Privacy Policy

1. Who we are

[TO CONFIRM: registered entity name], registered in [TO CONFIRM: jurisdiction] under number [TO CONFIRM: company number], registered office [TO CONFIRM: registered address], trading as GLOCOD.AI.

Data protection contact: privacy@glocod.ai. [TO CONFIRM: whether a Data Protection Officer has been appointed, and their contact details; and whether an EU/UK Article 27 representative is required.]

2. Scope and roles

This policy covers three different situations, and our role under the GDPR differs in each.

Where we act as a processor, the customer organisation is the controller and decides what goes into its workspace and why. If you are that organisation's employee, customer or contact, please raise data protection requests with them first — we will assist them in responding.

3. Data we collect

3.1 When you use this website

The public landing page sets no advertising or tracking cookies and runs no third-party analytics. If you submit the “Let's Talk” contact form, we record:

• the name, email address, company and message you type;
• the page URL the form was sent from and your browser user-agent string, which we keep for spam and abuse prevention; and
• the date and time of submission.

Our hosting and infrastructure providers process your IP address and standard request metadata in server and security logs, as any web host does. Fonts are served from Google Fonts, which receives your IP address in order to deliver the font files.

3.2 When you hold an account

• Identity and contact: name, work email address, organisation, job title, and your role in the workspace.
• Authentication: hashed credentials, session and multi-factor data. Where your organisation uses SSO or SCIM, the identifiers your identity provider supplies.
• Billing: plan, seat count, billing contact, billing address, VAT number and invoice history. We do not receive or store full card numbers — payments are handled by our payment processor.
• Usage: product events, feature usage, search and query logs, audit-trail entries (who did what and when), device and browser information, and error diagnostics.
• Support: the content of correspondence with us.

3.3 Workspace content (processor role)

Your organisation's users create instruments, obligations, action items, tasks, notes, assignments and sign-offs. These may contain personal data — typically the names, roles and contact details of the people who own or review a piece of compliance work — and, depending on how your organisation uses the platform, other categories it chooses to include. Your organisation controls that content; we process it on its instructions under the DPA.

4. How and why we use it

Where we rely on legitimate interests, we have assessed that our interest in operating a secure, functioning service does not override your rights and freedoms. You may object — see clause 11 — and we will stop unless we have compelling grounds.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

5. Legal bases (GDPR)

Each purpose in the table above names its Article 6 basis: performance of a contract (Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), or consent (Art. 6(1)(a)).

We do not seek to process special categories of personal data (Art. 9) in the course of providing the platform. Where a customer's own configuration involves such data — including health data — additional terms apply; see clause 12.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out on that basis.

6. AI processing

The platform uses automated systems, including large language models, to interpret regulatory text, extract obligations and deadlines, and draft action items.

• Workspace content is not used to train models — ours or any third party's. Where content is sent to a model provider to generate an interpretation, it is sent under contractual terms that prohibit training on it and require prompt deletion.
• Model providers act as our sub-processors and are listed under clause 7.
• Automated output is a decision-support aid. It does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR: a person in your organisation reviews and acts on it. If that ever changes, we will say so here and provide the Article 22 safeguards.

7. Sharing and sub-processors

We share personal data only with:

• Sub-processors that provide infrastructure, model inference, payments, email delivery and error monitoring on our behalf, each under a written contract meeting Article 28 GDPR;
• Professional advisers (legal, accounting, insurance) under duties of confidentiality;
• Authorities, where we are legally required to disclose — we will notify the affected customer unless prohibited from doing so; and
• An acquirer, in a merger, acquisition or asset sale, subject to this policy continuing to apply.

Our current sub-processor list is available at [TO CONFIRM: URL of the maintained sub-processor list]. Customers on the Companies and Enterprise plans may subscribe to notifications of changes and object to a new sub-processor as set out in the DPA. The categories in use are:

8. International transfers

Workspace data is hosted in [TO CONFIRM: hosting region — the FAQ on the landing page states the EU; confirm this matches the actual deployment, and note that EU data residency is offered as an Enterprise commitment].

Some sub-processors operate outside the EEA and the UK. Where personal data is transferred to such a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), together with a transfer risk assessment and supplementary technical measures including encryption in transit and at rest.

You may request a copy of the relevant transfer safeguards from privacy@glocod.ai.

9. Retention

We may retain data longer where necessary to establish, exercise or defend legal claims, or where the law requires it.

10. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS) and at rest;
• row-level access control, so a workspace's data is reachable only by that workspace's authorised users;
• role-based access and least privilege for our own personnel, with access to customer content restricted to what support and incident response require, and logged;
• multi-factor authentication on administrative systems, and SSO/SCIM for customers who need it;
• audit logging of significant actions;
• backups, and tested restore procedures; and
• vendor due diligence before a sub-processor is engaged.

No system is perfectly secure. If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours where Article 33 GDPR requires it, notify affected customers without undue delay, and notify data subjects directly where Article 34 applies.

To report a suspected vulnerability, contact security@glocod.ai. [TO CONFIRM: whether this mailbox exists; add a security.txt and disclosure policy if so.]

11. Your rights

Subject to the conditions in the GDPR (and equivalent rights under the UK GDPR and other applicable laws), you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase data, where one of the Article 17 grounds applies;
• restrict processing in the circumstances set out in Article 18;
• data portability — receive data you provided in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests, and at any time to direct marketing; and
• withdraw consent where processing is based on it.

Send requests to privacy@glocod.ai. We respond within one month, extendable by two further months for complex requests, and will tell you if we need the extension. We may ask for information to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.

If your data is in a customer's workspace, we will refer your request to that customer as controller and support them in answering it.

12. HIPAA

Where a customer is a Covered Entity or Business Associate under the U.S. Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations, and the platform is used in a way that involves Protected Health Information (PHI), the following applies.

12.1 Business Associate Agreement

Do not put PHI into the platform unless a Business Associate Agreement (BAA) is in place. Standard plans are not provisioned for PHI, and this website's contact form must never be used to transmit it. A BAA is available for [TO CONFIRM: which plans — typically Enterprise only]; contact privacy@glocod.ai to request one.

Where a BAA is executed, it governs our handling of PHI and prevails over this policy to the extent of any conflict.

12.2 Our obligations under a BAA

Under an executed BAA we will:

• use and disclose PHI only as permitted by the BAA, by HIPAA, or as required by law;
• apply the administrative, physical and technical safeguards required by the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) to electronic PHI;
• bind each sub-processor that may encounter PHI to equivalent restrictions and conditions;
• report to the customer any use or disclosure not permitted by the BAA, and any Security Incident or Breach of Unsecured PHI, without unreasonable delay and within the timeframe the BAA sets;
• make PHI available so the customer can meet its obligations to provide access (45 C.F.R. § 164.524), to amend (§ 164.526), and to account for disclosures (§ 164.528);
• make our practices, books and records available to the U.S. Department of Health and Human Services as required by § 164.504(e)(2)(ii)(H); and
• on termination, return or destroy PHI where feasible, and otherwise extend the BAA's protections to any PHI that must be retained.

12.3 Minimum necessary and de-identification

Customers should apply the HIPAA minimum-necessary standard and de-identify PHI wherever the platform's purpose can be achieved without it. Regulatory instruments, obligations and tasks rarely require PHI; identifying an owner by name and role generally does not involve PHI at all.

[TO CONFIRM: whether Glocod intends to accept PHI at all. If not, replace this section with a plain statement that the platform is not HIPAA-provisioned and PHI must not be submitted — which is a materially simpler and lower-risk position.]

13. Cookies and analytics

This landing page sets no cookies and runs no analytics, advertising or session-recording scripts. There is nothing here to consent to or opt out of.

The dashboard application at dashboard.glocod.ai uses strictly necessary cookies and local storage to keep you signed in and to hold interface preferences. These are exempt from consent requirements because the service cannot be provided without them. It sets no advertising cookies.

Your browser may be configured to block cookies; doing so will prevent you from signing in to the dashboard.

[TO CONFIRM: if analytics are ever added to either property, a consent banner and a cookie table must be added here first.]

14. Children

The service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@glocod.ai and we will delete it.

15. Changes

We may update this policy as the service and the law develop. The “Last updated” date at the top always reflects the current version. Where a change materially affects how we handle your personal data, we will notify account holders by email or in-product before it takes effect.

16. Contact and complaints

• Privacy enquiries and rights requests: privacy@glocod.ai
• General enquiries: hello@glocod.ai
• Post: [TO CONFIRM: registered entity name and address]

If you are in the EEA or the UK and are not satisfied with our response, you may lodge a complaint with your local supervisory authority. Our lead supervisory authority is [TO CONFIRM: supervisory authority]. We would appreciate the chance to address your concern first.