Privacy Policy
Last updated: October 7, 2026
1. Scope and who we are
GLYNT.AI, Inc. (“GLYNT.AI”, “we”, “us”) is the controller of the personal information described in this policy, except for customer files, where we act as a processor. Our address is 530 Showers Drive, #7416, Mountain View, CA 94040, USA.
This policy applies to visitors to glynt.ai and related pages (the “Site”), people who contact us or request a demo, account holders and users of our platform, and business contacts at customers, partners and prospects.
Customer files. Customers send us their raw input files, such as utility bills, meter exports and invoices. We process those files on the customer’s behalf and on their documented instructions, as a processor (GDPR) or service provider (CCPA), under our customer agreement and data processing addendum (DPA). Any personal information in those files stays under the customer’s control. Questions or requests about it should go to the customer, and if we receive one, we pass it to them.
AI and model training
- Segmented AI and data. We process each customer’s files in a segmented environment. A customer’s data, and the AI that works on it, are kept separate from every other customer’s. We do not use one customer’s files, or anything the AI learns from them, to process another customer’s data.
- AI and model training. We use AI built for this task to extract, check and prepare data from customer files. We use a customer’s files to tune the AI only within that customer’s segmented environment. We do not use personal information collected through the Site to train AI models.
Not covered. This policy does not cover third-party sites that the Site links to, or our employees and job applicants, who receive a separate notice.
2. Information we collect
We collect the categories below. The right-hand column maps each to the categories defined in the California Consumer Privacy Act (CCPA).
| What we collect | Examples | Source | CCPA category |
|---|---|---|---|
| Contact and identity details | Name, work email, phone, job title, company | You, when you fill in a form, request a demo or contact us | Identifiers; commercial information |
| Account details | Username, password, role, workspace settings | You, or your employer’s account administrator | Identifiers; sensitive personal information (account log-in with password) |
| Messages and support requests | Emails, form text, call notes | You | Identifiers; other personal information |
| Device and usage data | IP address, browser type, pages viewed, referring page, time on page, approximate location from IP | Your browser, cookies and similar technologies | Identifiers; internet or network activity; geolocation (approximate) |
| Marketing and event data | Newsletter sign-ups, webinar attendance, preferences | You; our event and marketing partners | Identifiers; commercial information |
| Business-contact data from third parties | Name, work email, employer and role | Public sources and business-data providers | Identifiers; professional information |
| Personal information inside customer files | Names on utility accounts, service addresses | Our customers (we are a processor) | Governed by the customer agreement, see section 1 |
We collect only the information we need for the purposes in section 3.
3. How we use information and our legal bases
We use personal information only for the purposes below. For visitors in the EEA, UK and Switzerland, the right-hand column gives the legal basis under Article 6 of the GDPR.
| Purpose | Information used | GDPR legal basis |
|---|---|---|
| Provide, secure and support the platform and Site | Account details, usage data, messages | Contract; legitimate interests (keeping our services secure and working) |
| Respond to inquiries and demo requests | Contact details, messages | Legitimate interests (answering people who contact us); steps before a contract |
| Send marketing emails about our products and content | Contact details, marketing data | Consent where required by law (including in the EEA and UK for non-customers); otherwise legitimate interests. You can opt out at any time |
| Analyze and improve the Site | Device and usage data | Consent for non-essential cookies; legitimate interests for strictly necessary measures |
| Detect fraud, abuse and security incidents | Device and usage data, account details | Legitimate interests |
| Meet legal obligations and respond to lawful requests | Any category, as required | Legal obligation |
| Establish, exercise or defend legal claims | Any category, as required | Legitimate interests |
| Plan and complete a business transfer, such as a merger or financing | Any category, as required | Legitimate interests |
4. How we share information
We share personal information only as described here:
- Service providers and processors. Companies that process information on our behalf under written contracts that limit their use of it. These include analytics (Google Analytics), website hosting provider (AWS), CRM and email (Hubspot) and other vendors. Current list available on request.
- Customers and account administrators. If your employer holds the account, its administrators can see your account details and activity.
- Professional advisers. Lawyers, auditors, insurers and accountants, under duties of confidentiality.
- Business transfers. A buyer or investor, and their advisers, in connection with a merger, acquisition, financing or sale of assets. We will tell you if your information becomes subject to a different privacy policy.
- Legal process and safety. Courts, regulators and law enforcement when the law requires it, or to protect rights, safety and security.
Sale and sharing (California). We use advertising cookies from Google that may count as “sharing” for cross-context behavioral advertising. You can opt out through the “Your Privacy Choices” link in the footer or by sending a Global Privacy Control signal.
Categories disclosed in the past 12 months. We disclosed identifiers, internet or network activity, and commercial and professional information to service providers for the business purposes in section 3. We disclosed no other categories to third parties, except as described under business transfers and legal process.
5. Cookies and tracking
The Site uses cookies and similar technologies. Strictly necessary cookies keep the Site working and do not need consent. We set analytics and any advertising cookies only after you accept them in our cookie banner, if you are in the EEA, UK or Switzerland, and honor your choice elsewhere as the law requires. You can change your choice at any time through the “Cookie settings” link in the footer.
Google Analytics. We use Google Analytics to understand how visitors use the Site. It sets cookies and collects your IP address, device and page-view data. You can opt out with the Google Analytics browser add-on.
Global Privacy Control and Do Not Track. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale and sharing for that browser.
Cookie Declaration
Browser controls. Most browsers let you block or delete cookies. Blocking necessary cookies may stop parts of the Site from working.
6. International transfers
GLYNT.AI is based in the United States, and our service providers may process information in the United States, the United Kingdom and other countries. If you are in the EEA, UK or Switzerland, your information is transferred to countries that may not offer the same level of data protection.
We protect those transfers with one or more of the following.
- The European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Addendum, in our contracts with customers and service providers.
- A transfer risk assessment where the destination country’s laws could limit those protections.
You can ask for a copy of the safeguards that apply to your information by contacting us at the address in section 14.
7. How long we keep information
We keep personal information only as long as needed for the purposes in section 3, then delete or de-identify it. The periods below are proposed for the business to approve.
| Category | Retention |
|---|---|
| Contact and demo-request data | 24 months after your last interaction with us, unless you become a customer |
| Marketing data | Until you unsubscribe, then you are on a suppression list so we honor your opt-out |
| Customer files and the personal information in them | As set in the customer agreement; deleted or returned within 90 days after the agreement ends |
| Device and usage data (analytics) | Not retained |
| Support messages | 3 years after the request is closed |
| Records we must keep by law (tax, contracts, security logs) | The period the law requires, 7 years |
8. Security
We protect personal information with administrative, technical and physical safeguards that fit the sensitivity of the data. These include encryption in transit and at rest, role-based access limited to people who need it, logging and monitoring, vendor reviews, and staff confidentiality and security training. Our controls are aligned with SOC 1 (Type II) and SOC 2 (Type II).
No system is completely secure. If a breach affects your personal information, we will notify you and regulators as the law requires. Please use a strong, unique password and tell us right away if you think your account was compromised.
9. Your choices and rights
You can ask us to access, correct or delete your personal information, and to stop marketing emails, wherever you live. Residents of California, the EEA, the UK and Switzerland have additional rights, set out in sections 10 and 11.
How to make a request. Email privacy@glynt.ai, call (650) 386-6392, or write to GLYNT.AI, Inc., Privacy, 530 Showers Drive, #7416, Mountain View, CA 94040.
How we respond. We confirm receipt within 10 business days and respond within 45 days. If we need more time, we may extend by up to another 45 days (30 days under the GDPR, extendable by two months for complex requests) and tell you why.
Verifying your identity. We match the details you give us with information we already hold. For sensitive requests we may ask for more. We do not need a government ID for most requests.
Authorized agents. You can use an agent to make a request. We require your signed permission, and may verify your identity directly with you.
No retaliation. We do not deny service, charge different prices or give lower quality service because you exercised your rights.
Customer-file data. If your information is in a file a customer sent us, we will refer you to that customer, as explained in section 1.
Appeals. If we decline your request, you can appeal by replying to our decision. If you are still not satisfied, you can contact your state attorney general or your local data protection authority.
10. California privacy rights
This section applies to California residents under the CCPA, as amended by the CPRA.
Notice at collection. In the past 12 months we collected the categories in section 2, for the purposes in section 3, and keep them for the periods in section 7.
Your rights. You have the right to:
- Know what personal information we collected, used, disclosed or shared about you, including the categories, sources, purposes and recipients.
- Access a copy of the specific personal information we hold about you, in a portable format.
- Delete personal information we collected from you, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of sale and sharing of your personal information, including through a Global Privacy Control signal.
- Limit use of sensitive personal information. We use account log-in credentials only to provide the service you asked for, so no limit is needed.
- Non-discrimination for using these rights.
How to exercise them. Use the methods in section 9. A request to know or delete needs two steps: you submit the request, then confirm it. We will not ask you to create an account.
Minors. We do not knowingly sell or share the personal information of anyone under 16.
Shine the Light. California residents may ask once a year which categories of personal information we disclosed to third parties for their direct marketing
Other US states. Residents of other states with privacy laws, such as Colorado, Connecticut, Texas and Virginia, have similar rights, and can use the same methods. If we decline a request, you can appeal as described in section 9.
11. Supplement for the EEA, UK and Switzerland
This section applies if you are in the European Economic Area, the United Kingdom or Switzerland, and adds to the rest of this policy.
Our role. GLYNT.AI, Inc. is the controller for Site, marketing, account and business-contact data. For personal information in customer files, we are the customer’s processor, and the customer is the controller.
Our representatives. GLYNT.AI, Inc. 128 City Road, London, EC1V 2NX, United Kingdom, privacy@glynt.ai. No data protection officer is required.
Where we get information. We collect most information from you. We also receive business-contact details from public sources and business-data providers. (see section 2).
Legal bases, recipients and transfers. See sections 3, 4 and 6.
Your rights. You have the right to:
- Access your personal information and receive a copy.
- Rectify inaccurate or incomplete information.
- Erase your information in the cases the law provides.
- Restrict our processing in the cases the law provides.
- Port information you gave us, in a structured, machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time, without giving a reason.
- Withdraw consent at any time, where we rely on it.
Use the methods in section 9. We respond within one month, extendable by two months for complex requests.
Complaints. You can complain to the data protection authority where you live or work, or where you think a breach occurred. In the UK this is the Information Commissioner’s Office, and in Switzerland the Federal Data Protection and Information Commissioner. We would welcome the chance to address your concern first.
Providing information. You do not have to give us personal information, but we may be unable to respond to a request or provide the platform without the details we need to do so.
Automated decisions. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
12. Children
The Site and platform are for businesses and are not directed at anyone under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this policy
We review this policy at least once every 12 months and update it when our practices or the law change. We will post the new version on this page with a new “Last updated” date. For material changes, we will also show a notice on the Site before they take effect, and ask for your consent again where the law requires it. Earlier versions are available on request.
14. Contact us
Questions, requests and complaints about privacy:
- Email: privacy@glynt.ai; general support: support@glynt.ai
- Phone (US): (650) 386-6392
- Mail: GLYNT.AI, Inc., Privacy, 530 Showers Drive, #7416, Mountain View, CA 94040, USA
- EU/UK representative and DPO: see section 11