Yes, we used AI to build this.
GDPRGard's tools were built using Claude Code, Anthropic's AI-assisted development environment. We're not hiding that — it's a quality signal, not a liability.
AI-assisted development means faster iteration and more consistent code patterns across every tool in the suite. It does not mean an AI has access to your data, your account, or anything you do on the live site. The assistant that helped write the code has no connection to the application once it's deployed — it's a development tool, the same way a code editor or a linter is a development tool.
What "running" actually means here.
Every tool in the GDPRGard suite is a static, stateless web page. There's no password-based account system and no server storing your documents. The only data we keep is minimal: aggregate click totals (no personal data) and, for the paid AI tools, an access code with a credit balance tied to a one-way hash of your email. When you open a tool, your browser loads a single HTML file and talks directly to Anthropic's API to process whatever you've entered or uploaded.
That's a deliberate trade-off. It's a simpler architecture than a typical SaaS platform, and it means there's no store of customer documents that could be breached, because there isn't one.
- Claude Code wrote and reviewed the application code
- Used to design layouts, prompts, and PDF export logic
- No connection to live user sessions
- Your browser calls the Anthropic API directly per session
- No password login and no stored profile
- Your documents are never written to a database or any other storage
What happens when you upload something.
Say you upload a contract to ContractGuard, or photograph an invoice for InvoiceExtract. Here's the actual sequence, every time:
The one place data does briefly exist outside your browser is in transit to and from Anthropic's API, which processes the request and returns a result. We don't control Anthropic's own infrastructure, so we won't make specific claims about server regions or retention windows on their end — for that, refer to Anthropic's privacy policy directly rather than trust our summary of it.
Every third party your data could touch.
Not a generic "we use cookies" notice — here's the actual list of external services used across the suite, and why each one is there.
| Service | Used for |
|---|---|
| Anthropic API | Processes whatever you type or upload — contracts, invoices, audit answers — and returns the generated result. This is the core function of every tool. |
| Netlify | Hosts the static site files and runs a small serverless function that keeps our API key out of the page source. No customer data passes through Netlify's own storage. It also provides aggregate, cookieless traffic statistics (page views, page-load timing). |
| Formspree | Receives the contact form when you explicitly request our services or send us an enquiry. Only triggered when you submit a form — never automatically. |
| Stripe | Hosts the checkout and processes your payment when you buy an eBook or toolkit. We never see or store your card details. |
| Resend | Sends the delivery email with your download link, or your AI-tool access code, to the address you gave. |
| Supabase | Stores anonymous daily click totals from the optional Analytics setting (London region, no personal data). |
| Google AdSense / Funding Choices | Serves and personalises ads on the site, and measures campaign effectiveness. Only ever loaded once you accept Marketing cookies in the banner — triggered by your consent, never by default. |
| Meta Pixel | Measures whether our Facebook and Instagram ads lead to visits and purchases. Only ever loaded once you accept Marketing cookies in the banner — triggered by your consent, never by default. |
That's the complete list. No third-party analytics trackers and no session recording tools. The only analytics is an optional, cookieless first-party click counter (aggregate counts, no personal data) that runs only if you switch on Analytics in the cookie banner. The two advertising tools (Google AdSense and the Meta Pixel) only ever load once you've opted into Marketing cookies yourself. If that changes, this table changes with it.
What our guidance is actually built on.
We're not endorsed, certified, or partnered with any regulator — no tool on this site has that, and we wouldn't claim it if it did. What we can tell you is which published guidance specific tools are informed by, so you can go check the source yourself rather than take our word for it.
| Tool / page | Informed by |
|---|---|
| BreachNotify | EDPB guidance on personal data breach notification under Art. 33–34, and the 72-hour notification framework set out in the Regulation itself. |
| Cookie banner & consent flows | EDPB guidelines on consent under the GDPR, and the Planet49 ruling from the European Court of Justice on pre-ticked consent boxes. |
| Privacy Policy Generator | EDPB guidelines on transparency, and the Art. 13/14 information requirements set out in the Regulation. |
| GDPR Audit & Compliance Checklist | The European Commission's official GDPR resources, and the supervisory authority guidance referenced throughout this page. |
| Croatian-specific guidance | Published material from AZOP, the Croatian Personal Data Protection Agency — our supervisory authority. |
These are the bodies whose published guidance we build from — the European Data Protection Board, the European Commission, and AZOP for Croatia-specific matters. None of them have reviewed or approved GDPRGard's tools, and we don't claim otherwise.
What we don't have yet.
It would be easy to claim enterprise-grade infrastructure we don't actually run. We'd rather tell you what's genuinely missing today, so you can decide if that matters for your use case.
None of this makes the tools unsafe to try — for most SMBs running quick checks on a contract or HR document, the current architecture is appropriate. It does mean that if your organisation has strict procurement requirements around formal DPAs or EU-only data residency guarantees, you should talk to us before relying on GDPRGard for anything regulated or high-stakes.
This page is not legal advice, and neither is the rest of the site.
GDPRGard's tools generate drafts, checklists, and analysis to help you move faster on compliance tasks. They are not a substitute for a qualified lawyer or Data Protection Officer, particularly for high-stakes decisions like data breach notifications or employment contracts. Where it matters, get a human to check it.
Have a question we didn't answer?
If something on this page is unclear, or your organisation needs something we don't currently offer — a DPA, an EU-only deployment, a security questionnaire answered — just ask.
Email hello@gdprgard.eu