Privacy notice

Glossy Data (entity details to be published) is the controller of your personal data. Company number and registered office: entity details to be published.

For anything about privacy, email hello@glossydata.com.

If you're an agency client whose data an agency has added to Glossy Data, the agency is the controller and we act as its processor. See our data processing agreement.

• Account details: your name, email address and sign-in information.
• Business details: your business name, website, address or town, trade, and any competitors you add.
• Tracked questions: the questions you ask us to track, and the locations they're asked from.
• AI answers: the answers AI engines give to those questions. These can name other businesses and sometimes people, such as sole traders.
• Billing: your plan, invoices and billing address. Stripe handles payments. We never see your full card number.
• Free check leads: the email address you give us, the business you checked, and your marketing choice exactly as you gave it, with the date.
• Usage analytics: simple first-party counts of page views and actions. These use an identifier made by hashing with a salt that changes every day, so we can't link your visits across days or back to you.
• Messages: anything you send us by email.

• We don't store IP addresses. To stop abuse of the free check we keep a salted, one-way hash of an IP address for up to 48 hours (it can't be turned back into the address), then delete it. Rate limiting otherwise happens in memory.
• We don't sell personal data, or share it for advertising.
• We don't use advertising trackers or third-party analytics cookies. See our cookie policy.

We only send marketing emails if you opt in. We confirm your opt-in by email first (double opt-in). Every marketing email has a one-click unsubscribe link.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see “Your rights” below).

We use these service providers (processors) to run the service. Each has a contract with us that limits how they can use data.

Consumer ChatGPT and Google AI answers are collected through DataForSEO, so we don't send your questions to OpenAI or Google for them, and we never send them your personal data. Integrations you connect yourself (such as your identity provider for SSO) receive data on your instructions; they are your providers, not our sub-processors.

We may also share data if the law requires it, or with professional advisers, or as part of selling or reorganising our business. If that happens, this notice will continue to protect your data.

Some providers are based in, or access data from, the US and other countries outside the UK.

When we transfer data outside the UK, we use a recognised safeguard. That means the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for details of these safeguards at hello@glossydata.com.

Draft: these retention periods are proposals and will be confirmed before launch.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have it corrected if it's wrong;
• have it erased;
• restrict how we use it;
• object to our use of it, including for marketing;
• receive it in a portable format;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email hello@glossydata.com. We'll reply within one month. It's free.

If an AI answer we've stored mentions you and you'd like it removed, email hello@glossydata.com and we'll look at it promptly.

If you're unhappy, please send us a written complaint by email to hello@glossydata.com first. We reply in writing and will try to put it right.

You can also complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

We encrypt data in transit and at rest, and limit staff access to what's needed. No system is perfectly secure, but we'll tell you and the ICO promptly if a breach puts your data at risk.

Glossy Data is a business service and isn't meant for anyone under 18. We don't knowingly collect children's data.

We'll update this notice when our practices change, and change the date at the top. If a change matters, we'll email account holders before it takes effect.