Legal
Privacy
Last updated
GuidedVisual collects the minimum it needs to run: your name and email address from Google so you can sign in, and the projects and images you create. It does not use analytics, advertising, or third-party tracking of any kind, and it never sells or shares your work. Everything you have made can be downloaded at any time, and deleted by you whenever you choose.
Who this is about
GuidedVisual is a tool for turning an image into an interactive visual. It is operated as a sole proprietorship in India, trading as GuidedVisual, and can be reached at hello@guidedvisual.com. For anything about your data specifically, write to security@guidedvisual.com.
This policy covers the GuidedVisual application, the pages you publish with it, and the embeds those pages produce.
What is collected
| What | Why | Kept until |
|---|---|---|
| Email address and display name | To identify your account and own your projects. Supplied by Google when you sign in. | You ask for the account to be deleted |
| A sign-in session | To keep you signed in between visits. | 30 days, or when you sign out |
| Your projects | Titles, artboards, regions, labels, descriptions, links and settings — the work itself. | You delete them |
| Images you upload | The pictures your visuals are built on, plus the frozen copies a publication makes. | You delete the project |
| View counts | How many times each published project was opened, and how many of its regions were opened. | You delete the project |
| Feedback you send | Your message, any screenshots you attach, your account address and which part of the product you were in — sent as one email to our support mailbox so it can be answered. Screenshots are not stored in the application at all, only in that email. | As long as the conversation it starts needs it |
Signing in
Sign-in uses Google, and asks Google for three things only: openid, email and profile. That gives an email address, a display name and a picture URL. GuidedVisual stores the email address and the display name. It never receives your Google password, and it has no access to your Gmail, Drive, contacts or calendar.
Your session is stored as a SHA-256 hash of the session token, never the token itself, so somebody who obtained a copy of the database still could not sign in as you. The token lives only in a cookie on your own device, marked HttpOnly, Secure and SameSite=Lax.
What published pages record
When somebody opens a page you published, GuidedVisual increments two numbers: how many times that project was viewed that day, and how many of its regions were opened. That is the whole record — a project id, a date, and two counts.
No visitor identifier is stored. No IP address, no cookie, no device fingerprint, no user agent, nothing that could distinguish one reader from another or the same reader on two days. The counts cannot be traced back to a person because there is nothing in them to trace.
What is deliberately not done
- No analytics. There is no Google Analytics, no Plausible, no Segment, no product analytics of any kind.
- No advertising and no tracking. Nothing here is used to build a profile of you, and nothing is shared with an advertising network.
- No third-party scripts. The security policy the site sends with every page names no external origin at all. Fonts and text recognition assets that would normally come from a CDN are served from this site instead, so no other company learns that you visited.
- No email click tracking. When account email is switched on, links in it will not be rewritten through a tracking domain.
- Your work is never sold, licensed or used to train anything.
Smart Trace runs on your computer
The feature that drafts regions from a floor plan, and the one that reads labels off it, both run in your browser. The image is not uploaded to an inference service, and no third party sees it. The optional server-side AI mapping feature is switched off on this deployment.
Where it is stored, and who else touches it
GuidedVisual runs on Cloudflare. Your account records and projects are in a Cloudflare D1 database and your images are in Cloudflare R2 object storage, both on Cloudflare’s global network. Cloudflare processes this data on our behalf and does not use it for its own purposes.
| Company | What for | What they see |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, image storage | Everything stored, as our processor |
| Google LLC | Sign-in | That you signed in to GuidedVisual |
| Resend | Sending account email, and delivering your feedback to us | The address a message is sent to, and its contents, including attached screenshots |
| Zoho Corporation | Our mailboxes | Feedback you send and email you write to us |
That is the complete list. There is nobody else. Because these companies operate internationally, data may be processed outside India.
What your browser stores
One cookie, spotweave_session, which keeps you signed in and expires after 30 days. It is strictly necessary and there is no alternative to it if you want an account. There are no advertising or analytics cookies, so there is no cookie banner to click through.
The editor also remembers two things in your browser’s own storage, which never leave your device: whether you chose the light or dark theme, and which layer folders you had collapsed.
Your rights
Under India’s Digital Personal Data Protection Act, and under the GDPR if you are in the UK or EU, you can ask for a copy of your data, ask for it to be corrected, and ask for it to be deleted.
- Getting a copy is self-service. The dashboard has two download buttons: one for a complete archive including every image, and one for the records alone. Neither needs to be requested.
- Deleting a project removes it, its images, and its published copies, from the dashboard.
- Deleting your whole account is self-service too. The bottom of the dashboard has a Delete this account section. It removes your projects, your images, your published pages and the record of this address, immediately and permanently — including embeds running on other people’s websites, which will stop showing anything. Download a backup first; there is a link beside the button.
- If you would rather somebody did it for you, or you have lost access to the account, write to security@guidedvisual.com and it will be done within 30 days.
If you think something here has gone wrong, tell us first — but you are also entitled to complain to India’s Data Protection Board, or to your own supervisory authority if you are in the UK or EU.
Children
GuidedVisual is not intended for children under 18, and accounts should not be created for them. If you believe a child has created an account, write to security@guidedvisual.com and it will be removed.
Security
Every request for a project checks the signed-in owner on the server, so one account cannot reach another’s work. Session tokens are stored only as hashes. Uploads are checked for type, size and dimensions, and SVG files are checked for anything that could run as code. Published links use long random tokens that cannot be guessed by counting.
No system is perfectly secure. If you find a problem, please report it to security@guidedvisual.com rather than disclosing it publicly, and you will get a reply.
Changes
If this policy changes in a way that affects you, the date at the top changes and, once account email is enabled, you will be told before the change takes effect. Old versions are recorded in the project’s history.