Guardian Privacy Policy

Effective date: October 19, 2026

Guardian Core Systems, LLC ("Guardian", "we", "us") provides a facilities management platform that companies use to request, dispatch, track and pay for maintenance work at their locations, and to work with the service providers who do that work. This policy explains what personal information we collect through the Guardian platform, our websites, and the Guardian AI Connector, how we use it, and the choices you have.

Who this applies to:

Customer users: people at companies that use Guardian (for example facilities, operations and finance teams, and store or site managers).
Service providers and technicians: companies and people who receive and complete work through Guardian, including by text message or a job link.
Website visitors: people who visit our websites or contact us.

Our role. For most information in the platform, our customer (the company that uses Guardian) decides what is collected and why, and Guardian processes it on that customer's behalf under our agreement with them. If your employer or the company you work for uses Guardian, their privacy notice also applies. Questions about that information can go to them or to us.

1. Information we collect

Account information. Name, work email, phone number, job title, company, role and permissions, and sign-in records. Sign-in is handled by our authentication provider; we do not store your password.

Work and facilities information. Work orders, requests, notes, photos, documents, locations and addresses, assets and equipment, schedules, proposals, invoices, lease terms and landlord details, and the history of changes to them, including who made each change and when.

Service provider information. Company name, contacts, phone numbers and email addresses, trades and coverage areas, rates and price lists, insurance certificates, signed agreements, tax forms such as W-9 (which include a taxpayer identification number), invoices, and payment preferences. For technicians: name, mobile number, check-in and check-out times, the site sign-off (printed name, date, time and signature of the person on site), and photos taken on the job.

Text messages and calls. If a service provider or technician agrees to receive text messages, we store their mobile number, their consent and opt-out status, and the messages sent and received. If our phone system is used to check in or out, we record the call event and the keys pressed.

Email. Emails sent to Guardian addresses (for example a documents mailbox) and their attachments, which we file to the matching job.

Location. Addresses of customer locations. When a technician checks in on a job link, the platform asks their browser for the device's location once, to confirm arrival at the site; if they decline, the site's address is used instead. We do not track devices continuously.

Usage and device information. IP address, browser type, pages requested, and timestamps, recorded by our hosting provider for security and reliability, plus cookies needed to keep you signed in (section 6).

Website and contact information. What you send us when you request a demo or contact us.

What we do not want. Guardian is not designed to hold patient health information, payment card numbers, or other sensitive personal data, and we ask people not to enter it. For customers in healthcare, the platform shows a reminder wherever people type or upload, and asks people to confirm that photos and files contain no patients or patient information before uploading.

2. How we use information

To provide the platform: create and route work, notify service providers and sites, schedule visits, record completion, and handle proposals, invoices and payments.
To read documents for you: our AI features read invoices, proposals, leases, inspection reports and similar documents to extract the details people would otherwise type in, and to check them against the job, the agreed rates and the lease. People review the results.
To communicate: send work notifications, reminders and service messages by email and, where consent was given, by text.
To keep records: an audit history of changes, which customers and Guardian use to resolve questions and disputes.
To protect the service: security, rate limits, fraud and abuse prevention, and troubleshooting.
To improve the platform, using aggregated or de-identified information where we can.
To meet legal obligations and enforce our agreements.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use customer data to train AI models, and our AI providers process it under terms that do not allow them to train on it.

3. Text messages (SMS)

Service providers and technicians who opt in receive job-related text messages from Guardian on behalf of our customers: new job notices, scheduling, check-in and check-out prompts, and reminders. Message frequency varies with the work. Message and data rates may apply. Reply STOP to opt out at any time and HELP for help.

Mobile numbers and text message consent are not shared with third parties or affiliates for their marketing or promotional purposes. They are shared only with the providers who deliver the messages for us (section 5).

4. AI processing

Some features send document contents and job details to an AI provider to read and summarize them. Our primary AI provider is Anthropic. If it is unavailable, text-only requests may be sent to OpenAI as a backup. AI results are suggestions that people review. They are not used to make decisions about individuals.

Your organization and its partners in the work. Customers see the work on their locations. Service providers see the jobs sent to them and what they need to do the work (location, contact on site, scope, instructions). Landlords may receive notices about work the lease makes theirs, when a customer uses that feature.
Service providers who run Guardian for us, under contracts that protect the information:
- hosting and database: Railway
- sign-in and account security: Clerk
- file storage: Cloudflare (R2)
- AI document reading: Anthropic, with OpenAI as a backup for text only
- email delivery: Mailtrap, and Microsoft 365 for Guardian mailboxes
- text messages and phone: Twilio
- business lookups when sourcing service providers: Google (Places)
- maps shown in the platform: OpenStreetMap (your browser loads map images from it)
- scheduled background tasks: cron-job.org (no personal information is sent)
Systems a customer connects, when the customer turns them on: accounting (QuickBooks), work order platforms (ServiceChannel), and AI assistants through the Guardian AI Connector (section 8). Information then flows to those systems under the customer's own agreement with them.
Authorities and others, when required by law, or to protect the rights, safety and security of Guardian, our customers, or others.
A successor, if Guardian is involved in a merger, acquisition, financing or sale of assets, subject to this policy.

6. Cookies

The platform uses cookies that are strictly necessary to keep you signed in and secure. It does not use advertising cookies or third-party analytics. Our marketing website's hosting provider may set its own cookies, as described on that site.

7. Retention

Work, facilities and billing records are kept for as long as the customer's account is active and as our agreement with that customer requires, then deleted or returned within 90 days after the agreement ends, unless the agreement or the law requires otherwise.
The audit history of changes is kept for 365 days.
Text message consent and opt-out records are kept as long as needed to honor them and as the law requires.
Hosting request logs are kept by our hosting provider for a limited period.
Website contact information is kept while we are in touch, and then deleted.

8. Guardian AI Connector

The AI Connector lets an authorized customer user ask an AI assistant such as Claude (Anthropic) or ChatGPT (OpenAI) questions about that customer's Guardian data. It is read-only: it cannot create, change or delete anything.

Connecting. A customer Admin signs in to Guardian and approves access for one customer account. We record who approved it, for which account, which AI application asked, and when. Access credentials are stored only in hashed form, expire, and can be revoked at any time on the customer's Admin page.
What we receive. The requests the assistant sends to the connector (for example "open work orders in Ohio"). We do not receive your conversation, the assistant's replies, your chat history, your files, or the assistant's memory.
What it returns. Only what a customer Admin can see in the Guardian portal for that one account. Never another customer's data, service provider costs or margins, Guardian's internal notes, access codes, or links issued to service providers.
After it leaves Guardian. Answers the connector returns go to the AI provider you chose and are handled under your agreement and settings with them (Anthropic privacy policy, OpenAI privacy policy).
Records. Every connector request is recorded in the customer's audit history (the tool used, a summary of the filters, the number of results, the time and the connection), kept as in section 7.
Disconnecting. Remove the connector in your AI assistant, or have a customer Admin revoke it in Guardian. Either stops access immediately.

9. Health information

Guardian is not designed to receive, store or process protected health information, and we ask customers and service providers not to put it in the platform. For customers in healthcare, the platform reminds people of this wherever they type or upload, and asks them to confirm that photos and files contain no patients or patient information.

10. Security

We protect information with encryption in transit (HTTPS), access controls by role and by customer, hashed credentials and link tokens, rate limits, and an audit history of changes. No system is completely secure. We will notify affected customers of a security incident as the law and our agreements require.

11. Your choices and rights

Account and profile: ask your organization's Guardian administrator, or contact us, to see or correct your information.
Text messages: reply STOP to any message.
Access, correction, deletion and other rights: depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to not be treated differently for using these rights. Where we process information for a customer, we will work with that customer to answer your request. Contact us at the address below. We will verify your request before acting on it.

12. Children

Guardian is a business service and is not directed to children under 16. We do not knowingly collect information from children.

13. International use

Guardian is operated in the United States and information is stored in the United States.

14. Changes

We may update this policy. We will post the new version here with a new effective date, and notify customer administrators of material changes.

15. Contact

Guardian Core Systems, LLC
8 Wright Street, 1st Floor
Westport, Connecticut 06880

Privacy questions: privacy@guardiancoresystems.com
Support: support@guardiancoresystems.com