Privacy Policy

1. Who We Are

Vaneta Technologies Private Limited ("we", "our", or "us") operates Glimmio, a self-serve growth platform for D2C brands, at ads.glimmio.com. This policy explains how we collect, use, share, protect, retain, and delete data.

2. Data We Collect

We collect different types of data depending on how you interact with our platform:

• Account Data: Name, email address, password hash, and billing information used for subscription processing.
• Integration Data: When you connect external platforms, we process the account metadata, performance metrics, product and order records, customer contact and consent records, message delivery events, and verified reviews required for the features you enable.
• Platform credentials: OAuth refresh tokens and embedded-signup credentials, encrypted before storage and used solely to operate the integrations you authorize.
• Tracking Diagnostics: Conversion events and API health reported by each platform, used to confirm your tracking is working.

3. How We Use Your Data

We use the data we collect solely to provide and improve the Glimmio platform, including:

• Powering profit analytics dashboards and generating reports.
• Providing AI-assisted recommendations through the subprocessors listed in this policy.
• Executing actions you authorize, such as pausing a campaign or uploading a conversion.
• Building consent-aware audiences, delivering marketing campaigns, suppressing opted-out contacts, and collecting verified-purchase reviews.
• Billing and customer support.

We do not use your data to train generalized machine-learning models, and we do not use it for advertising unrelated to your own campaigns.

4. Google User Data

When you connect a Google account, we request only the scopes required by the features you enable:

• Sign in with Google requests your basic profile and email address only, to create or match your Glimmio account. It does not request access to your advertising data.
• https://www.googleapis.com/auth/adwords — read your Google Ads accounts, campaigns, assets and performance reports, and make the campaign changes you explicitly approve inside Glimmio.
• https://www.googleapis.com/auth/datamanager — upload your own store's conversion events back to your Google Ads account so your campaign reporting is accurate.
• https://www.googleapis.com/auth/content — read your Merchant Center account status and product approval results, so Glimmio can show you which products Google disapproved and why. We read this data; we do not modify your Merchant Center account or your product feed.
• https://www.googleapis.com/auth/gmail.send — requested separately, and only if you choose Gmail as a sender for lifecycle email. It permits sending messages you compose in Glimmio. We never read, search, download, or store the contents of your mailbox.

Scopes are requested at the point you enable the relevant feature, not up front. You can revoke Glimmio's access at any time from your Google Account permissions page or by disconnecting the integration in Workspace Settings.

Limited Use disclosure. Glimmio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer Google user data to third parties except as necessary to provide or improve the features you enable, to comply with applicable law, or as part of a merger or acquisition; we do not use Google user data for serving advertisements; we do not allow humans to read Google user data unless we have your explicit consent for a specific support request, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and de-identified.

Limited Use and AI/ML. The use of raw or derived user data received from Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. We do not use, transfer, or sell Google user data — raw, aggregated, anonymised or derived — to create, train, fine-tune or improve any foundational or generalised machine learning or artificial intelligence model.

Glimmio uses two third-party AI providers, both integrated directly against their first-party APIs rather than through any aggregator, gateway or model hub: OpenAI (paid platform API) and Anthropic (paid platform API). Both providers state that data submitted through their paid platform APIs is not used to train their models. No Google Workspace data is sent to either AI service. Glimmio's only Workspace grant is gmail.send, which permits sending a message and grants no ability to read, search or download a mailbox; the content Glimmio submits to an AI provider is limited to your store catalog, advertising performance metrics, product reviews and brand settings.

5. How We Protect Your Data

We apply the following technical and organizational measures. Data we treat as sensitive — credentials and OAuth tokens for your connected platforms, customer contact records, and payment identifiers — receives the additional controls noted below.

• Encryption in transit: All traffic to and from the platform is served over HTTPS with TLS 1.2 or higher, with HTTP Strict Transport Security enabled. Connections to every third-party API, and between our application and its database, are likewise encrypted in transit.
• Encryption at rest: Credentials for your connected platforms, OAuth refresh tokens and other secrets are encrypted by the application with AES-256-GCM, using a key held outside the database — so a copy of the database alone reveals nothing.
• Network isolation: The database and job queue are not reachable from the public internet. Only the HTTPS proxy accepts inbound connections; every other service is confined to a private network.
• Access control: Administrative access requires multi-factor authentication (TOTP). Access follows least privilege through role-based permissions, and platform-administrator actions are recorded in an append-only audit log.
• Customer isolation: Every record belongs to one workspace and business account, and every query is filtered by it. Contact identifiers are derived separately for each customer, so the same email address cannot be linked across two of our customers.
• Secret handling: Credentials are never returned to any client, never written to logs, and never included in data exports or support bundles.
• Callback authentication: Incoming callbacks from connected platforms are rejected unless their signature verifies, so delivery and billing status cannot be forged.
• Backups and recovery: Databases are backed up on a regular schedule, retained for a limited period, and restricted to the same administrators.
• Monitoring: Application errors and abuse signals are monitored, and rate limiting is applied to public endpoints.

No system can be guaranteed perfectly secure. If a breach affects your personal data, we will notify affected customers and the relevant supervisory authority as required by applicable law.

6. Data Retention

We keep data only as long as it is needed for the purpose it was collected for:

• Storefront browsing events: 180 days.
• Message recipient addresses: redacted from delivery records after 90 days; the aggregate delivery record is kept for 365 days for billing and reporting.
• Audit logs: 365 days.
• Incoming platform callbacks: 14 days, or 30 days where an error requires investigation.
• Account and integration data: for the life of your account, then deleted as described below.

Google user data is retained only while your Google integration remains connected. Disconnecting it deletes the stored credentials immediately; derived reporting data is removed on the schedule above.

7. Data Sharing & Disclosure

We do not sell, rent, or trade your personal or business data. We may share data only under the following circumstances:

• Service Providers: We use cloud infrastructure, payment, communications, and AI providers to operate the Service. They process data only for the services they provide to us, subject to their applicable terms and our agreements.
• Legal Compliance: We may disclose information if legally required to do so to comply with applicable laws, regulations, or valid legal requests.

8. Your Rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023 and the GDPR where it applies, you may request access to the personal data we hold about you, correction of inaccurate data, erasure, and a portable copy. You can disconnect any integration at any time from Workspace Settings, which revokes our access immediately. To exercise any other right, or to permanently delete your account and all associated data, follow the instructions on our Data Deletion page or contact us at the address below. We respond within the period required by applicable law.

9. Third-Party Subprocessors

We use trusted third parties to provide secure infrastructure and advanced processing capabilities. You can view our full list of Subprocessors here.

10. Children

Glimmio is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 18.

11. Changes to This Policy

We may update this policy as the platform evolves. Material changes will be reflected in the "Last Updated" date above, and significant changes affecting how we handle your data will be communicated to workspace owners.

12. Contact Us

Vaneta Technologies Private Limited. For questions, privacy requests, or grievances regarding this Privacy Policy, contact our privacy team at help@glimmio.com.