Privacy Policy

Effective from 27 October 2026

1. Data controller

The controller of personal data is [company name], company code [company code], registered address [registered address], email [contact email] (we). This policy explains what data we process when you use Glosa (the Service), why, and what rights you have.

The controller of personal data contained in manuscripts, layouts and comments is the organisation that uploaded them (e.g. a publisher), and we process it as a processor under the Data Processing Agreement.

The Service is not intended for persons under 14.

2. What data we process

• Account data: first name, last name, email address, password hash (we do not store the password itself), profile photo, two-factor authentication settings, and sign-in data from Google, Microsoft or company SSO if you chose that method.
• Organisation and project data: organisation name and logo, billing details (name, codes, address, email), member roles, project information, invitations, deadlines.
• Uploaded content: manuscripts, layouts, attached files, text extracted from them, comments, replies, style guides and dictionaries.
• AI credit and usage data: credit balance and statement, who ran an AI check and when, how many credits were used.
• Consent records: when and to which version of the terms of use, privacy policy or data processing agreement you agreed (and on behalf of which organisation), and your IP address and browser information at the time.
• Feedback: the text you submit, the address of the page where you wrote it, and browser information.
• Technical data: sign-in sessions, IP address, browser information (for session management and security), activity log, app error log (error description and page address – kept for 90 days).

3. Why we process data

• To provide the Service under a contract with you or your organisation (GDPR Art. 6(1)(b)).
• To ensure the security of accounts and data and to improve the Service based on feedback – legitimate interest (GDPR Art. 6(1)(f)).
• To send notifications about project events – this is part of the Service (GDPR Art. 6(1)(b)); you can manage them in your profile settings.
• To keep records of agreement to the documents – legitimate interest in proving that the contract was concluded and in defending legal claims (GDPR Art. 6(1)(f)).
• To meet accounting and other legal obligations (GDPR Art. 6(1)(c)).

Account data (name, email) is necessary to conclude and perform the contract – the Service cannot be used without it. We do not sell your data, use it for advertising or use it to train artificial intelligence models. We do not make automated decisions that have legal or similarly significant effects on you, and we do not carry out profiling.

4. Where data is stored

Data and uploaded files are stored on servers provided to us by [hosting provider and country]; uploaded files – Cloudflare, Inc., JAV (duomenys ES); backups – Cloudflare, Inc., JAV (duomenys ES). Uploaded files are stored encrypted. We apply technical and organisational security measures: encrypted connections (HTTPS), role-based access control, two-factor authentication, an activity log and regular backups.

5. Confidentiality of manuscripts

Uploaded manuscripts and layouts are confidential. They are visible only to users invited to the project by the project manager or an organisation administrator. Our staff can access content only when needed to solve a technical problem at your request or when required by law.

6. Artificial intelligence features

AI proofreading runs through the Claude API provided by Anthropic, PBC (USA). Data is sent to Anthropic only when you use AI features (run AI proofreading, a layout or consistency check, ask for an AI suggestion or a version change summary). In that case the text of the relevant pages (for the layout check, also images of those pages), the organisation's style guide and dictionary are transmitted. Anthropic processes this data as a processor under its commercial terms and does not use it to train models. Anthropic deletes requests and responses automatically within 30 days; longer only if required by law or when investigating a breach of its usage policies.

Typography and spelling checks run on our server – no data is transmitted. An organisation administrator can turn AI features off, in which case no data is sent to Anthropic.

7. Recipients of data

We share data only with the following processors that help us provide the Service:

• the server provider – [hosting provider and country];
• the file storage provider – Cloudflare, Inc., JAV (duomenys ES);
• the backup storage provider – Cloudflare, Inc., JAV (duomenys ES) (backups are encrypted and the provider cannot read them);
• the email delivery provider – to send notifications, invitations and sign-in links;
• Anthropic, PBC (USA) – only when AI features are used (see section 6);
• Google, Microsoft or your company's identity provider – only if you sign in through them.

If data is transferred outside the European Economic Area, we apply the safeguards provided for in Chapter V of the GDPR – standard contractual clauses approved by the European Commission or, where the recipient is certified, the Commission's adequacy decision (the EU-US Data Privacy Framework).

8. How long we keep data

• Account and project data – for as long as you use the Service.
• When an account, organisation or project is deleted, the data and files are deleted immediately; they remain in backups for no longer than 30 days.
• Read notifications are deleted after 180 days, all notifications after one year.
• The organisation can set retention periods for archived projects and the activity log itself (Settings → Organisation → Data).
• Records of agreement to the documents are kept for the duration of the contract and for 10 years after it ends (the general limitation period) – also after the account is deleted.
• Accounting documents (invoices) are kept for 10 years, as required by the Lithuanian rules on keeping accounting records.

9. Your rights under the GDPR

Under the General Data Protection Regulation (GDPR) you have the right to:

• access your personal data and obtain a copy of it;
• have inaccurate data corrected;
• have your data erased (“the right to be forgotten”) – you can also delete your account yourself;
• restrict or object to the processing of your data;
• receive your data in a structured, commonly used format and transfer it to another controller – you can also download it yourself (My account → My data);
• lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

To exercise your rights, write to [contact email]. We will reply within 30 days. For data contained in manuscripts, contact the organisation that uploaded them.

10. Cookies

We use only strictly necessary cookies – session cookies needed for signing in and security, and a cookie that remembers your chosen interface language. They are not used for tracking, analytics or advertising, so no consent is required. Interface settings (e.g. theme, completed guides) may also be stored in your browser.

11. Changes to this policy

We may update this policy. We will notify you of material changes by email or in the Service, and when you next open the Service you will be asked to review the updated version. Please also read the Terms of Use.