Privacy notice
Effective September 16, 2026 · GaugeWright LLC
Scope and roles
This notice covers GaugeWright websites, GaugeDesk, GaugeWright Hub, Vend, and related support and commercial interactions. GaugeWright is the controller for account, website, support, and business-contact data. When a customer uses a hosted service to process its own data, the customer is the controller and GaugeWright acts as its processor under the applicable agreement.
Data we process
We may process account identifiers, authentication and tenant membership, billing and business-contact details, support communications, security and audit events, service telemetry, IP address and device/browser information, and the content a customer intentionally supplies to a hosted workspace. Local-only GaugeDesk workspace content remains on the user's device except when the user enables a hosted, relay, federation, model-provider, or support flow.
Why we process it
We use data to provide and secure the service, authenticate users, administer accounts and billing, respond to requests, diagnose failures, prevent abuse, comply with law, and improve reliability. We do not sell personal data or use customer workspace content for advertising.
Legal bases and retention
Depending on context, processing is necessary to perform a contract, pursue legitimate interests in operating and securing the service, comply with law, or act on consent. We keep data only as long as needed for those purposes, contractual commitments, security, dispute resolution, and legal obligations. Customers can export or erase supported workspace data; residual encrypted backups age out under the backup lifecycle.
Sharing and international processing
We disclose data only to personnel and service providers that need it for the purposes above, to a customer-selected model or identity provider, during a corporate transaction subject to appropriate safeguards, or when required by law. Our current service providers are listed on the subprocessor page. Data may be processed outside the user's jurisdiction; where required, we use contractual transfer safeguards.
Security
We use access control, encryption in transit, encrypted managed secret storage, audit logging, isolation controls, vulnerability scanning, backups, and incident procedures appropriate to the service. No system is risk-free. See the security center and current security questionnaire for detailed status.
Cookies and local storage
We use no advertising cookies, no cross-site tracking, and no cookie-based analytics. Our website analytics is Cloudflare Web Analytics, which sets no cookie, writes nothing to your browser's storage, and does not identify individual visitors. There is no consent banner on this site because there is nothing non-essential to consent to; what we do store is listed here in full.
| Name | Kind | Purpose | Lifetime | Strictly necessary |
|---|---|---|---|---|
| Account session | Cookie (first party) | Keeps you signed in across GaugeWright services. Set only after you sign in; scoped to .gaugewright.com, Secure, HttpOnly, SameSite=Lax. | The session; cleared on sign-out | Yes |
gw_session_hint | Cookie (first party) | Tells this website that the browser already has a session, so the navigation offers your account rather than a sign-in prompt. Carries no identifier. | The session | Yes |
| Release cache | sessionStorage (first party) | Holds the current GaugeDesk release details on the download page so the page does not re-fetch them as you navigate. | The browser tab | Functional |
| Turnstile | Cookie (Cloudflare) | Distinguishes people from automated abuse on forms. Set only when a form challenge runs. | Short-lived, set by Cloudflare | Yes |
A browser that is not signed in and submits no form carries none of these.
Third-party embeds
No third party that is not strictly necessary loads on a public page before you ask for it. The consultation page's scheduler runs on Google Calendar, so we show a placeholder in its place and connect to Google only when you choose to load it — at which point Google receives your IP address and sets its own cookies under its own privacy policy. That choice applies to that visit and is not recorded anywhere; returning to the page shows the placeholder again, so withdrawing it needs no action beyond declining to load it. The booking page can also be opened directly in a new tab, or a time arranged by email, without loading the embed at all.
Webfonts and other static assets are served from our own origin rather than fetched from a third party, so visiting a page discloses your address to no one but us.
Your choices and requests
Subject to applicable law, a person may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent. Email Jack@GaugeWright.com. We verify the requester's identity and authority before disclosing or changing data. Customers should first direct requests about customer-controlled workspace data to that customer.
Children and changes
The services are not directed to children under 13. We may revise this notice as services or law change; the effective date above identifies the current version.
Contact
GaugeWright LLC · Privacy and security requests: Jack@GaugeWright.com.