Privacy Policy

1. Who is responsible for your data

Your organization decides how it uses Glassa, so it is the controller of the content in its workspace: messages, files, meetings and notes, work items, team mail, its people directory, and what its AI teammates do. easyloops Ltd processes that content for your organization, on its instructions, under our Data Processing Agreement. Questions about it, and requests to see or delete it, go first to your organization.

easyloops Ltd is the controller of:

• your account, and how you sign in;
• our security logs and records of sign-ins;
• billing, if your organization pays us;
• messages you send us;
• our own marketing about Glassa;
• visits to glassa.ai.

2. Google user data

If you sign in with Google, we ask Google only for the basic sign-in scopes: openid, email and profile.

• Which data we take: your name, email address, and profile photo (if your Google account has one), and your Google account ID, so we recognise you the next time you sign in. We never see your Google password, and we can't read your Gmail, Drive, contacts or calendar.
• Why we use it: only to sign you in to Glassa, confirm your work email address, and show your name and photo to the people in your organization.
• Never sold or used for ads: we never sell it, never use it for advertising or tracking, and never pass it to anyone for their own purposes or to train generalized AI models.
• How long it is kept: for as long as your Glassa account exists. When your account is deleted, the link to your Google account and the profile details from it are deleted too.
• How to delete it: email hello@easyloops.ltd from your account's address, or ask your organization's administrator. We act on it within one month. You can also remove Glassa's access at any time in your Google Account's security settings.

Glassa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. What we collect

• Your account: your name, work email address and profile photo; how you sign in (a hashed password, or the link to your Google account); and your membership and role in your organization.
• Your work in Glassa: messages, threads, reactions, voice notes and files; meeting transcripts and notes; objectives, work items, standups and logbooks; the team mail you send and receive; and your organization's directory.
• AI teammates: what a teammate does in your workspace, such as its messages, its work and the audit log of its actions, is kept like any member's work.
• Notifications: if you turn on notifications, your device's push token and platform.
• Security data: your sign-in sessions, records of your sign-ins, and the service logs (such as IP address, browser and time) that keep accounts and workspaces safe.
• When you write to us: your message and your contact details.
• Visits to glassa.ai: Cloudflare, which serves the site, receives your IP address and browser details with each request.

We have put no analytics or advertising code in glassa.ai or the Glassa apps, and we have turned on neither Cloudflare's Web Analytics nor its bot management for glassa.ai. We don't use advertising identifiers or cross-site tracking, and we never sell or rent personal data or workspace content.

4. AI in Glassa

• Summaries: AI writes a meeting's notes from its transcript, and your Logbook, a summary of your own work that only you see. Both are written on Microsoft Azure.
• Speech to text: a speech-to-text service turns the audio of meetings and dictated notes into text. Which service depends on the language; our sub-processor list names each one.
• AI teammates: a teammate is an AI agent your organization hires to work in its workspace. Glassa shows it as AI in the people directory and on its profile. It acts on your organization's behalf, within the access your organization gives it, and records what it does in an audit log your organization can review.

Today a teammate runs in the Glassa desktop app, on the computer of the member who hires it, and works through the AI model account that member connects to it, such as their own ChatGPT account. What the teammate sends that account is handled by its provider under the member's or your organization's own agreement with it, not by us. The teammate keeps its working files on that computer. Apart from its audit log and the work it does in your workspace, which come to Glassa, we have no access to them.

When you talk to a teammate by voice, your browser's own speech recognition may turn what you say into text. Some browsers, such as Chrome, do this by sending your voice to their maker.

We do not use your personal data, or anything in your organization's workspace, to train AI models. Glassa makes no decision about you based only on automated processing that has a legal or similarly significant effect on you. What AI writes in Glassa is there for people to read and check.

5. Meetings and calls

Glassa does not record the audio or video of calls. When someone turns on notes in a meeting, Glassa shows that notes are on, and what is said is sent to a speech-to-text service as people speak. For some languages, the audio is also kept in a temporary file on our server during the meeting, so that the speakers can be told apart afterwards, and then deleted. AI then writes the notes from the transcript.

• The transcript is deleted 3 years after the meeting. The notes stay in your organization's workspace until it deletes them.
• Whoever turns on notes, or brings a teammate into a call, must tell everyone there, guests included, as our Acceptable Use Policy requires. If you are a guest and object, tell the person who invited you, or write to us.
• Voice notes you send in chat are kept as files, like any other file.

6. Why we use it, and on what legal basis

For the data we control, we rely on these legal bases:

• To provide Glassa: signing you in, delivering messages, mail and notifications, and hosting meetings, notes, work and AI features. This is necessary for our contract with you or your organization, or is in our legitimate interest in providing the service your organization asked for.
• To keep Glassa secure: protecting accounts and workspaces, preventing abuse, finding and fixing faults, and enforcing our terms. This is in our legitimate interest, and yours.
• To reply to you: when you write to us. This is in our legitimate interest in answering you.
• To tell you about Glassa: only where the law allows, with your consent where it requires it. You can opt out at any time.
• To meet our legal duties: such as keeping financial records and answering lawful requests from authorities.

For the content of your organization's workspace, we act on your organization's instructions, and your organization decides its legal basis.

7. Who we share it with

• Our sub-processors: the companies that run parts of Glassa for us. Our sub-processor list names each of them, what it does, the data it handles and where. They act only on our instructions.
• Your organization: what you post in its workspace is seen by the people and teammates it is shared with, and your organization's owners and administrators manage the workspace.
• Services you choose: Google, when you sign in with it; the provider of a model account a member connects to a teammate; and the mail providers of people you email. Each handles your data under its own terms and privacy policy.
• Payment: if your organization buys Glassa through Stripe, Stripe sells it as merchant of record and handles the payment under its own privacy policy.
• Advisers and buyers: our professional advisers, and anyone who buys or takes over our business, who must protect your data as this policy does.
• Authorities: the police, courts or regulators, only when the law requires it or to protect someone's safety.

8. Where it is stored, and transfers abroad

Glassa's servers, databases, files and call server run on Microsoft Azure in India (the Central India region), outside the UK and the EEA. Backup copies are kept in South India, and mail is sent from Azure in India. AI summaries are written on Microsoft Azure in the United States, or in another Azure region. Speech is turned into text in the United States and on Google's global infrastructure. Cloudflare stores meeting transcripts, received team mail, service logs and published documents in Asia-Pacific, and diagrams in Western Europe. Those are the regions we asked Cloudflare for, and it places data in them as a best effort, not a guarantee. The sub-processor list gives the place for each.

For each transfer of personal data out of the UK or the EEA to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement, or another safeguard data protection law allows. Where an adequacy decision covers a transfer, we rely on that. You can ask us for a copy of the safeguard for a transfer.

9. How long we keep it

• Your account: while it exists. Glassa does not yet let you delete your account yourself, so write to us and we delete it within one month. What you created in your organization's workspace stays there, under your organization's control, as part of its records.
• Your organization's workspace: until your organization deletes what is in it, or leaves Glassa, as our Data Processing Agreement sets out.
• Meetings: transcripts for 3 years after the meeting; temporary audio only until the meeting's speakers are told apart.
• Service logs: up to 30 days.
• Records of sign-ins and other security events in our sign-in service: 2 years.
• Backups: deleted data stays in our backups until they age out: database backups within 35 days, point-in-time recovery logs within 7 days, and deleted files within 365 days. We do not use it in the meantime, and if we ever restore a backup, we delete it again.
• Messages you send us: as long as we need to deal with them and any follow-up.
• Financial records: 6 years, as UK law requires.

10. Security, and if something goes wrong

Data is encrypted in transit and at rest, Glassa's databases cannot be reached from the internet, sign-in tokens are short-lived, files move only through short-lived signed links, and every action of an AI teammate is kept in an audit log. Our security measures list them.

If a breach puts personal data we control at risk, we report it to the UK Information Commissioner's Office within 72 hours of becoming aware of it where the law requires, and tell you without undue delay if it is likely to put you at high risk. For data in your organization's workspace, we tell your organization, and it decides who else must be told.

11. Your rights

You have the right to:

• see the personal data we hold about you, and get a copy of it;
• have it corrected, or deleted;
• have us restrict how we use it, or object to our using it;
• get it in a machine-readable form to take elsewhere;
• withdraw your consent where we rely on it, and stop our marketing at any time.

Email hello@easyloops.ltd from your account's address. We may ask you to confirm who you are. It is free, and we reply within one month, or tell you within that month if a complex request needs up to two months more. For content your organization controls, ask your organization's administrator; if you ask us, we pass your request to your organization.

12. Children

Glassa is for work, for people aged 18 and over. It is not meant for children, and we do not knowingly collect their data. If you think a child is using Glassa, tell us at hello@easyloops.ltd and we will delete their account.

13. Cookies and browser storage

Neither glassa.ai nor the Glassa app sets cookies. Our sign-in service sets one cookie, for at most 15 minutes, while you sign in with Google. Cloudflare, which delivers glassa.ai, sets one only if it has to check that a visitor is not a bot. The app keeps what it needs in your browser's storage: your sign-in session, a copy of your workspace, your unsent drafts and the settings you choose. All of it is strictly necessary, so none of it needs your consent. Our cookie notice lists each item and what it is for.

14. Complaints

If you are unhappy with how we handle your data, tell us first at hello@easyloops.ltd, and we will try to put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or, in the EU, to the data protection authority where you live or work.

15. Changes and contact

If we change this policy in a way that matters, we will publish it as a new version, with the date it takes effect above, and tell organizations in Glassa or by email before the change applies. Questions and requests go to hello@easyloops.ltd. easyloops Ltd is registered in England and Wales, company number 17250950.