Privacy Policy

1. Who is responsible for your information

Glasa is operated by David Lachkepiani, based in Georgia, who is the controller of personal information used for Glasa's own purposes. For privacy questions or requests, email [email protected].

For personal information controlled by an organization using a workspace, Glasa may act as processor under that organization's instructions and applicable data-processing terms. This notice does not replace a required processing agreement. Contact your workspace administrator about organization-controlled information; the operator handles Glasa's own account administration, security and billing.

2. Information you provide

Account information includes your email, name, account identifiers, sign-in information, organization and workspace membership, invitations and preferences. If you sign in with Google, the service receives the identity information needed for that sign-in, such as your email, name and Google account identifier.

Workspace information includes the brands, domains, competitors, countries, questions and prompts you configure, collected AI answers, citations, reports, recommendations and notes. Questions and publicly available answers or pages can contain personal information even when the subject is a business.

If you authorize a connected analytics or other third-party account, the service processes the connection credentials and the data needed for the features you enable. Access is limited by the permissions you grant and can be withdrawn through the connected provider or the available connection controls.

If you request research or contact the operator, the service processes your email, selected research topic or niche, company details you choose to provide, message content, delivery status and email preferences. Research requests can also include the source page and campaign information that brought you there.

The shared research and readiness report form records your email, public website, optional name, selected research, source page, first-visit campaign codes and separate marketing choice. It creates a preliminary profile without a login, workspace or trial. Your country is derived from the client IP using a local country database; if it cannot be determined, collection waits rather than assuming a country. The entered website is read to prepare three market questions and fresh ChatGPT answers, with one daily batch before registration. Registering with the same email links that history and stops this public daily schedule; it does not automatically import the history into your workspace. A registered user can request a bounded manual batch.

For a paid purchase, the service processes subscription, invoice and transaction identifiers, plan, payment status and billing information supplied by the checkout provider. Payment-card entry is handled by that provider; Glasa does not ask you to enter a full card number into its own application forms.

3. Information collected through use and public sources

Hosting and security systems process technical request information such as IP address, browser and device information, request time, requested pages and errors. Public tools process the domain or URL you submit and the pages retrieved to run the check, together with request and anti-abuse information.

The service obtains answers and cited pages from AI platforms, collection providers and publicly accessible websites. Those materials may mention identifiable people. The original answer and citations in a report indicate the source of the observation; a public source is not a guarantee that its content is accurate.

Usage analytics can include visited pages, clicks, navigation, timing, approximate location, campaign information and account or workspace identifiers. Session recording can reconstruct the visible page and interactions. Displayed content, including prompts and AI answers, may appear in a recording; masking form fields does not mean that all displayed personal information is removed.

4. Why information is used

Information is used to create and secure accounts, provide workspace access, collect and analyze the answers you request, produce reports, manage subscriptions, deliver requested research and support, and send essential account or service messages.

Where a legal basis is required, account and service processing relies on performing an agreement with you, or legitimate interests in serving an organization's authorized users. Security, abuse prevention, diagnostics and limited service measurement rely on legitimate interests in protecting and maintaining the service where permitted and subject to your rights. Optional cookie-based analytics, session recording and marketing email require consent where the law demands it. Calling analytics 'cookieless' does not itself make that processing exempt from consent or other data-protection requirements. Accounting and legally required records rely on legal obligations.

Consent to marketing email is a separate choice. You can withdraw it in account preferences or using the unsubscribe mechanism in an email. Essential messages about sign-in, service access or a purchase may still be sent.

Account details and the content needed for a requested operation are necessary to provide that operation. Declining optional marketing does not prevent account use. AI analysis assists with business reports; Glasa does not use those reports to make decisions about individuals that have legal or similarly significant effects.

5. Cookies, analytics and session recording

The site and application use cookies or browser storage for functions such as sign-in, remembering settings and remembering your cookie choice. The shared Glasa consent cookie stores your choice for up to 180 days. Clearing browser data may remove that choice.

The public report form also remembers the first landing address and five campaign codes in browser storage, separately from the optional analytics choice, so navigation does not replace the source of your request. If browser storage is unavailable, these values are kept only in the open page's memory. Requesting the report does not require optional marketing consent; the checkbox starts unchecked. Requested report events use your normalized email to route the request through PostHog and the email destination.

The public website and product application use PostHog with a US collection endpoint. Before you answer the cookie banner, and after Reject, the configured PostHog analytics use a cookieless mode. That mode avoids PostHog cookies and local storage but still sends usage events and processes technical request information. Reject does not mean no requests reach the hosting or analytics provider.

The public website and application load Google Tag Manager from Google only after you accept analytics cookies, unless your browser sends Do Not Track or Global Privacy Control. Before a choice and after Reject, its container is not requested. Fetching the container sends technical request information, such as IP address and browser information, to Google. Glasa sends consent updates that permit analytics storage only; advertising storage, advertising user data and advertising personalization remain denied. Withdrawing consent after it loaded reloads the page to stop the running container. Its published configuration controls additional tags, whose actual operation remains subject to applicable consent and data-protection requirements.

Accept enables PostHog cookie-based analytics and session recording on the website and in the application. PostHog recording is configured to mask input fields, but visible page content and interactions, including prompts and AI answers, can still be recorded. You can reopen Cookie settings and choose Reject to withdraw consent for future PostHog cookie-based analytics and recording. Withdrawal does not make earlier processing under valid consent unlawful; information collected under consent remains subject to applicable deletion requirements. Contact [email protected] about deletion or an objection to analytics that continue without cookies.

These settings do not stop essential security records, accounting or server records of operations needed to provide the service. Do not put secrets or sensitive personal records into prompts or other visible content.

6. Service providers and other recipients

Information needed for an operation is sent to the providers used for that operation. These can include hosting and database infrastructure; AI collection providers such as Bright Data and DataForSEO; OpenRouter and the model provider handling an analysis request; Firecrawl for page reading or rendering; PostHog for analytics; Google for Tag Manager and any configured tags; Cloudflare for anti-abuse checks; Loops or an email delivery provider for messages; and Stripe or Paddle when shown as the provider for your purchase.

For example, collecting an AI answer sends the question and requested platform or region to a collection provider; analysis may send questions, answers and relevant page text to an AI provider; an email request sends your email and the information needed to deliver it. Avoid including personal or confidential information that the requested feature does not need.

Providers process requests under their applicable terms and data-handling arrangements. Retention and other processing can differ between providers and features. Our internal OpenRouter analysis requests are configured to request no provider data collection and zero data retention; this setting is specific to those requests and is not a promise covering every AI platform or collection provider. Contact the operator if you need information about the providers used for your account.

Authorized workspace members can see shared workspace information according to their access. Authorized service administrators may access information for support, security and diagnostics. Information may also need to be disclosed to meet a valid legal obligation or protect the service and others. A future change of operator must preserve applicable data-protection obligations and be explained in an updated notice.

7. International processing

Glasa serves users internationally. Providers may process information outside your country, including in the United States. The operator's location does not mean information is stored only in that country.

Processing locations depend on the provider and feature. Applicable requirements for cross-border processing continue to apply, including any required protection or transfer safeguards. You can contact [email protected] for information about the recipients, processing locations and transfer arrangements relevant to your account. This Policy does not itself give permission for a transfer or replace a safeguard required by law.

8. How long information is kept

Account and workspace information is kept while needed to provide the service and its history, subject to deletion requests, the applicable plan and any legal retention requirements. Billing, consent, security and dispute records may need to be kept for longer to document purchases, respect opt-outs, investigate abuse or meet legal obligations. A request is reviewed against those needs rather than treated as a promise of immediate deletion of every record.

A public agent readiness report is cached for up to 24 hours under its current configuration. Research and support records are kept while needed to deliver the request, follow up where permitted or document it. A limited record of an email opt-out may be kept to respect that choice. Provider records and backups follow separate retention arrangements; their retention depends on the purpose, the provider configuration, legal requirements and any unresolved security or dispute needs. Closing an account does not by itself erase every business record or backup. You can request deletion and ask about the information retained for your account.

9. Your choices and rights

You can manage workspace access and available account preferences, withdraw optional marketing consent, reopen Cookie settings and choose Reject to stop PostHog cookie-based analytics and session recording, and disconnect an authorized integration. Your organization's administrator may control shared workspace information.

Depending on the law that applies, you may request access to personal information, correction, deletion, a portable copy or restriction of processing. You may also object to processing based on legitimate interests, including relevant service measurement, and withdraw consent without affecting processing that was lawful before withdrawal.

Send a request to [email protected]. Requests are normally free; a fee or refusal is permitted only where applicable law allows it. The operator may need proportionate information to verify identity and clarify which account or records are involved, while protecting other people's information. Responses must follow applicable legal deadlines. If a request is refused or restricted, you will receive the reason and information about available complaint rights, unless the law prevents disclosure.

You may complain to the data-protection authority competent for your location. In Georgia, the State Audit Office supervises personal-data protection; its website is sao.ge. Contacting the operator first is optional and does not remove your right to complain. Where information is controlled by your organization or a connected provider, the request may also need to be addressed to that organization or provider.

10. Security, children and changes

Account access, workspace permissions and anti-abuse controls help protect information. No internet service can guarantee complete security; protect your credentials and avoid submitting unnecessary sensitive information.

Glasa accounts are intended for adults and the service is not directed to children under 18. If you believe a child has provided personal information, contact the operator so the information and any required action can be reviewed.

Updates will be posted here with a new date. Material changes to how personal information is handled, including a change of operator, will be communicated through the service or the account contact when required. Consent will be requested where the law requires it.

Privacy contact: David Lachkepiani, Georgia, [email protected]. Include the account email and a description of your request, and avoid sending passwords or unnecessary sensitive information.