Privacy Policy

Google user data

If you sign in with Google, we ask Google only for the basic sign-in scopes: openid, email and profile.

• Which data we take: your name, email address, and profile photo (if your Google account has one), and your Google account ID, so we recognise you the next time you sign in. We never see your Google password, and we can't read your Gmail, Drive, contacts or calendar.
• Why we use it: only to sign you in to Glassa, confirm your work email address, and show your name and photo to the people in your organization.
• Never sold or used for ads: we never sell it, never use it for advertising or tracking, and never pass it to anyone for their own purposes or to train generalized AI models.
• How long it is kept: for as long as your Glassa account exists. When your account is deleted, the link to your Google account and the profile details from it are deleted too.
• How to delete it: email hello@easyloops.ltd from your account's address, or ask your organization's administrator. We act on it within one month. You can also remove Glassa's access at any time in your Google Account's security settings.

Glassa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we collect

• Your account: your name, work email address and profile photo; how you sign in (a hashed password, a passkey's public key, or a link to your Google, Apple or Microsoft account); and your membership and role in your organization.
• Your work in Glassa: messages, threads, reactions, voice notes and files; meeting audio, video, transcripts and notes; objectives, work items, standups and logbooks; team mail; and your organization's directory.
• AI teammates: what a teammate does in your workspace, such as its messages, the changes it proposes and the audit log of its actions, is kept like any member's work.
• Notifications: if you turn on push notifications, your device's push token and platform.
• Security data: your sign-in sessions, and the server logs (such as IP address, browser and time) that keep accounts and workspaces safe.

We don't use advertising, advertising identifiers or cross-site tracking, and we never sell or rent personal data or workspace content.

Why we use it

We use your data to provide Glassa to you and your organization: to sign you in, deliver messages and team mail, host meetings and notes, track work, run the AI features your organization uses, and keep accounts and workspaces secure.

For your account and our security logs, easyloops Ltd is the controller. We rely on our contract with you to provide the service, and on our legitimate interest in keeping it secure. For the content your organization creates in its workspace, your organization is the controller, and easyloops Ltd processes that content on its instructions.

Where it is stored and who processes it

Glassa runs on Microsoft Azure in India (the Central India region), which is outside the UK and the EEA. Files and backups are kept in Azure and Cloudflare R2 storage, encrypted at rest. Meetings run on our own servers in Azure. These providers process data for us, only on our instructions:

• Microsoft Azure: servers, databases, storage, and email delivery (Azure Communication Services).
• Cloudflare: website delivery, DNS and file storage (R2).
• Google Firebase Cloud Messaging and Apple Push Notification service: push notifications.
• Anthropic, OpenAI, Google and Deepgram: AI features, such as AI teammates, meeting captions, transcripts and notes.

When data leaves the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard UK law allows.

Browser storage

Glassa uses only strictly necessary cookies and browser storage: your sign-in session, an offline copy of your workspace, and your appearance settings. It has no advertising or analytics trackers.

How long we keep it

We keep your account while it is active, and security logs only as long as we need them to protect the service. Your organization's messages, notes, work items and mail stay in its workspace until your organization deletes them or closes the workspace.

Your rights

You can ask us to show you, correct, export or delete your personal data, or to restrict or stop using it. Email hello@easyloops.ltd from your account's address and we will reply within one month. For content your organization controls, you can also ask your organization's administrator. You can complain to the UK Information Commissioner's Office at ico.org.uk.

Changes and contact

If we change this policy in a way that matters, we will update the date above and tell organizations in Glassa or by email before the change applies. Questions and requests go to hello@easyloops.ltd. easyloops Ltd is registered in England and Wales, company number 17250950.