Yes, we used AI to build this.
GDPRGard's tools were built using Claude Code, Anthropic's AI-assisted development environment. We're not hiding that — it's a quality signal, not a liability.
AI-assisted development means faster iteration and more consistent code patterns across every tool in the suite. It does not mean an AI has access to your data, your account, or anything you do on the live site. The assistant that helped write the code has no connection to the application once it's deployed — it's a development tool, the same way a code editor or a linter is a development tool.
What "running" actually means here.
Every tool in the GDPRGard suite is a static, stateless web page. There's no user account system, no central database, and no server storing your documents. When you open a tool, your browser loads a single HTML file and talks directly to Anthropic's API to process whatever you've entered or uploaded.
That's a deliberate trade-off. It's a simpler architecture than a typical SaaS platform, and it means there's no customer database that could be breached, because there isn't one.
- Claude Code wrote and reviewed the application code
- Used to design layouts, prompts, and PDF export logic
- No connection to live user sessions
- Your browser calls the Anthropic API directly per session
- No account, no login, no stored profile
- Nothing is written to a database — there isn't one
What happens when you upload something.
Say you upload a contract to ContractGuard, or photograph an invoice for InvoiceExtract. Here's the actual sequence, every time:
The one place data does briefly exist outside your browser is in transit to and from Anthropic's API, which processes the request and returns a result. We don't control Anthropic's own infrastructure, so we won't make specific claims about server regions or retention windows on their end — for that, refer to Anthropic's privacy policy directly rather than trust our summary of it.
Every third party your data could touch.
Not a generic "we use cookies" notice — here's the actual list of external services used across the suite, and why each one is there.
| Service | Used for |
|---|---|
| Anthropic API | Processes whatever you type or upload — contracts, invoices, audit answers — and returns the generated result. This is the core function of every tool. |
| Netlify | Hosts the static site files and runs a small serverless function that keeps our API key out of the page source. No customer data passes through Netlify's own storage. |
| Formspree | Receives the contact form when you explicitly request an expert review or send us an enquiry. Only triggered when you submit a form — never automatically. |
| Google Fonts | Loads the typefaces used across the site. This is a request to Google's CDN on every page load — we haven't yet self-hosted these fonts to avoid that request entirely. |
That's the complete list. No analytics trackers, no advertising pixels, no session recording tools. If that changes, this table changes with it.
What our guidance is actually built on.
We're not endorsed, certified, or partnered with any regulator — no tool on this site has that, and we wouldn't claim it if it did. What we can tell you is which published guidance specific tools are informed by, so you can go check the source yourself rather than take our word for it.
| Tool / page | Informed by |
|---|---|
| BreachNotify | EDPB guidance on personal data breach notification under Art. 33–34, and the 72-hour notification framework set out in the Regulation itself. |
| Cookie banner & consent flows | EDPB guidelines on consent under the GDPR, and the Planet49 ruling from the European Court of Justice on pre-ticked consent boxes. |
| Privacy Policy Generator | EDPB guidelines on transparency, and the Art. 13/14 information requirements set out in the Regulation. |
| GDPR Audit & Compliance Checklist | The European Commission's official GDPR resources, and the supervisory authority guidance referenced throughout this page. |
| Croatian-specific guidance | Published material from AZOP, the Croatian Personal Data Protection Agency — our supervisory authority. |
These are the bodies whose published guidance we build from — the European Data Protection Board, the European Commission, and AZOP for Croatia-specific matters. None of them have reviewed or approved GDPRGard's tools, and we don't claim otherwise.
What we don't have yet.
It would be easy to claim enterprise-grade infrastructure we don't actually run. We'd rather tell you what's genuinely missing today, so you can decide if that matters for your use case.
None of this makes the tools unsafe to try — for most SMBs running quick checks on a contract or HR document, the current architecture is appropriate. It does mean that if your organisation has strict procurement requirements around formal DPAs or EU-only data residency guarantees, you should talk to us before relying on GDPRGard for anything regulated or high-stakes.
This page is not legal advice, and neither is the rest of the site.
GDPRGard's tools generate drafts, checklists, and analysis to help you move faster on compliance tasks. They are not a substitute for a qualified lawyer or Data Protection Officer, particularly for high-stakes decisions like data breach notifications or employment contracts. Where it matters, get a human to check it.
Have a question we didn't answer?
If something on this page is unclear, or your organisation needs something we don't currently offer — a DPA, an EU-only deployment, a security questionnaire answered — just ask.
Email hello@gdprgard.eu