Privacy Notice

Privacy policy

Effective from: 20 July 2026

Last updated: 10 August 2026

Overview

This notice explains how Mister Gere Ltd ("Wardict", "we", "us", "our") collects, uses and protects your personal data when you use the Wardict service at wardict.com.

We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Wardict is intended for users in the United Kingdom only.

1. Who we are

Legal name: Mister Gere Ltd
Trading as: Wardict
Company number: 17229722 (registered in England & Wales)
Registered office: Wellingborough, England
Contact for privacy matters: privacy@wardict.com

2. What this notice covers

This notice covers personal data we collect through the Wardict website, account creation, the AI-generated verdict service, paid products (Full Report and Pro Annual), the Evidence Locker, founder-published demand-test pages (including the email addresses of visitors who use them), our own site analytics, self-reported outcome tracking, human review of a sample of verdicts, the referral programme and any related communications.

It also covers Wardict for VC funds: the enquiry form on our funds page, which anyone can submit without an account, and the private fund workspace, where an investment team uploads material about a company and records its reasoning. Section 5 sets out what we collect in each case, and section 7 names every processor that sees it.

It applies both to account-holders and to visitors of founder-published pages (see section 3).

Wardict is offered to account-holders located in the United Kingdom only. If you access the account service from outside the UK, please do not submit personal data. We may decline to provide the service. Founder-published pages are public and may be viewed and submitted to by visitors anywhere; section 3 explains how we handle their data.

3. Founder-published pages and their visitors

Some Wardict account-holders (we call them founders) use our tools to publish a public web page that tests demand for a business idea before they build it. These pages appear at an address like wardict.com/test/<name>, are generated with AI, and carry a "Hosted by Wardict" note in the footer. Wardict (Mister Gere Ltd) hosts these pages and stores what is collected through them on the founder's behalf. The founder is an independent person or business, not part of Wardict.

This section is for visitors to those pages, in particular anyone who enters their email address into one. Because these pages are public, they may be viewed and used by visitors anywhere, so this section is not limited to visitors in the United Kingdom.

What we collect when you use a founder's page

Your email address

If you submit the interest form on a founder’s page, we store the email address you enter (and a normalised copy used only to avoid duplicates) so the founder can see who registered interest and follow up.

Visit and conversion signals

We count page views and form submissions using a hashed visitor identifier rather than storing your identity, so the founder can measure interest in the idea.

Traffic-source data

If you arrived through a link carrying campaign tags (for example utm_source, utm_medium, utm_campaign), we record them so the founder can see which channel you came from.

Submitting the form registers interest only. It is not an order, and no payment is taken.

Who is responsible for your data

The founder decides why they collect your email and what they do with it (including whether and how they contact you), so the founder is responsible for that use, and for any marketing they send you, as the controller of your email address. Wardict provides and hosts the page, stores the data on the founder's behalf, and uses aggregated, hashed interest signals to run and improve our own service. For anything about data collected through a founder's page, email privacy@wardict.com and we will help, or put you in touch with the founder.

Our lawful basis

We and the founder rely on legitimate interests (Article 6(1)(f) UK GDPR) to record and measure interest in an idea that has not launched. The founder is responsible for having a lawful basis for any later marketing they send you.

How long we keep it

We keep a lead email for no longer than 24 months, and only while the founder's page and Wardict account remain active. It is deleted when the founder deletes the page or closes their Wardict account, when it reaches the 24-month limit (we run an automated purge), or sooner if you ask us to erase it (see below).

Your rights

You have the same rights set out in "Your rights" below, including the right to ask for a copy of the email we hold about you, to have it erased, or to object to its use. The quickest way to erase your email is our self-serve tool at wardict.com/erase: enter your address, follow the link we email you, and we remove your data from every founder page. You can also email privacy@wardict.com (tell us which page you visited if you can) and we will action your request and pass it to the founder, or complain to the Information Commissioner's Office (ico.org.uk). The "Privacy" link shown beside the form on a founder's page brings you here.

4. Age restriction

Wardict is for users aged 16 or over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please email privacy@wardict.com and we will delete it.

5. Personal data we collect

We only collect the personal data we need to run the service. The categories are:

Account data

Email address, display name, profile picture (from your sign-in provider), hashed password (for email sign-in), a device fingerprint used for abuse prevention.

Submitted content

The business idea text you submit for analysis, plus any optional clarifying answers you provide.

Case evidence you add

Free-text notes and evidence you optionally save to a case in the Evidence Locker (for example interview, pricing or sales notes). This may include personal data about third parties you choose to enter, so only add what you have a basis to.

Service output

The AI-generated verdict, score, and any associated analysis we produce for you. Saved verdicts are stored in your Evidence Locker.

Founder-page visitor data

If you publish a demand-test page, the visitor emails, hashed view/conversion signals and campaign (UTM) tags collected through it. If you are a visitor to such a page, section 3 explains how we handle your data.

Self-reported outcomes

If you tell us what happened to an idea (for example its stage, an approximate revenue or funding band, and free-text notes), we store it to follow the idea’s progress and calibrate our methodology.

Payment data

Billing email, Stripe customer ID, transaction records (amount, currency, status, timestamps). We do not see or store your full card number or CVC. Stripe handles those directly.

Usage / analytics data

De-identified behavioural events (e.g. "verdict_submitted", "checkout_initiated"), with high-level attributes such as input length and verdict score. Sent to PostHog (EU data centre). No name, email or idea text is sent.

First-party analytics & telemetry

Separately from PostHog, we store in our own database a per-visit record (a device fingerprint, session identifier, page path, referrer and any first-touch campaign tags) and per-verdict technical telemetry such as input length and processing cost. Any free-text feedback you give on a verdict may be read by a human reviewer (see section 12).

Local browser storage

A referral code if you arrived via an invite link, cached verdict results, a session identifier, and Full Report access flags.

Referral data

Your personal referral code, the relationship between referrer and referred user, and report-unlock counts.

Marketing preferences

Whether you have opted in to receive Warden Briefings, the version of the consent wording you saw, and a log of every opt-in or opt-out so we can evidence your choice. Only collected if you tick the marketing checkbox at signup or change your preference later.

Fund enquiry data

If you use the enquiry form on our funds page, we store the fund name, the contact name you give, your work email, the assets-under-management band you select, any note you write and your browser’s user-agent string. The form is public and needs no account, so we hold this whether or not you become a customer. The note field is free text and asks you to leave out anything confidential, because it reaches us as a business enquiry rather than as case material.

Fund workspace membership

For each fund workspace, the email address, name and role of everyone invited to it, including invitations nobody has taken up yet. Every member of that fund can see this list.

Fund case material

Everything an investment team files against a case in a fund workspace: uploaded documents (decks, memos and similar) held in a private, fund-scoped store, pasted meeting notes, and the claims, evidence, diligence questions, IC briefs, decisions and reviews the team records. This material is about a third-party company and routinely contains personal data about people who are not Wardict users, such as its founders and staff, so only upload what you have a lawful basis to share.

Communications

Records of emails you send us, including any data-subject requests.

6. Why we use it and our lawful basis

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

Performance of a contract (Art. 6(1)(b))

Creating and operating your account, generating verdicts, delivering paid features (Full Report, Pro Annual), running the Evidence Locker, processing payments via Stripe, and running a fund workspace for the fund that asked us to open one.

Legitimate interests (Art. 6(1)(f))

Operating a cross-user verdict cache (normalised hashes and embeddings) so we can serve faster, cheaper results; preventing abuse and fraud (rate-limiting, device fingerprint); keeping the service secure and free of bots; replying to a fund enquiry and keeping a record of that correspondence; and holding the case material a fund files, on that fund’s instructions, where it concerns people who are not our users.

Consent (Art. 6(1)(a))

Non-essential analytics cookies (PostHog), and sending you Warden Briefings: our marketing emails containing startup verdicts, validation tips, product updates, and occasional offers. You only receive Warden Briefings if you ticked the marketing checkbox at signup or opted in later from your account settings. You can withdraw consent at any time using the unsubscribe link in any Warden Briefing, from your account settings, or by emailing us at privacy@wardict.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Legal obligation (Art. 6(1)(c))

Retaining payment records for accounting and tax purposes under UK law.

Our legitimate-interests assessment for the verdict cache concluded that the privacy impact is low (we cache derivative outputs and embeddings keyed by normalised hashes, not by user identity), and that the benefit to all users (faster, lower-cost service) outweighs that impact. You can request more detail at any time.

7. Who we share your data with

We do not sell your personal data. We share it only with the service providers (data processors) we need to run Wardict. Each operates under a written data-processing agreement.

Supabase Inc.

Database, authentication, edge functions and storage, including the private, fund-scoped store that holds documents uploaded to a fund workspace. Hosting region: EU / UK where available.

Google LLC (Gemini API)

AI processing of your submitted idea to produce the verdict, and generating landing-page and advertising images from your brief (model gemini-3-pro-image). For a fund workspace, the text of the case material a fund files (deck text, pasted notes, memos and the claims recorded against them) is sent to the same API to produce the claim ledger, the Warden’s challenge, the diligence questions and the IC brief. We route requests through a server-side proxy so your data reaches Google only as needed. Google is an independent processor here: we make no promise on Google’s behalf about how long it holds a request or whether it is used for training, and you should read Google’s own terms for the Gemini API if that matters to your fund.

Google LLC (OAuth)

Optional "Sign in with Google" authentication, if you choose it.

Stripe Payments Europe Ltd

Payment processing for the Full Report and Pro Annual products.

PostHog Inc.

Product analytics. We use the EU instance at eu.i.posthog.com and do not pass your name, email or idea text.

Resend (Resend, Inc.)

Email delivery. Receives your email address and name to send transactional emails (such as the welcome email) and, where you have opted in, marketing or outcome follow-up emails. US-based.

Netlify, Inc.

Website hosting and content delivery. Processes connection data (such as IP address and browser user-agent) for all site and founder-page traffic. US-based.

Google LLC (Google Fonts)

Serves the fonts used across our pages, including founder pages. Your browser fetches them from Google on page load, which sends Google your IP address and user-agent. This is not controlled by the cookie banner.

Google LLC (feedback intake)

When you send us in-product feedback, your message and any contact detail you include are delivered to a Google Apps Script endpoint (backed by Google Sheets) we use to receive feedback.

We may also share personal data with our professional advisers (lawyers, accountants), or with law enforcement and regulators where we are required to do so by law.

8. International transfers

Some of our processors (notably Google, Stripe, PostHog, Resend and Netlify) are based outside the UK or may transfer data to other countries. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision recognised by the UK government, as appropriate.

You can request a copy of the safeguards we use by emailing privacy@wardict.com.

9. Cookies and similar technologies

We use a small number of cookies and browser-storage items. We classify them as either essential (needed for the service to work) or non-essential (only loaded with your consent).

Essential

Supabase auth session

Keeps you signed in. Expires when you sign out or after your session ends.

wardict_referral_code

Stores a referral code you arrived with, until you sign up.

wardict_referral_registered

Flag noting that a referral has been registered against your account.

wardict_pilot_<hash>

Records that you have access to a Full Report for a specific verdict.

Cached verdicts

Stores recent verdict results so the page survives a refresh.

wardict_session_id

Anonymous session identifier used to de-duplicate events within a browsing session.

Non-essential (analytics)

PostHog analytics cookies

De-identified product analytics, set only after you accept analytics in the cookie banner. EU data centre.

You can withdraw consent at any time by clearing cookies for our site or by emailing us. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

10. How long we keep your data

Account, profile, verdict history, referrals

For as long as your account is active, then deleted within 30 days of account closure.

Self-reported outcomes and Evidence Locker case evidence

For as long as your account is active, then deleted within 30 days of account closure.

Founder-page visitor leads & signals

No longer than 24 months, and only while the founder’s page and account are active. Deleted on page or account deletion, by an automated purge at the 24-month limit, or sooner on a visitor’s erasure request via wardict.com/erase (see section 3).

First-party analytics & verdict telemetry

Retained for our own analysis and abuse prevention. Because these records are not tied to your account identity, closing your account does not by itself remove them.

Human-review records (sampled verdicts, feedback)

Held in anonymised form for quality and calibration; they carry no account identity.

Fund enquiries

No longer than 24 months from the date you send the enquiry, then deleted. We will delete one sooner on request: email privacy@wardict.com from the address you used.

Fund workspace membership, case material and documents

For as long as the fund workspace is open. A fund admin can remove a document from a case, or withdraw a person’s access, at any time. We delete a workspace and everything in it, including the files in the private store, within 30 days of the fund asking us to close it.

Payment records (Stripe, invoices)

7 years from the end of the relevant accounting period, as required by UK tax law.

Analytics events (PostHog)

12 months from collection, then automatically purged.

Verdict cache (normalised hashes & embeddings)

Retained while it serves requests. Contains no direct identifier linking entries back to you.

Communications (emails)

3 years from the last contact, unless we need to keep them longer for a legal claim.

Marketing-consent records (opt-ins, opt-outs, wording version)

For the lifetime of your account plus 7 years after closure, so we can evidence your past choices if challenged. Kept separately from the rest of your profile so a deletion request can be honoured without erasing the audit trail required to defend prior sends.

11. Your rights

Under the UK GDPR you have the right to:

access the personal data we hold about you
have inaccurate data corrected
have your data erased (the "right to be forgotten")
restrict how we process your data
receive a copy of your data in a portable format
object to processing based on legitimate interests
withdraw consent at any time (where consent is the lawful basis)
complain to the Information Commissioner's Office

To exercise any of these rights, email privacy@wardict.com. We will respond within 30 days. We may ask you to verify your identity first. There is no charge for a reasonable request.

If you are not satisfied with our response, you can complain to the ICO: ico.org.uk, helpline 0303 123 1113.

12. Automated decision-making and profiling

The verdict is generated by an AI model (Google Gemini) at your request. It is not used to make any decision producing legal effects on you or similarly significantly affecting you (Article 22 UK GDPR). You initiate each verdict, you can ignore the result, and we do not use the verdict to evaluate you for credit, employment, insurance, housing or anything similar.

The verdict is an AI-generated opinion. It may be inaccurate, incomplete or biased. You should not rely on it as professional advice. See our Terms of Service for the full disclaimer.

To check and improve quality, a sample of verdicts may be reviewed by human expert panellists. A reviewer may see the idea text you submitted and any feedback you send us about a verdict, but not your name or account identity, which are removed before review. We do this on the basis of our legitimate interest in calibrating and improving the service.

The same applies in a fund workspace. The claim ledger, the challenge, the diligence questions and the IC brief are AI-generated readings of the material a fund has filed, produced at the fund's request. Wardict does not decide whether to invest, does not rank companies and does not score the people involved: the investment committee takes the decision, and the record it keeps is the one it wrote itself.

13. Security

We protect your data with measures including:

TLS encryption in transit between your browser and our servers
Database row-level security so users can only access their own data
PCI-DSS-compliant card handling through Stripe (we never see your card number)
Server-side proxying of the Gemini API key so it is never shipped to the browser
Restricted CORS allow-lists on our edge functions
Rate limiting and abuse prevention on verdict submissions

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify you and the ICO as required by law (within 72 hours where applicable).

14. Changes to this notice

We may update this notice from time to time. If we make a material change, we will let you know by email and through an in-app notice before the change takes effect. Non-material changes will be reflected in the "Last updated" date at the top of this page. We encourage you to review this notice periodically.

15. Contact us

Questions, complaints, or to exercise your rights: email privacy@wardict.com.

Terms Pricing Home