Privacy Policy

What this covers

This policy explains what Glai collects, why, and the choices you have. It has two parts: what the tracking script records about the visitors of websites that use Glai (our customers' visitors), and what we hold about the account holders themselves. Our customers decide to put the script on their sites and are responsible for telling their own visitors about it in their own privacy policy.

What the script collects about a visitor

When a page with the script loads, and on each page change, click on a link to another site, tagged button click or custom event the site fires, the script sends: the page address and title, the address of the page that linked to it (the referrer), the screen size, the browser language, and the site's own id. The server adds the browser and device type worked out from the browser's user agent string, and the country, region and city worked out from the IP address, with an approximate position rounded to about 10 kilometres for the live map (never a street address).

The visitor is counted with a random id that the script creates in the visitor's browser (in local storage and a first-party cookie called glai_vid). That id is not derived from anything personal, is different on every website, and is never shared between websites, so a visitor cannot be followed from one site to another. A site can instead run in daily mode: nothing is written to the browser, and the visitor is counted with a hash of the day, the site, the IP address and the user agent, made with a secret key. The hash changes every day and cannot be turned back into the address.

The IP address is used once, to find the country, city and approximate position and, in daily mode, to make the hash. It is then dropped. It is not written to the database and does not appear in any dashboard.

The script sets no third-party cookie, loads nothing from anyone else, and does not record what a visitor types. A site can ask the script to identify a visitor after that person signs in (their email address, name and the site's own user id); that is the site's choice and data, shown only in that site's dashboard.

Payments our customers connect

A customer can connect their payment provider (Stripe, Polar, Paddle or Lemon Squeezy) so each payment is matched to the visit that brought it. For each payment the provider sends us its id, the amount, currency, when it was paid, the product name, the customer's email address and name as the provider sends them, and the visitor id the customer passed into the checkout. Refunds are recorded the same way. The webhook signing secret the customer pastes is encrypted before it is stored and used only to check that a call really came from the provider.

How long visitor data is kept

Page views and visits are kept for the period of the customer's plan (the retention shown on the pricing page) and then deleted by a daily job. Payments, with the source they were attributed to, are kept for as long as the site exists. When a customer deletes a website, everything recorded for it is deleted with it.

Shared dashboards

A customer can publish a read-only dashboard at a link anyone can open. It shows totals, charts and breakdowns by source, page, country, device and so on. It never lists individual visitors, visitor ids, email addresses or payments by person.

AI features

When a customer asks the AI a question about their numbers, the question and an aggregated summary of their stats (totals and breakdowns, the same tables the dashboard shows) are sent to the AI provider configured for this service to generate the answer. Visitor ids, email addresses, names and IP addresses are never part of that summary. We keep the question, the model used, token counts, the credits charged and the time it took, to show usage and to monitor cost and errors. We do not use customer content to train AI models.

Account information

When you create an account we store your name, email address and your password as a one-way hash (bcrypt), never the password itself, or your Google account identifier if you sign in with Google. We also record the time zone your browser reports, your light or dark mode choice, and whether you have confirmed your email address. Adding a website, connecting a payment provider, creating API keys and using the AI tools require a confirmed address.

Sign-in and security records

For each sign-in, failed attempt, password change and signed-out session we record the IP address, the approximate location derived from it (city, region, country, network provider) and the browser and device type. You can see this log in your security settings. We use it to protect your account and to alert you to sign-ins from new locations.

Signed-in sessions use short-lived tokens and a session token that changes every time it is used and is stored only as a hash. If an old session token is ever presented again, we treat it as stolen and sign that session out. API keys you create are shown once and stored only as a hash, so we cannot read them back.

Payments for your plan

Subscriptions are handled by Stripe. Your card details go directly to Stripe and never reach our servers. We store the Stripe customer and subscription identifiers needed to manage your plan.

Emails we send you

We email you about your account: confirming your address, password resets, sign-ins from a new place, billing (receipts, failed payments, trial and plan changes), and a few getting-started tips in your first days. System email is sent through Mailgun. We keep a record of each of these emails (the address, the subject, when, and whether it was delivered to our email provider) so we can help when one does not arrive. Emails about your account, security and billing are service messages, so they are sent while you have an account; the getting-started tips can be switched off in Settings.

Service providers

We rely on providers to run the service: a database host, an IP geolocation service (ipinfo.io, used when the request's location is not already known from our network provider), an AI provider, Stripe for subscriptions, Mailgun for system email, and Google Analytics on our own marketing pages only (never on our customers' websites or on shared dashboards). Each sees only what it needs for its job.

Access by our staff

A small number of staff can see account information, usage and sign-in records to provide support, prevent abuse and keep the service running. Every action they take on an account, such as suspending it or changing its plan, is recorded in an audit log.

Your obligations as a customer

You decide to add the script to your website, so you are the one responsible for telling your visitors about it. Say in your own privacy policy that you use privacy-friendly analytics, what is collected (the page, the referrer, the device and browser type, the country and city, and a random id kept in the browser, or none in daily mode) and that no IP address is stored. The script sets no third-party cookie, so a consent banner is not needed for it in most places, but the rules where your visitors live are yours to check.

Retention and deletion

We keep your account data while your account is open. You can delete websites, goals, API keys and workspaces in the app, and everything recorded for a website goes with it. To close your account and delete its data, contact hello@glai.io. Audit records of security actions may be kept after an account is deleted.

Contact

Questions about this policy can be sent to hello@glai.io.