Privacy Policy

1. Who is responsible

The controller for the processing described here is Glerora (“we”, “us”). You can reach us about anything in this policy at hello@glerora.com.

2. Who this policy covers

• Customers - people who create a Glerora account and use the dashboard.
• Website visitors - people who visit glerora.com.
• Chat visitors - people who use a Glerora assistant embedded on one of our customers’ websites. Section 10 explains how this works; for them, our customer is responsible for the data.

3. What we collect and why

Your account

When you sign up we store your email address, a securely hashed password (if you use one), your display name, and the website you tell us about. If you sign in with Google or Microsoft, we receive your name and email address from that provider. We use this to create and secure your account, sign you in and send essential account emails such as verification codes and password resets. We don’t send marketing emails unless you have agreed to receive them. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Workspace content

We store what you add to your workspace: website addresses and the pages we crawl from them, uploaded documents, text sources, assistant settings and the indexed passages created from them. We use it only to provide the service - to answer your visitors’ questions and show you your dashboard. Legal basis: performance of a contract.

Conversations and leads

When someone chats with one of your assistants we store the messages and related details, and any contact details the visitor chooses to leave. We process this on your behalf - see section 10.

Payments

Subscriptions are paid through Stripe. Card details go directly to Stripe and never reach our servers; we keep the Stripe customer and subscription identifiers, your plan and its billing status. Legal basis: performance of a contract; legal obligations for invoices and tax (Art. 6(1)(c) GDPR).

Emails you send us

When you contact us, we keep the conversation and the details you include so we can help you and refer back to it later. Legal basis: performance of a contract, or our legitimate interest in answering you.

Security and abuse prevention

To protect the service we briefly process IP addresses to apply rate limits, and keep a log of important workspace actions (such as publishing an assistant or starting a checkout). Legal basis: legitimate interests in running a secure service (Art. 6(1)(f) GDPR).

Website analytics

On glerora.com we use Vercel Web Analytics and Speed Insights to count page views and measure loading performance. They do not use cookies and do not identify individual visitors. The chat widget on customers’ sites is excluded from these statistics. Legal basis: legitimate interests in understanding and improving our website.

Do you have to give us this data?

You don’t have to, but we need your email address and sign-in details to create an account, and payment details to provide a paid plan. Without them we can’t provide the service.

4. How assistant answers are generated

To write an answer, the assistant sends the visitor’s question, the recent conversation and the matching passages from the customer’s content to the AI provider selected for that assistant (OpenAI, Anthropic or Google). The provider processes it only to generate the reply. Glerora does not use customer content or conversations to train AI models. Customers who bring their own API key use it under their own agreement with that provider.

Glerora does not make decisions about people based solely on automated processing that have legal or similarly significant effects on them. Assistant answers are information, not decisions about you.

5. When we access or share information

We do not sell personal data, and we don’t share it for advertising. We only access or share it in these situations:

• Service providers that help us run Glerora, under data processing agreements: hosting and database, payment processing, email delivery, the AI provider that writes assistant answers, and - if you use them - Google or Microsoft sign-in.
• Support and troubleshooting: we look at a workspace’s content only when you ask us to help with it, or when needed to keep the service secure or fix a problem affecting it.
• Legal requests: we disclose data to authorities only when legally required, for example by a valid court order. Where the law allows, we tell the affected customer before disclosing.
• Protecting rights and safety: to investigate fraud or abuse of the service, or to protect our users or the public.
• Business transfers: if Glerora is sold or merged, data may pass to the new owner, who must keep honouring this policy. We will let customers know beforehand.
• With your consent, for example when you connect a webhook to send leads to another service.

6. International transfers

Your workspace data is stored in the EU. Some of our service providers process data outside the European Economic Area. For those transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

7. How long we keep data

• Account and workspace data: for as long as your account exists.
• Sources, conversations and leads: until you delete them, or until the workspace is deleted - deleting a workspace removes everything in it.
• IP addresses used for rate limiting: deleted automatically within two days.
• Payment notification records: deleted after 30 days.
• Invoices and billing records: as long as tax and commercial law requires (typically up to 10 years).

When you delete something in Glerora, it is removed from our live database right away. Our hosting provider may hold encrypted disaster-recovery copies that expire in its normal backup cycle; we never restore deleted data from them except to recover from a failure. To delete your account itself, email hello@glerora.com and we will remove it and its workspaces.

8. Cookies and browser storage

Glerora does not use advertising or tracking cookies. The dashboard keeps your sign-in session in your browser’s local storage, and the chat widget stores a random visitor identifier so a conversation can continue on the next page. Both are strictly necessary for the service to work. Because we don’t track you across other websites, “Do Not Track” and Global Privacy Control signals don’t change how Glerora behaves.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected, or your data deleted;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise these rights, email hello@glerora.com. We may ask you to confirm your identity before acting on a request, and we answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

If you live in a US state with a consumer privacy law, such as California, you have similar rights to know, access, correct and delete your personal information, and not to be discriminated against for using them. We do not sell or share personal information as those laws define it.

10. If you chatted with an assistant on another website

Our customers put Glerora assistants on their own websites. If you use one, the company running that website decides how the conversation is used and is the controller of your data; Glerora processes it on their behalf as a processor, under a data processing agreement. The company’s own privacy policy should explain this.

When you chat with an assistant, the following is stored in that company’s workspace:

• your messages and the assistant’s replies, and which sources each reply used;
• the page and website the chat was opened on, and when;
• a random visitor identifier kept in your browser, so the conversation can continue across pages;
• your name, email address and company - only if you choose to leave them.

Your IP address is used briefly to prevent abuse (section 7), and your messages are sent to an AI provider to write replies (section 4). The company keeps the conversation until it deletes it. To access or delete your data, contact that company; if you can’t reach them, write to hello@glerora.com and we will pass your request on and help them answer it.

11. Security

We protect data with encryption in transit and at rest, database-level isolation between workspaces, encrypted storage of API keys and strict access controls. See our Security page for details. If a security incident affects your personal data, we will notify you and the competent authorities as the law requires, without undue delay.

12. Children

Glerora is a business service and is not directed at children under 16.

13. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version; for material changes we will notify customers by email or in the dashboard before they take effect.