Privacy Policy

This Privacy Policy explains how Glancely ("we", "our", "us") collects, uses, and protects information when you use our service at glancely.ai. We're committed to handling your data responsibly and transparently. By using Glancely, you agree to the practices described here.

1. Who we are

Glancely is a marketing analytics product operated by BOTSIS KOSMAS E.E. (trading as KB Analytics), a limited partnership based in Greece, European Union. BOTSIS KOSMAS E.E. is the data controller for the purposes of GDPR.

• Legal entity: BOTSIS KOSMAS E.E., trading as KB Analytics
• VAT number: EL801829229
• General Commercial Registry (GEMI): 164122303000
• Registered office: Athens, Greece. The full registered address is held on public file by the Greek General Commercial Registry (GEMI) under the registration number above, and can be retrieved from businessportal.gr.
• Email: hello@glancely.ai

You can reach us at hello@glancely.ai for any privacy-related question or request.

2. What we collect

We keep the data we collect minimal and tied to what the service actually needs to work. Specifically:

When you sign in with Google

• Your email address and display name
• A Google profile identifier
• OAuth refresh and access tokens (so we can fetch your analytics data on your behalf)
• Your profile photo — the one from your Google account, or one you upload — to show beside your name to people in your workspaces. Remove it on your Profile at any time; it is deleted with your account.

When you connect data sources

• Which Google Analytics 4 properties, Search Console sites, and Google Ads accounts you've connected
• Which source is set as "active" per type

Optional profile information

If you fill in your profile (entirely optional), we store: company name, country, phone number, job role, primary use case, and whether you want marketing communications.

When you use the contact form

Your name, email address, the subject you chose and your message, so we can reply. We email it to ourselves and send you a short confirmation, both through Postmark; the confirmation repeats nothing you wrote. Contact messages are deleted automatically after 12 months.

"Talk to a person" in the help chat sends the same way: your message, your conversation with the help assistant, the page you were on, and — if you are signed in — your workspace's name, your role, plan and how many sources it has. Only when you press Send.

When you use the AI assistant

• The questions you ask
• The responses we generate for you
• If you "pin" an answer to your dashboard: the question, the answer text, and the chart data are stored alongside your account so the card can be re-rendered

Standard technical data

• IP address (security, abuse prevention)
• Browser type and version
• Timestamps of activity within Glancely

Payment data

Stripe handles all payment processing. We see only your subscription status, plan tier, and the last 4 digits of your card — we never receive or store full card details.

3. What we don't collect

This part matters because Glancely's whole architecture is built around it: we don't store your analytics data on our servers.

When you load a dashboard, we fetch your data live from Google's APIs and discard it after rendering. When you ask the AI a question, we fetch the answer from Google in real time, give it to the AI, and never write the raw rows to our database.

The narrow exceptions:

• Short-lived cached aggregations (up to 6 hours) to keep dashboards fast — summarized totals, not raw rows
• If you connect a BigQuery export, cached query results for up to 6 hours, since the tables underneath update once a day — summarized results, not raw rows
• Pinned AI answers (only when you explicitly pin them)
• Anomaly snapshots (24-hour cache for the AI narration of a flagged shift)

We have no permanent table of "your sessions", "your purchases", or "your campaigns". We can't sell what we don't have.

4. How we use your information

We use your data to:

• Provide the service — fetch your analytics, render dashboards, answer your AI questions
• Communicate with you — transactional emails (account, billing, security), respond to support inquiries
• Improve the product — see which features get used, and where people get stuck, so we know what to build next. What this records is set out under "Usage data inside the app" below
• Bill you — process subscription payments via Stripe
• Keep Glancely safe — detect fraud, abuse, technical issues
• Comply with legal obligations — respond to lawful requests, maintain audit logs

We do not: sell your data, show ads on Glancely, train AI models on your data, or share your data with marketers or data brokers.

5. Third parties we share data with

The service requires interaction with several third-party providers. We share only what's necessary; each role is described below.

Google

We use Google's APIs (Analytics Data API, Search Console API, Google Ads API) to fetch your data on your behalf. We send your access token; they send back your data. Google's own privacy policy applies to what they do with the interaction.

Google Analytics and Google Ads (our own website)

Separately from reading your data, we measure our own public website with Google Analytics, and we advertise Glancely on Google Search. What that involves, and the choices you have, are set out under Cookies and tracking.

Anthropic

When you use the AI assistant or open a dashboard with anomaly detection, the question and a minimum-necessary slice of relevant data are sent to Anthropic's Claude API to generate the response. When you ask the help assistant (the chat bubble on our website and in the app), your conversation with it — and, when you are signed in, your role, plan and how many sources you have, never any analytics figures — is sent to Anthropic to write the answer. We don't keep these conversations; they stay in your browser tab. We rely on Anthropic's standard API terms; by default they do not train models on API traffic. See anthropic.com/privacy.

Stripe

Stripe handles all subscription billing and payment processing. We receive only subscription state — no raw card details. See stripe.com/privacy.

Postmark (email delivery)

We use Postmark to deliver email — workspace invitations, account emails, weekly digests for those who switch them on, and scheduled reports. They process the recipient's email address and the content of the message, and retain both for 45 days so delivery problems can be investigated. Postmark stores this in the United States; see International transfers below.

Worth being specific about two cases: a weekly digest contains figures drawn from your analytics, and a scheduled report attaches the report itself as a PDF. Both pass through Postmark and sit in their message log for those 45 days. Nothing else we send carries your analytics data.

Scheduled reports go to people you choose, who may not use Glancely. We keep their email addresses with the schedule until it is changed or removed, and use them for nothing else. Every such email names who sent it and carries a link to stop receiving it; an address that uses it is kept, so it is not added back.

Sentry (error reporting)

When something goes wrong in the application, the error and the code path that caused it are sent to Sentry so we can fix it. We have deliberately turned off the parts of that service that would carry your data: no email addresses, usernames or IP addresses, no request contents (so nothing you type into the assistant), and none of the in-memory values from the code, which is where analytics rows and access tokens would otherwise appear. What is sent is the error itself, the file and line, and the workspace id. See sentry.io/privacy.

Hosting

Our application runs on Railway. They host our database and web servers but do not access your data beyond standard infrastructure operations. See railway.app/legal/privacy.

Limited disclosures we may make

• To law enforcement when legally required (court order, subpoena, etc.)
• To prevent fraud or abuse
• To a successor entity if Glancely is acquired (you'll be notified in advance)

6. Google user data and Google's Limited Use policy

Glancely reads data from your own Google accounts. This section sets out exactly what we access, what we do with it, and — just as importantly — what we never do with it.

What we access, and why

• Google Analytics (analytics.readonly) — asked only when you connect a Google Analytics property, to list the properties you have access to, and to read the metrics shown on your dashboards. This is the most limited scope Google offers for reading Analytics.
• Search Console (webmasters.readonly) — asked only when you connect a Search Console site, to read queries, clicks, impressions and positions for sites you have verified.
• Google Ads (adwords) — asked only when you connect an Ads account, to read campaign, cost and conversion metrics. Google publishes no read-only scope for the Ads API, so this is the only scope available. We issue read-only queries exclusively and never create, edit, pause or delete anything in your Ads account.
• Your email address and profile name — to create and identify your account.

Raw event data in BigQuery (optional)

If your Google Analytics property exports its raw events to BigQuery, you can connect that export to answer questions the Analytics API cannot — your own custom events, and history going back further than Analytics keeps it. This is optional, off unless you switch it on, and it works differently from everything above.

We do not use your Google login for it. Google offers no permission meaning “just the Analytics export”; the only available one would let us read everything in your BigQuery. Many companies keep customer, finance or HR data there, so we do not ask for it.

Instead we create a dedicated service account for each connected property — an identity that exists only for you, used for nothing else and by nobody else. You grant it read access to one dataset: the analytics_<property id> that Analytics writes to. It holds no permission on anything else in your Google Cloud, including other datasets in the same project.

• You control it, and you can see it. The grant appears in your own Google Cloud console and you can withdraw it there at any time, without involving us. Disconnecting in Glancely deletes the service account outright.
• Still nothing is stored. Queries run when a page or a question needs them, and results are held in a cache for up to six hours, since the tables underneath update once a day. No event data is written to our database.
• We record what your site measures, not what it measured. To answer questions about your custom events we keep a list of your event and parameter names, how often each appears, and — where a parameter has only a handful of fixed options, such as which section of a form someone was in — those options. That is the shape of your tracking, not the visits themselves. Where a parameter holds an identifier or free text, so that its values would describe individual visits rather than describe the parameter, no values are kept at all.
• Queries run in our Google Cloud project and are billed to us, so connecting this does not add to your Google bill.

Raw event data is more detailed than the reports in Analytics: it can include a pseudonymous identifier for each visitor, approximate location, device, and whatever parameters your own site chooses to send. Everything in What we never do with it below applies to it in full.

Limited Use

Glancely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we never do with it

• We do not store your analytics data. Every dashboard load fetches it live from Google; responses are held in a cache for up to six hours and no metrics are written to our database.
• We do not sell it, rent it, or transfer it for advertising, credit assessment or any similar purpose.
• We do not use it to develop, improve or train generalised AI or machine-learning models — ours or anyone else's.
• No human at Glancely reads it, except where you explicitly ask us to look at something to support you.

The AI assistant

When you ask the assistant a question, the question and the minimum slice of data needed to answer it are sent to Anthropic's Claude API, solely to produce your answer. Anthropic does not train models on API traffic. Nothing is sent to Anthropic unless you ask a question or open a page that generates an insight.

Your questions and the assistant's replies are stored so a conversation survives a page refresh. Each conversation is private to the person who started it — nobody else in the workspace sees it — and it is deleted automatically after 90 days. You can delete one sooner with the bin icon in the assistant panel. To share an answer with your team, pin it to a page.

Withdrawing access

You can revoke Glancely's access to your Google account at any time at myaccount.google.com/connections. Doing so stops all data fetching immediately. Deleting your Glancely account removes the stored tokens entirely.

If you connected a BigQuery export, that is separate and is revoked separately: remove the service account's access to the dataset in your own Google Cloud console, or disconnect it in Glancely, which deletes the account entirely.

7. Legal basis for processing (GDPR)

If you're in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following bases under GDPR:

• Contract — we need your data to provide the service you signed up for
• Legitimate interest — for security, fraud prevention, and product improvement
• Consent — for any marketing communications (you can opt out anytime), and for analytics and advertising cookies on our website
• Legal obligation — for tax records, lawful requests, etc.

8. Your rights

Regardless of where you live, you can:

• Access the data we have about you
• Correct anything that's wrong
• Delete your account and associated data
• Export your data in a portable format
• Object to certain uses (e.g., marketing)
• Withdraw consent at any time, where consent is the basis

To exercise any right, email hello@glancely.ai. We respond within 30 days at no cost.

If you're in the EEA/UK and you think we've mishandled your data, you can also complain to your national Data Protection Authority. In Greece, this is the Hellenic Data Protection Authority.

Requests from public authorities

If a public authority asks us for anyone's personal data, we check that the request is lawful and properly made before answering, challenge it where we believe it is not, disclose only the minimum the request lawfully requires, and keep a record of each request, our response and the reasons for it. Where the law allows, we tell the person concerned. In the past 12 months we have received no such requests.

Meta (Facebook and Instagram) ad accounts

If you connect a Meta ad account, you sign in with Facebook to give Glancely read-only access to your ads (the ads_read permission). We keep only that access token, the name Meta gives for your login, and which ad accounts you connected. Spend, clicks and other ad figures are read from Meta when a page needs them and never stored. We never create, change or pause anything in your ad accounts.

To delete it: on your Glancely Profile, under Your Meta logins, choose Remove. We ask Meta to withdraw Glancely's access and delete the token at once. You can also remove Glancely in Facebook (Settings & privacy → Settings → Business integrations), or email hello@glancely.ai and we'll delete it within 30 days. Deleting your Glancely account deletes it too.

9. Data retention

• Account data (email, OAuth tokens, profile, pinned insights) — retained while your account is active, plus 30 days after deletion to allow recovery from accidental cancellation
• Dashboard, raw-event, anomaly & AI caches — 15 minutes to 24 hours, then automatically expired
• Contact form messages — 12 months, then automatically deleted
• Stripe billing records — 7 years, as required by tax law
• Application logs — 30 days for security, then deleted
• Backups — kept for 30 days

You can request immediate deletion by emailing us.

10. Security

We follow standard SaaS security practices:

• All traffic encrypted in transit with TLS 1.2 or higher
• OAuth tokens encrypted at rest
• Production data access restricted to the development team
• Regular dependency updates and security patching
• Two-factor authentication required for administrative access

No system is perfectly secure. If we detect a breach affecting your data, we'll notify you within 72 hours, in line with GDPR.

11. International transfers

Glancely is operated from Greece (EU). Some of our processors (Anthropic, Google, Stripe, Railway, Postmark, Sentry) are based in the United States. When your data is transferred outside the EEA, we rely on:

• Standard Contractual Clauses (the EU-approved data transfer mechanism), or
• EU–U.S. Data Privacy Framework participation by the receiving party

We don't transfer your data to jurisdictions that lack adequate protection.

12. Cookies and tracking

Glancely uses only essential cookies and storage:

• A session cookie (so you stay logged in)
• A CSRF token cookie (security)
• A small localStorage flag for UI state (dismissed banners, etc.)

We do not use analytics tracking cookies inside your Glancely account — once you're signed in to your own account, no third-party tracker measures what you do; our own usage records are described below. It would be ironic for an analytics tool to track its own users. Inside the app there are no advertising cookies, cross-site trackers or ad pixels either.

On our public pages only — the ones you can read without signing in, such as the homepage, pricing, contact, help and this page, and the live demo with its sample businesses — we use Google Analytics to see which pages people find useful. We also advertise Glancely on Google Search, and use Google Ads to see whether those ads bring people who go on to sign up. The first time you visit, we ask. We'd rather tell you exactly what each answer means than summarise it:

• Analytics only: Google Analytics sets one cookie. It lets us see which pages you visited in a session and where you arrived from. It does not tell us who you are.
• Allow all: the same, and advertising measurement too. If you arrived by clicking one of our ads, Google may store a cookie remembering that click, so it can tell us whether the ad brought someone who later signed up. We never use this to show you ads elsewhere: personalised advertising and remarketing stay switched off whatever you choose.
• No thanks: no cookie is set and nothing is stored on your device. Google still receives an anonymous record that a page was viewed — no identifier, nothing linking it to any other visit, and nothing that can be tied back to you. It carries your IP address, as every request to any website does.
• Your answer is remembered in localStorage and in a small cookie of our own, glancely_consent, so that both your browser and our server know it. A refusal is remembered just as firmly as an acceptance, so we don't ask twice.
• None of this runs on any page of your own account. The one exception is the moment you create your account: if you chose Analytics only or Allow all, our server tells Google Analytics that a signup happened, linked to the same anonymous browser identifier its cookie already holds — never your name or email — and keeps that identifier, and the answer you gave, with your account. When you first pay for a subscription, the same identifier is used to tell Google Analytics a purchase happened and its amount before VAT. With Allow all, Google may use it to tell us whether an ad brought you. Also only with Allow all, our server tells Meta (Facebook and Instagram) that a signup happened, with the identifier of the Meta ad you clicked if you came from one, your IP address and your browser type — never your name or email — so Meta can tell us whether its ads bring people who sign up; the ad identifier is held only until then and never stored. If you chose No thanks or Analytics only, nothing is sent to Meta, and with No thanks nothing is sent to Google either.

To change your mind, use Cookie choices at the foot of any public page, or in the demo's banner.

Usage data inside the app

We record how Glancely itself is used — which pages you open (including each setup step you reach after signing in), when you download a report, when you ask the AI a question. This is how we find out which parts of the product are worth improving.

• It is stored in our own database. No third party, no cookie, no pixel, and nothing sent to Google or anyone else.
• It records actions, not content: that a question was asked, never the question; that a report was downloaded, never what was in it.
• We never store your IP address or your browser's user agent against these records.
• It is deleted automatically after 180 days.

We also record where you first arrived from — the referring site or campaign link, and whether you arrived by clicking an ad — so we know which channels bring people to Glancely. It is taken from the page request itself, not from a tracking cookie, and saved when you first sign in. Of an ad click we keep only that it was one, never the click's identifier. It works the same whether or not you accepted analytics.

Visits to our public pages. We count visits to the website in our own database too, because Google Analytics only sees the people who accept its cookie. Each visit is one record: where it came from (the campaign link, the referring site, or that it was a click on one of our Google or Meta ads — never the click's identifier), the page you landed on, and whether you're on a phone, tablet or computer. No IP address, no browser details, no identifier that could follow you, and no extra cookie: one visit is told from the next by the same session the site already uses, with a new visit after 30 minutes away. Robots are left out, signed-in people aren't counted, it works whatever you choose on the cookie banner, and it is deleted after 180 days like the rest. We also count which answer you give on the cookie banner itself, with the same visit details and nothing more, so we know how many visitors Google Analytics cannot see.

What a visit did. To the same visit record we add: how many of our pages it opened and their addresses in order (the first ten); how long each page was actually on screen; how far down it was scrolled; how long the first page took to load; which of our buttons or controls were used (for example "Start free trial", the currency switch or a pricing question), never anything you type; and your country, worked out from your browser's time-zone setting, not from your IP address. If you reach an address on our site that does not exist, we count the address. Like the rest, it has no identifier and no cookie, works whatever you choose on the cookie banner, and is deleted after 180 days.

The live demo. Opening the demo gives you a temporary guest login, so the client you are viewing and the questions you ask are yours alone. It holds no name or email, shows only made-up sample businesses, and is deleted after a day together with any questions you asked its AI assistant (which, like every assistant question, are sent to Anthropic to be answered). To stop one address opening thousands of guest logins, the address your request came from is counted for an hour, then forgotten. We record that the demo was opened and from which button, and whether you then started a trial from it. The demo's pages are measured by Google Analytics like our public pages, under the same cookie choice described above.

You can disable cookies in your browser, but the service won't work without the essential ones.

13. Children's privacy

Glancely is a business tool not directed at children. If you're under 16 (or under the applicable age in your country), don't use Glancely. If we discover we've collected data from a minor, we'll delete it immediately.

14. Changes to this policy

We'll update this policy from time to time. For material changes, we'll notify you by email at least 30 days before they take effect. The "Last updated" date at the top always reflects the most recent version.

15. Contact us

Privacy questions, requests to exercise your rights, or anything else: hello@glancely.ai.

For fraud-prevention reasons, we may ask for additional verification before processing certain requests.