Last updated: 27 July 2026
GuardMyWeb (“we”, “us”, “our”) provides a reverse-proxy website security service: real-time attack blocking, traffic monitoring, and optional monitoring/testing tools for the websites our customers register with us. This policy explains what data we collect, why, and how it’s handled.
When a website is protected by GuardMyWeb, traffic to that site passes through our proxy so we can detect and block attacks. For each request we log: the visitor’s IP address, the requested path and method, the User-Agent header, and a location/device estimate derived from that data (city/country from IP, browser/OS from User-Agent). This is used solely for security monitoring — detecting attacks, generating traffic reports for the site owner, and (only for sites where the owner has explicitly enabled it) scanning page content for malware or defacement. To detect malicious activity, our security systems may automatically inspect request URLs, headers, query parameters, and request bodies while the request is in transit. We do not use form content for advertising or unrelated purposes, and we do not routinely retain passwords, payment-card details, or ordinary form submissions. Security-relevant excerpts may be retained where necessary to investigate or report a detected attack.
To create an account you sign in with Google, which gives us your verified email address. We also send a one-time verification code to that email to confirm you control it. For each customer account we store: your email/username, your subscription plan, the list of websites you’ve registered with us, and your billing cycle status. Passwords for the small number of accounts created before Google sign-in was introduced are stored as salted cryptographic hashes — never in plain text.
The customer portal and admin dashboard store a session token in your browser’s local storage to keep you signed in — this is not a tracking cookie and isn’t shared with any third party. We don’t use advertising or cross-site tracking cookies.
Data protection law distinguishes between a “controller” (who decides why and how personal data is processed) and a “processor” (who processes it on the controller’s behalf, following their instructions).
If you’re a customer and need a Data Processing Agreement (DPA) with us for your own compliance obligations, contact info@guardmyweb.com and we’ll provide one.
You can object to processing based on legitimate interests, or ask about the lawful basis for a specific processing activity, by emailing info@guardmyweb.com.
We never sell visitor or customer data to third parties.
Traffic and attack logs are retained for the report-history window included in your plan (currently 90 days for both Basic and Premium). Account data is retained for as long as your account is active, and deleted (or anonymised where we’re required to keep records) within a reasonable period after you request account deletion.
All traffic to our services is encrypted in transit (HTTPS/TLS). Passwords are hashed, never stored or logged in plain text. Admin accounts support two-factor authentication. Access to production systems is restricted to the people operating GuardMyWeb.
Under UK GDPR you have the right to access, correct, or request deletion of your personal data, to object to processing based on legitimate interests, and to request a copy of your data in a portable format. To exercise any of these rights, email info@guardmyweb.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you believe your data has been mishandled.
GuardMyWeb is a business tool and is not directed at, or knowingly used to collect data from, children.
If we make material changes to this policy, we’ll update the “last updated” date above. Continued use of GuardMyWeb after a change means you accept the updated policy.
Questions about this policy or your data: info@guardmyweb.com.