Privacy Policy

Glappi runs Glappi and is the controller of the personal data described here. Contact: mail@glappi.com.

For the content your team creates in a workspace, the customer who owns the Glappi account decides what it is used for; we process it on their behalf to provide the service.

• Account: your name, email address and time zone, and your password (stored only as a secure hash by our sign-in provider). If you sign in with Google, we receive your name and email from Google.
• Team and workspaces: the accounts, workspaces and teams you belong to, your role, and invitations.
• Content: posts, images you upload or generate, AI settings (such as your brand description, topics and examples), schedules and approvals.
• Connected social accounts: when you connect Facebook, Instagram or Bluesky, we store the account's name, ID and picture and an access token (or Bluesky app password), encrypted. We use them only to publish your posts and to read their statistics.
• Statistics: reach, likes, comments and shares of the posts Glappi published, and your Facebook Pages' daily reach, as reported by the networks.
• Billing: your plan, subscription status and invoices. Card details are entered at and stored by Stripe; we never see your full card number.
• Usage: AI credit usage, an activity log of what happens in a workspace (for example "approved a post"), and which emails we sent you.
• Technical: cookies needed to keep you signed in and remember your chosen workspace, and server logs (such as IP address and errors) for security and troubleshooting.

• To provide Glappi (performance of our contract with you): your account, workspaces, writing posts with AI, publishing them, statistics, emails about your posts.
• To bill you (contract and legal obligations): subscriptions, credit purchases and invoices.
• To keep Glappi secure and working (our legitimate interest): preventing abuse, fixing errors, protecting accounts.

We don't sell personal data, don't use it for advertising and don't send marketing emails. We send a weekly summary and important alerts about your posts; you can turn them off in Settings or with the link in each email.

We use these service providers. They process data only to provide their service to us:

• Supabase: database, sign-in and file storage.
• Vercel: hosting of the Glappi website and app.
• Stripe: payments, subscriptions and invoices.
• OpenAI: writes post texts and images when you use AI. It receives your request and your workspace's AI settings. Under OpenAI's API terms, this data isn't used to train their models.
• Resend: sends Glappi's emails.
• Google: only if you choose to sign in with Google.

When you connect a social network, the posts you publish go to that network (Meta for Facebook and Instagram, Bluesky) and are handled under its own privacy policy.

Some of these providers process data outside the European Economic Area, mainly in the United States. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

• We use data from these networks only to publish the posts you approve and to show their statistics to your team in Glappi.
• We don't share it with anyone else, don't sell it and don't use it for advertising or profiling.
• When you disconnect an account in Glappi, its access token is deleted immediately. You can also remove Glappi's access in Facebook (Settings → Business integrations) or delete the app password in Bluesky. See Data deletion.

• Account, workspace and content data: as long as your account exists. Deleting an account deletes its workspaces, posts, images and connections.
• Images nobody uses anymore are deleted automatically within a few days.
• The activity log: 180 days. Post statistics stop being updated 30 days after a post is published.
• Invoices and payment records: as long as accounting and tax law requires.
• Server logs: a short time, for security and troubleshooting.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or give it to you in a portable format. Most of your data you can see and change yourself in Glappi. For anything else, write to mail@glappi.com and we'll answer within one month.

You can also complain to a data protection authority, in Slovenia the Information Commissioner of the Republic of Slovenia, or the one where you live.

Glappi uses only cookies it needs to work: to keep you signed in, to remember the workspace you chose and to complete connecting a social account. There are no advertising or tracking cookies, so we don't ask for cookie consent.

All traffic is encrypted (HTTPS). Passwords are stored only as secure hashes. Social network access tokens are encrypted before they're stored. Access to data is limited by team roles, and every workspace is separated from other customers' workspaces.

Glappi is a business tool and isn't meant for anyone under 16.

If we change this policy, we update the date at the top. For important changes we'll tell account owners by email before they take effect.