Privacy Policy

This Privacy Policy explains how GuideJot ("we," "us," or "our") collects, uses, stores, discloses, and protects information about you when you access or use our website, platform, and services (collectively, the "Service").

Privacy is a core part of how we build the Service. We do not sell your personal information. We use privacy-first, cookieless analytics. We collect only what we need to operate, improve, and secure the Service. If something in this policy is unclear or you would like clarification, please email us at hi@guidejot.com.

This Privacy Policy applies to all visitors, users, and other persons who access the Service ("you" or "your"). By using the Service, you consent to the data practices described in this policy. If you do not agree, you must not use the Service.

GuideJot is the data controller responsible for your personal information under this Privacy Policy. Our primary contact for all privacy matters is:

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we acknowledge that GuideJot may act as both data controller and, in limited circumstances, processor with respect to specific personal data flows described in this Privacy Policy.

We collect the following categories of information. We distinguish between information you actively provide, information we collect automatically, and information generated when you use the Service.

We use the information we collect only for purposes that are compatible with the contexts in which the information was collected, or as otherwise disclosed to you. Specifically, we use information for the following purposes:

• To provide, maintain, operate, and deliver the Service — including creating and authenticating accounts, processing YouTube URLs, running SOP generation pipelines, storing SOP history, and rendering share links.
• To credit your account after a successful purchase, deduct credits when you create an SOP job, issue compensating refunds for failed jobs, and maintain an accurate transaction ledger.
• To secure the Service, detect and prevent fraud, abuse, and unauthorized access, investigate security incidents, and enforce our Terms of Service.
• To improve the Service — including troubleshooting failures, iterating on models and extraction quality, measuring product-market fit, understanding feature adoption, and prioritizing the product roadmap. For analytics we exclusively use aggregated, non-identifying or de-identified data.
• To communicate with you about your account, including transactional emails: OTP sign-in codes, email change confirmation codes, and service-related notices. We do not send marketing emails without your explicit opt-in consent.
• To comply with our legal obligations, such as record-keeping, tax compliance, responding to lawful government requests, and enforcing our rights, contracts, and policies.
• With your explicit consent or at your direction, for any other purpose described when you provide the information.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you. We do not sell or rent your personal information to any third party for any purpose, including for direct marketing or behavioral advertising.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data only under the following lawful bases, as applicable:

• Contract: Processing necessary for the performance of our agreement with you, i.e., to deliver the Service you requested, operate your account, process credits and refunds, and respond to communications.
• Consent: Where we specifically ask for your consent, such as (in the future) opt-in marketing emails. You can withdraw consent at any time by following the unsubscribe link or by emailing us at hi@guidejot.com.
• Legitimate Interests: Processing where we have a legitimate business interest that is not overridden by your rights, including (a) security and fraud prevention; (b) product improvement through aggregated analytics; (c) internal product research and model quality measurement; and (d) enforcing our Terms of Service and legal rights.
• Legal Obligation: Processing necessary to comply with a legal obligation to which we are subject, such as taxation, record keeping, or responding to valid legal process.

Where we rely on legitimate interests, we conduct a balancing test to ensure your fundamental rights and freedoms do not override those interests. You may object to processing on this basis at any time; see Section 12 (Your Rights).

We share your information only in the limited circumstances described below. We require all recipients to handle your information in a manner consistent with this Privacy Policy and to implement appropriate technical and organizational security measures.

We do not share your personal information with advertisers, ad networks, marketing partners, or data brokers. We do not participate in cross-site behavioral advertising of any kind.

GuideJot is built to minimize cookies and avoid tracking. The following is a complete list of cookies and similar storage mechanisms used by the Service.

No analytics cookies, advertising cookies, third-party tracking cookies, or cross-site tracking pixels are used. Because our analytics provider operates without cookies, no consent banner is required under the EU ePrivacy Directive for analytics. You can block or delete cookies at any time in your browser settings; note that doing so may prevent you from signing in or using authenticated features of the Service.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, or as required or permitted by applicable law. Our standard retention periods are:

• Account data (email, name, linked accounts): Retained for the lifetime of your account, and deleted or anonymized within 90 days after you delete your account, except where longer retention is required by law.
• Authentication logs and security telemetry: Retained for up to 12 months, then aggregated or deleted.
• Generated SOPs, inputs, and user interaction state: Retained for the lifetime of your account unless you explicitly delete a specific SOP.
• Credit ledger and billing transaction records: Retained for a minimum of 7 years to satisfy tax, accounting, and audit obligations, then anonymized or securely deleted.
• Server logs (IP address, user-agent, URL, status): Retained for up to 30 days, then securely deleted.
• Support and inbound communications: Retained for as long as necessary to resolve the matter, plus a maximum of 36 months for reference and dispute resolution.

After the applicable retention period, we either permanently and securely delete the information, anonymize it such that it can no longer be linked back to you, or retain it separately from personal identifiers in an aggregated form.

We implement and maintain a comprehensive set of technical and organizational security measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Those measures include:

• Encryption of all data in transit using TLS; encryption of sensitive persistent data at rest using provider-managed encryption or industry-standard AES-256.
• Strict database access controls, least-privilege IAM policies, row-level locking for sensitive transactions (e.g., credit deductions), and parameterized queries to prevent injection attacks.
• Automated dependency patching, regular vulnerability scanning, rate limiting on public endpoints, and server-side input validation on all user inputs.
• Secure, one-way password-equivalent hashing for authentication tokens, short-lived OTP codes with single-use semantics, and brute-force throttling on all authentication endpoints.
• Production system access is restricted to authorized personnel on a need-to-know basis, with access controls appropriate for the system's scale.
• We periodically review and update our security controls, response plans, and incident-handling playbooks as the Service evolves.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal data, we will notify you and applicable regulators as required by applicable law, without undue delay. For EEA/UK users, this includes notification to the competent supervisory authority under the GDPR where legally required.

The Service is operated primarily from infrastructure located in the United States, EEA, Japan, and potentially other jurisdictions where our service providers operate. If you access the Service from outside those regions , please be aware that information we collect will be transferred to, processed, and stored in those same jurisdictions and potentially additional jurisdictions where our service providers operate, whose data-protection laws may differ from those in your country of residence.

For transfers of personal data originating in the EEA, UK, or Switzerland to countries not recognized as providing an adequate level of protection by the European Commission or relevant competent authority, we rely on recognized transfer mechanisms, including the EU Standard Contractual Clauses (SCCs) as adopted by the European Commission, UK International Data Transfer Addendums where applicable, and equivalent or supplementary safeguards.

You may request a copy of the relevant transfer mechanism documents by contacting us at hi@guidejot.com.

The Service is not directed to, nor intended for use by, children under the age of 16 (or the relevant age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you are a parent or guardian and you believe that your child has provided us with personal information without your consent, please contact us immediately at hi@guidejot.com and we will take commercially reasonable steps to permanently delete that information from our active systems.

Depending on where you live, you may have the following rights with respect to your personal information, subject to applicable law and any legal exemptions. To exercise any of these rights, please email us at hi@guidejot.com. We will respond to verifiable requests within 30 days, and may extend that period by a further 60 days for complex or high-volume requests, in which case we will notify you of the extension within the first 30 days.

We do not charge a fee to process verifiable requests unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or decline to act. We may request additional information to verify your identity before fulfilling a request, as permitted by law.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information. This section supplements the rest of this Privacy Policy.

We collect the following categories of personal information from California residents in the preceding 12 months: Identifiers (email, name, third-party authentication account ID, IP address); Commercial information (credit purchase records, transaction references); Internet or other electronic network activity (pages visited, interactions with the Service, device and browser information); and Professional or employment-related information is not collected.

We disclosed for a business purpose the following categories of personal information in the preceding 12 months: Identifiers and electronic activity information to service providers (hosting, analytics, LLM inference, email delivery, payment processors, authentication providers) as described in Section 6. We did not sell any personal information, and do not intend to do so.

Subject to applicable exceptions, California residents may: (a) request access to or a copy of specific pieces of personal information we hold about you; (b) request deletion of your personal information; (c) request correction of inaccurate personal information; (d) opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising — however, we do not engage in such practices; and (e) not be discriminated against for exercising any of these rights.

Authorized agents may submit requests on your behalf using the contact details in Section 15. We will verify requests using the email associated with your account or other reasonable methods.

To the extent applicable laws such as the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Texas Data Privacy and Security Act (TDPSA), or similar state-level legislation apply to you, we grant you the rights of access, correction, deletion, data portability, and opt-out of targeted advertising or sale, as applicable. We do not currently process personal information for the purpose of targeted advertising as defined by those statutes. To exercise rights under state laws, email hi@guidejot.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, technology, legal requirements, or for other operational reasons. If we make material changes (as reasonably determined by us), we will notify you by email (to the address on file for your account) or by posting a prominent notice on the Service prior to the changes taking effect. Non-material changes (for example, clarifications, formatting updates, or minor additions) become effective immediately upon posting with an updated "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically for the latest information on our privacy practices. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy, our data practices, or would like to exercise any of the rights described in Sections 12–14, please contact us at:

We take every privacy inquiry seriously and will respond as promptly as circumstances permit.