Guardian Reset
Privacy Policy and Terms of Use
📅 Last updated: June 15, 2026 — Version 1.1
1. Data Controller
| Field | Information |
|---|---|
| Controller | Guardian Reset (Incorporation in Progress) |
| Activity | Development and operation of the Guardian Reset app (gambling addiction recovery support app) |
| DPO / Privacy Contact | info@guardianreset.com |
| Headquarters | Spain (subject to GDPR / EU Regulation 2016/679) |
2. Data We Process and Purpose
⚠️ SPECIAL CATEGORY DATA (GDPR Art. 9): Guardian Reset processes data related to your mental health and addictive behavior. This data enjoys enhanced protection. We only process it with your explicit consent and for the purpose stated in this policy.
| Data | Purpose | Legal Basis (GDPR) | Retention Period |
|---|---|---|---|
| Email and password | Account identification and access | Performance of contract (Art. 6.1.b) | Until account deletion |
| Usage statistics (Challenges, Badges) | Gamification and motivation | Consent (Art. 6.1.a) | Until account deletion |
| Waitlist subscription (Email, Interest Plan) | Notify availability of new Premium or Plus features | Consent (Art. 6.1.a) | Until voluntary unsubscribe |
| Name | Experience personalization | Consent (Art. 6.1.a) | Until account deletion |
| Abstinence start date | Calculate streak days, clinical progress | Consent + health data (Art. 9.2.a) | Until account deletion |
| Relapse and expense history | Tracking the recovery process | Consent + health data (Art. 9.2.a) | Until account deletion |
| User GPS location | Proximity radar and SOS alerts on the device | Consent (Art. 6.1.a) | Not persisted as user movement history |
| Reported establishment locations | Build the community map of high-risk points | Consent to report and legitimate interest in safety (Art. 6.1.a/f) | As long as the point remains relevant or until review/deletion |
| Chat with AI assistant | Conversational psychological and therapeutic support | Consent + health data (Art. 9.2.a) | Until account deletion |
| Instant Messaging App ID (optional) | Send emergency alerts to the user and their support network | Consent (Art. 6.1.a) | Until account deletion or revocation |
| Device metadata (model, OS, battery) | Included in SOS alerts to facilitate assistance | Legitimate interest in safety (Art. 6.1.f) | 72 hours from the SOS event |
| Consent log (date/time) | Legal compliance (GDPR Art. 7: demonstrate consent) | Legal obligation (Art. 6.1.c) | 3 years from revocation |
3. Data Processors and Transfers
| Provider | Function | Country/Region | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, authentication | EU (Frankfurt) | Standard DPA, EU SCCs |
| Resend | Transactional emails (confirmation, password reset, account notices) | EU / US depending on provider infrastructure | SMTP provider configured by controller; usage limited to necessary account communications |
| Cloud Infrastructure Providers | Web hosting and data flow automation architecture | EU / International (secure servers) | Server controlled by the controller, Standard Contractual Clauses (SCCs) applicable to hosting |
| Instant Messaging Providers | Emergency notifications (opt-in) | International | Only if the user voluntarily provides their messaging ID |
| Telecommunications Providers (Voice) | Management of voice calls for crisis support (Premium Plan only) | US / EU | Service requires prior explicit consent and signature of corporate DPA for activation |
| AI Model Providers (LLM) | Structured text processing to run the 24-hour conversational support assistant | US / EU | Usage strictly limited to functional processing without data retention for third-party training |
| Stripe Inc. | Subscription payment processing | US | EU SCCs, PCI DSS Level 1 certification |
Note: Guardian Reset does not sell, rent, or transfer your data to third parties for advertising or marketing purposes. Health data is never shared with third parties without your explicit consent or legal mandate.
International community map: establishment reports are aimed at identifying risk points, not at identifying individual users. Data availability, accuracy, and review may vary by country, local regulation, and community verification. If an establishment or user requests review or deletion of a report, it will be evaluated according to applicable law and criteria of security, accuracy, and data minimization.
4. Your Rights
Under the GDPR you have the right to:
- Access (Art. 15): Request a copy of all your data.
- Rectification (Art. 16): Correct inaccurate or incomplete data.
- Erasure / "Right to be forgotten" (Art. 17): Delete your account and all your data — available directly in the app under Settings → Danger Zone → "Delete my account".
- Portability (Art. 20): Receive your data in a structured format (JSON/CSV).
- Objection (Art. 21): Object to processing based on legitimate interest.
- Withdraw consent (Art. 7.3): At any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can revoke consent for Retell calls in Settings.
- Lodge a complaint with the AEPD: If you believe your rights have been violated, you can file a complaint with the Spanish Data Protection Agency at www.aepd.es.
To exercise your rights:
📧 info@guardianreset.com
We will respond within a maximum period of 30 days from receipt of the request, subject to identity verification.
📧 info@guardianreset.com
We will respond within a maximum period of 30 days from receipt of the request, subject to identity verification.
5. Data Security
- All communications are carried out over HTTPS / TLS 1.3.
- Passwords are stored using bcrypt hash managed by Supabase Auth (GoTrue).
- Access to storage systems applies strict security controls and organizational measures required by the GDPR.
- Session tokens (JWT) expire automatically and are securely renewed.
- Local storage (localStorage/IndexedDB) only contains the user's own data, on the user's device.
6. Cookies and Local Storage
Guardian Reset does not use tracking or advertising cookies. We only use browser local storage (localStorage and IndexedDB) for the following purposes:
| Stored Item | Purpose | Type |
|---|---|---|
g_token | Secure session JWT token | Strictly necessary |
g_user | User profile cache | Strictly necessary |
g_state | Streak status, points, progress | Strictly necessary |
g_cookies_accepted | Record of acceptance of this notice | Functional |
guardian_sync (IndexedDB) | Offline synchronization queue | Strictly necessary |
7. Minors
⚠️ Guardian Reset is designed exclusively for users over 18 years of age. We do not knowingly collect data from minors. If you discover that a minor has created an account, please contact us immediately to delete their data.
8. Terms of Use
8.1 Acceptable Use
Guardian Reset is a support tool for the gambling addiction recovery process. It does not replace professional psychological, psychiatric, or medical care. In case of a severe crisis, call 112 (emergencies) or go to your doctor.
8.2 Intellectual Property
All software, design, and content of Guardian Reset is the exclusive property of Guardian Reset (Incorporation in Progress). Copying, distribution, or modification without written authorization is prohibited.
8.3 Limitation of Liability
Guardian Reset provides support tools but does not guarantee gambling abstinence nor assumes responsibility for decisions made by the user. The service is provided "as is" without guarantees of uninterrupted availability.
8.4 Account Suspension
We reserve the right to suspend accounts that make fraudulent, abusive, or contrary use to the application's purpose.
8.5 Modifications
We may update this policy. We will notify you of significant changes via email or an in-app notice. Continued use of the app following notification implies acceptance of the changes.
8.6 Applicable Law and Jurisdiction
This policy is governed by Spanish law and the General Data Protection Regulation (GDPR). For any dispute, the parties submit to the courts and tribunals of Spain, without prejudice to the user's right to appeal to the AEPD.
9. Contact
For any questions regarding this policy or to exercise your rights: