Gloseva

Privacy Policy

Effective date: April 12, 2026

Introduction

Gloseva ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Gloseva platform, website (https://gloseva.com), and related services (the "Service").

This policy applies to all users worldwide. Specific sections address rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws.

1. Data Controller

Gloseva is the data controller for personal data processed through the Service. For questions about this policy or your data, contact us:

2. Paddle — Payment Data Processor

Payments for the Service are processed by Paddle.com Market Limited (for customers outside the US) or Paddle.com Inc. (for US customers), acting as our Merchant of Record. When you make a purchase, Paddle collects and processes your payment information (including payment card details, billing address, and transaction history) directly. We do not store or have access to your full payment card details.

Paddle processes payment data in accordance with their own Privacy Policy. We receive limited billing data from Paddle (such as transaction IDs, plan information, and subscription status) to manage your account.

3. Personal Data We Collect

We collect the following categories of personal data:

a) Account Data

  • Name, email address, and password (hashed)
  • Profile information you choose to provide
  • Organization or company name (if applicable)

b) Billing Data (via Paddle)

  • Transaction IDs, subscription plan, and billing cycle
  • Country of residence (for tax calculation by Paddle)
  • We do not receive or store full payment card numbers

c) Usage Data

  • Credit consumption, Agent configurations, interaction logs
  • Feature usage, API calls, and session activity

d) Technical Data

  • IP address, browser type and version, operating system
  • Device identifiers, time zone, and language preferences
  • Referring URLs and pages visited

e) Communication Data

  • Support requests, emails, and feedback you send us

f) Customer Data (processed on your behalf)

  • Data your end-users provide when interacting with your Agents
  • You are the data controller for this data; we act as your data processor

4. How We Use Your Data

  • Provide and maintain the Service — account management, billing, Agent execution, credit tracking
  • Improve the Service — analytics, performance monitoring, feature development (using aggregated or anonymized data where possible)
  • Security and fraud prevention — detecting and preventing unauthorized access, abuse, or fraudulent activity
  • Communicate with you — service updates, security alerts, support responses, and (with your consent) marketing communications
  • Legal compliance — fulfilling legal obligations, responding to lawful requests, and enforcing our Terms of Service

We do not sell your personal data. We do not use Customer Data to train AI models without your explicit consent.

5. Legal Bases for Processing (GDPR)

For users in the EU/UK/EEA, we process personal data based on the following legal grounds:

  • Contract performance (Art. 6(1)(b)) — to provide the Service and manage your account
  • Legitimate interests (Art. 6(1)(f)) — to improve the Service, ensure security, and prevent fraud, balanced against your rights
  • Consent (Art. 6(1)(a)) — for optional marketing communications and non-essential cookies (you may withdraw consent at any time)
  • Legal obligation (Art. 6(1)(c)) — to comply with applicable laws, tax requirements, and regulatory obligations

6. Data Sharing and Disclosure

We share personal data only as follows:

  • Paddle — payment processing, invoicing, tax compliance (as Merchant of Record)
  • LLM Providers — interaction data sent to AI models for processing (e.g., OpenAI, Anthropic, Google). When you use your own API keys, data flows directly under your agreement with the provider
  • Infrastructure providers — cloud hosting (data processing agreements in place)
  • Analytics providers — aggregated usage data for Service improvement
  • Legal authorities — when required by law, subpoena, or court order, or to protect our rights, safety, or property
  • Business transfer — in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity (we will notify you)

All third-party processors are bound by data processing agreements and are required to protect your data in accordance with applicable law.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. For transfers from the EU/UK/EEA, we rely on:

  • EU-US Data Privacy Framework (where applicable)
  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions of the European Commission

You may request a copy of the applicable transfer safeguards by contacting us at info@gloseva.com.

8. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy:

  • Account data — retained while your account is active, plus 30 days after deletion request for technical processing
  • Billing records — retained as required by tax and financial regulations (typically 7 years)
  • Usage/technical data — retained for up to 24 months, then aggregated or deleted
  • Communication data — retained for 3 years for support quality and legal purposes
  • Customer Data (end-user interactions) — retained in accordance with your Agent configuration settings; you may delete this data at any time through the dashboard

9. Your Rights (GDPR — EU/UK/EEA)

If you are located in the EU, UK, or EEA, you have the following rights under GDPR:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate or incomplete data
  • Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention requirements
  • Restriction — request restriction of processing in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests or direct marketing
  • Withdraw consent — withdraw any previously given consent at any time

To exercise these rights, email us at info@gloseva.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

10. Your Rights (CCPA/CPRA — California)

If you are a California resident, the CCPA/CPRA grants you the following additional rights:

  • Right to Know — request disclosure of the categories and specific pieces of personal information we collect, use, and disclose
  • Right to Delete — request deletion of your personal information, subject to certain exceptions
  • Right to Correct — request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing — we do not sell or share your personal information for cross-context behavioral advertising
  • Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights
  • Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information for purposes other than providing the Service

To exercise these rights, contact us at info@gloseva.com. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

11. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making that produces legal effects or similarly significant effects on you (within the meaning of GDPR Article 22). Our AI features are tools that you configure and control; any decision-making by your Agents is your responsibility, not ours.

We may use aggregated and anonymized usage data for internal analytics (e.g., identifying usage patterns to improve the Service), but this does not constitute profiling that affects individual users.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33)
  • Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms
  • Provide details of the breach, its likely consequences, and the measures taken or proposed to address it

13. Security

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, regular security assessments, and secure software development practices. However, no method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

14. Children's Privacy

The Service is not directed to individuals under 16 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at info@gloseva.com.

15. Cookies and Tracking Technologies

We use cookies and similar technologies as described in our Cookie Policy. Essential cookies are required for the Service to function. Non-essential cookies (analytics, preferences) require your consent in jurisdictions that mandate it (e.g., EU/UK).

16. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with any personal data.

17. Marketing and Communication Preferences

We may send you marketing communications about new features, promotions, or updates, but only if you have opted in or where permitted by applicable law (e.g., soft opt-in for existing customers). You may opt out at any time by clicking "unsubscribe" in any email or by contacting us. Opting out of marketing does not affect service-related communications (e.g., billing alerts, security notices).

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least thirty (30) days before they take effect, via email or a prominent notice on the Service. The "Effective date" at the top indicates when the policy was last revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

19. Contact Us

If you have questions, concerns, or wish to exercise your data protection rights, contact us:

If you are in the EU/UK/EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

    Privacy Policy — GLOSEVA