Privacy notice
GuardMac runs on your Mac and keeps its analysis there. What leaves your machine is the small amount needed to sell you a licence and stop that licence being copied onto unlimited computers. This page says exactly what that is.
Who we are
FrameLogic Limited ("we", "us"), trading as GuardMac, is the controller of the personal data described here.
| Company | FrameLogic Limited, registered in England and Wales, no. 17193146 |
|---|---|
| Registered office | 58 Rochester Avenue, Feltham, England, TW13 4EJ, United Kingdom |
| Privacy contact | privacy@guardmac.com |
We are the controller for personal data we collect about users of GuardMac and this site. Paddle is a separate controller for the payment data it collects. See "Who we share with".
What we collect, and why
When you buy a licence
| Data | Why | Legal basis |
|---|---|---|
| Email address | To send your licence key and support you | Performance of a contract |
| Name, as given at checkout | To identify your order and support you | Performance of a contract |
| Country | Correct pricing and currency; tax records | Contract; legal obligation |
| Paddle transaction and customer reference, amount, currency, date | To match a payment to a licence, handle refunds, and keep accounting records | Contract; legal obligation |
| Your licence key and seat count | To issue and validate the licence | Performance of a contract |
We never see or store your card details. Card data goes to Paddle and their payment processors, never to us.
When you activate GuardMac on a Mac
| Data | Why | Legal basis |
|---|---|---|
| A one-way hash of the Mac's hardware identifier | To tie a licence to a device and enforce the device limit. We cannot reverse the hash back to your serial number. | Legitimate interests: preventing licence abuse |
| Computer name, Mac model, chip, CPU core count, RAM size | So you can recognise your own machines when managing activations, and so we can reproduce bugs on the right hardware | Legitimate interests: support and licence management |
| App version and macOS version | Support, compatibility and update decisions | Legitimate interests: supporting the product |
| Activation and deactivation timestamps, and last seen date | An audit trail of where a licence is in use | Legitimate interests: preventing licence abuse |
A computer name is often a person's name, such as "Sam's MacBook Pro". We treat it as personal data for that reason. You can rename your Mac in System Settings if you would rather we did not hold it.
When you use dictation
Dictation is off until you turn it on, and turning it on is the only point at which GuardMac asks for the microphone. While you hold the fn key, or after a double tap until you tap again, audio is captured and converted to text on your Mac. The microphone closes three minutes after your last dictation, so the next one starts instantly, or within seconds of a key press if you have not dictated in that time. While it is open between dictations, GuardMac keeps only the last fraction of a second in memory and discards the rest.
| Data | Why | Legal basis |
|---|---|---|
| Audio, while you dictate | To turn what you say into text. With Apple's recogniser it is held in memory only. With High accuracy switched on it is written to a temporary file on your own Mac so the local recogniser can read it, and that file is deleted as soon as the text comes back. Either way it is never sent to us or to anyone else, and never leaves your Mac. | Consent: you switch it on, and it stops when you switch it off |
| The text it produces | Typed straight into whatever app you are using. Unless you turn on Smart formatting, we never receive it and never store it. | Consent |
| With Smart formatting on: the text of each dictation, whether the app you are typing into is a mail app, a chat app or something else, and your licence key | To tidy the text before it is typed: removing fillers such as "um", applying your own corrections, and laying out quotes, lists and emails. The text goes from your Mac to our server and on to Anthropic, whose Claude model returns the tidied version, which is then typed. The licence key shows the request comes from a licensed Mac. We do not store the text or write it to any log. We keep only daily counts per licence: how many dictations were tidied and how long they were, so we can run and pay for the service. The audio is never sent. Smart formatting is not used in terminal apps, or for a dictation held at the latch limit or because your Mac slept or locked. | Consent: off until you turn it on, and you can turn it off at any time |
Recognition is forced to run on this Mac, so the audio does not go to Apple either. With Smart formatting off, which is how it starts, we receive nothing from dictation at all: no audio, no transcripts, not even the fact that you used it. With it on, we receive the text of each dictation as described above, and never the audio.
What stays on your Mac
GuardMac's scanning, process monitoring and cleanup analysis run locally. We do not collect file names, file contents, directory listings, the processes you run, browsing activity, or keystrokes. We never collect the audio from dictation, and receive its text only if you turn on Smart formatting. None of the rest is sent to us.
When you email us
We keep your message and contact details so we can answer and keep a record of the support history. Legal basis: legitimate interests in supporting our customers.
This website
The site sets no analytics or advertising cookies, and we run no analytics or tracking scripts on it. Nothing follows you between sites, and nothing is loaded from an advertising network. Our checkout is provided by Paddle, and Paddle.js may set cookies that are strictly necessary to run the checkout and to prevent fraud; those are governed by Paddle's privacy notice.
We do count visits, using our own server logs rather than a third party. Each request records the time, the page, the country, the referring site, the browser's user agent string, and the IP address. We use this to see which pages are read, which sources send people here, and how many downloads happen. Legal basis: our legitimate interest in understanding whether the site works and in keeping it secure.
These are counts, not profiles. We do not build a record of an individual, do not follow anyone between visits, and have no way of identifying who you are from it. Logs are deleted after 90 days.
Who we share it with
| Recipient | Role | What for |
|---|---|---|
| Paddle.com Market Ltd | Merchant of record, separate controller | Selling the licence, taking payment, invoicing, sales tax and VAT, refunds and chargebacks |
| IONOS SE | Processor | Hosting our server and database, in the United Kingdom |
| Resend | Processor | Delivering your licence key and other transactional email |
| Anthropic PBC | Processor | Smart formatting, only if you turn it on: tidying the text of a dictation. Anthropic receives the text, never the audio, may keep it for a short period under its commercial terms, and does not use it to train its models. |
| Telegram | Processor | Internal operational alerts to us when a purchase needs attention. These contain order references and licence identifiers, not card data. |
| Professional advisers | Processors or controllers | Accountants and legal advisers, where needed |
| Authorities | — | Where required by law, or to establish or defend legal claims, or to protect rights and safety |
We do not sell your personal data, and we do not share it for anyone else's marketing.
International transfers
Our server and database are in the United Kingdom. Some of our processors are outside the UK and EEA, in particular Resend and Anthropic, which are based in the United States. Where personal data leaves the UK or EEA, we rely on appropriate safeguards, which for our US processors means the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies. You can ask us for details of the safeguards used.
How long we keep it
| Purchase and licence records | Seven years from the end of the relevant financial year, because UK tax law requires us to keep records of sales |
| Activation records | For as long as the licence is active, then up to 12 months, after which they are deleted |
| Payment webhook logs | 12 months, then deleted |
| Smart formatting usage counts (never the text) | 12 months, then deleted |
| Support email | Up to 3 years after the conversation ends |
| Web server access logs | Up to 90 days |
When data is no longer needed for the purpose it was collected for, we delete it or anonymise it.
Your rights
Under the UK GDPR and, where it applies to you, the EU GDPR, you have the right to:
- access the personal data we hold about you, and get a copy;
- have inaccurate data corrected;
- have data erased, where the reason we hold it no longer applies;
- restrict how we process it, in certain circumstances;
- receive data you gave us in a portable format, and have it sent to another controller;
- object to processing we carry out on the basis of legitimate interests;
- withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.
To exercise any of these, email privacy@guardmac.com. We will respond within one month, and may extend that where the law allows, in which case we will tell you why.
Some data we must keep despite an erasure request, such as sales records required for tax. We will tell you if that applies and erase everything we are not required to keep.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office, or to the data protection authority where you live or work if that is elsewhere in the EEA.
Security
We use appropriate technical and organisational measures to protect personal data. In practice that means encryption in transit (HTTPS throughout), access controls limiting who can reach the database, hashing of hardware identifiers rather than storing them in the clear, signature verification on incoming payment webhooks, and encrypted off-site backups. No system is perfectly secure, but we take this seriously and review it.
Children
GuardMac is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this notice
We may update this notice. The "last updated" date above shows when we last did. If a change materially affects you, we will make reasonable efforts to tell you.