoices. Paystack handles card and payment-method data under its own privacy policy and security standards; Guildwise HQ stores only a Paystack token reference and the card brand, last four digits and expiry date, never the full card number.
  • Model providers used by your agents. Guildwise HQ does not supply a model. Your agents run on your own workstation, a VPS you rent or a GitHub Codespace in your own GitHub account, using the tools and model providers that you choose and configure (for example a provider of an AI model or a coding assistant). What your agents send to those providers is governed by your agreement with them and their privacy terms, not by this policy. Please read them before connecting an agent to confidential information.

We may also disclose information where the law or a court requires it, to protect our rights or the safety of others, or in connection with a sale or restructuring of our business (the buyer would be bound by this policy).

A current list of sub-processors is available from us on request.

7. Transfers outside South Africa and the EEA

Our providers may process information in other countries. Where personal information leaves South Africa we make sure it is protected as section 72 of POPIA requires (a recipient bound by law, binding rules or an agreement that gives substantially similar protection, or with your consent). Where personal information of people in the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses (and the UK addendum) or another lawful transfer mechanism.

8. How long we keep information

  • Account information: for as long as the account is active, and for 90 days after it is closed.
  • Organization content: for as long as the organization exists. When an organization is closed or the contract ends, the customer can export its data for 30 days; after that we delete it, and it leaves our backups within 35 days.
  • The audit trail is append-only and is kept for the life of the organization, because it is the record of who approved what.
  • Support tickets: for 2 years.
  • Billing and tax records: for 5 years, the period the law requires in South Africa.
  • Server logs: for 90 days.
  • The landing-page assistant stores no conversations. It keeps only usage counters.

9. Cookies and local storage

We use only what the Service needs to work. We do not use advertising or cross-site tracking cookies.

  • A session cookie (aom_sid) keeps you signed in. It is strictly necessary, HttpOnly, and removed when you sign out or it expires.
  • Local storage in your browser remembers your own preferences, such as the light or dark theme, whether the sidebar is collapsed, the last project you opened and the progress of the first-login tour. It does not leave your browser.

Because these are strictly necessary for the Service you asked for, we do not show a cookie banner. If we add analytics or any non-essential cookie we will update this policy and ask for your consent first where the law requires it.

10. Security

We protect information with measures that are appropriate to the risk, including encryption in transit, hashed passwords, optional (and, for organizations that require it, mandatory) two-factor login, encryption at rest of sensitive secrets such as authenticator seeds, role-based access inside each organization, strict separation between organizations, and an append-only audit trail. No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator (and, under the GDPR, the competent supervisory authority) as the law requires and without undue delay.

11. Your rights

Under POPIA and the GDPR you can ask us to:

  • tell you whether we hold your personal information and give you a copy;
  • correct or complete it;
  • delete it, or restrict or object to our processing of it, where the law gives you that right;
  • give you your information in a portable format (GDPR);
  • stop sending you marketing, and withdraw any consent you gave;
  • not subject you to a decision based solely on automated processing that significantly affects you. We do not make such decisions about people.

Write to our Information Officer or use Contact us. We may need to confirm who you are first and will answer within the time the law allows (one month under the GDPR; a reasonable time under POPIA). If you are a member of a customer's organization, we may refer your request to that customer, who controls the content of the organization.

You may also complain to a regulator. In South Africa that is the Information Regulator (inforegulator.org.za; complaints e-mail: [email protected]). If you are in the European Economic Area or the United Kingdom you can complain to your local data protection authority. We would appreciate the chance to put things right first.

12. Children

The Service is for businesses and professionals and is not directed at children. You must be 18 or older to hold an account. We do not knowingly collect personal information of children; if you think we have, tell us and we will delete it.

13. Changes to this policy

We may update this policy as the Service or the law changes. We will change the date at the top and, for material changes, tell account holders by e-mail or in the Service before the change takes effect.

14. Contact

Creativ360 (Pty) Ltd trading as Guildwise HQ, 43 Malva Street, Dana Bay, Mossel Bay, Western Cape, South Africa. Information Officer: Pieter Jordaan, [email protected]. Or use the Contact us page.