Glac Privacy Policy

Last updated: 28 October 2026.

1. Who we are

1.1 GLAC PTY LTD, a company registered in Australia (ACN 680 390 130, ABN 27 680 390 130, registered address 5 Kalimna Ave, Campbelltown SA 5074, Australia) (“we”, “us”), provides Glac (the “Service”). For the personal data described in this policy, we are the controller: we decide why and how it is used.

1.2 Contact us about privacy at privacy@glac.ai.

1.3 Our representatives in the EU and the UK. We have no office in the European Union or the United Kingdom, and we offer the Service to people there, so we have appointed representatives under Article 27 of the GDPR and Article 27 of the UK GDPR. You, and data protection authorities, can contact them instead of us about anything to do with how we handle personal data:

• in the European Union: [EU representative’s name], [address], [email address];
• in the United Kingdom: [UK representative’s name], [address], [email address].

1.4 Data protection officer. We have not appointed a data protection officer under the GDPR or the UK GDPR, because the kind of processing that requires one is not part of our business. Write to privacy@glac.ai to reach the person responsible for privacy at GLAC PTY LTD, who is also our data protection officer under Singapore’s Personal Data Protection Act 2012.

2. What this policy covers

2.1 This policy covers personal data about:

• people who visit our website at glac.ai;
• people who sign up, sign in to the console, or use the API, the command-line tool, the SDKs or the MCP server;
• members of customer Accounts, people invited to them, and billing contacts;
• people who contact us.

2.2 It does not cover personal data that our customers put into the Service: their programs, files, disks, databases, logs and the requests their apps receive (“Customer Content”). Each customer decides what to do with that data, and we process it for them under our Data Processing Agreement. If you use a site or app that one of our customers runs on the Service, for example at an address ending in glac.run or on the customer’s own domain, read that customer’s privacy notice. Section 9 explains what our platform itself records when that happens.

3. The personal data we collect

3.1 When you sign up and use the console:

• your email address and the Account name; your password, which we store only as an Argon2id hash;
• which Accounts you belong to and your role in each (owner, admin or member), and invitations you send or receive, including the invited email address;
• for each sign-in session: when it started and was last used, the IP address and the browser’s user agent;
• a record of security events on your login: sign-ups, email verification, sign-ins, failed sign-ins and why they failed, password resets and changes, sessions ended, and changes of membership, each with the IP address and a request ID. We also record failed sign-ins for addresses that have no login; that record is not shown to anyone through the Service.

The links we email to verify an address, reset a password or accept an invitation contain a one-time token. We keep only a hash of the token and an encrypted copy that is used to send the email.

3.2 When you use the API and the Service:

• your API keys, which we store only as hashes;
• an audit record of every call that changes something: which API key or user made it, the method and path, the result, a request ID, the IP address it came from, and the time;
• usage records: for each hour and each resource, the CPU, memory, requests, outbound traffic and storage used, with the metadata labels you attached;
• events about your resources and your Account (for example, created, deleted, a payment failed);
• the notices we email to the Account: the address, the subject and the text.

3.3 When you pay:

• the Account’s name, email address, billing address and, if you give one, tax ID, together with the result of its verification by the tax authority (which can include the registered business name and address);
• card details: the card itself is held by Stripe, our payment processor. We receive and keep its brand, last four digits, expiry date, issuing country, type (credit, debit or prepaid) and the fingerprint Stripe gives it;
• your charges, invoices, refunds, payment disputes and fraud warnings about payments to us;
• evidence of where you are, which tax law requires: the country (and state and postal code) of your billing address, the country that issued your card, and the IP address you paid from and its country. We look up the country of an IP address in a database kept on our own servers.

3.4 When you connect to a Sandbox with SSH: our gateway records who connected or tried to, from which IP address, with which of your registered keys (its fingerprint), to which Sandbox and as which user, and the IDs and exit codes of the commands run. It does not record what the commands are.

3.5 When you contact us: your messages and our replies, by email or on our community forum. What you post on the forum can be read by others who use it.

3.6 Our website: it uses no analytics and no advertising, and sets no analytics or advertising cookies (Section 6.3).

3.7 From others: Stripe tells us the outcome of payments, the card details listed above, fraud warnings and disputes. Tax authorities, through Stripe, tell us whether a tax ID is valid.

3.8 When you sign in with GitHub or Google: you can sign in to the console with your GitHub or Google account. We ask GitHub only for your email addresses (its user:email permission) and Google only for who you are and your email address (openid email). From what they send, we keep:

• the provider’s identifier for your account: your user number at GitHub, your account ID (sub) at Google;
• your GitHub username or, for Google, your email address there;
• the email address the provider gives as your primary one, if it gives one;
• when the provider was linked to your login, and when you last signed in with it.

GitHub’s answer also holds your public profile, such as your name and picture: we do not keep it, and we ask Google for neither. We keep no token from either provider: GitHub’s is used once, to read your account and its email addresses, and then revoked; from Google we use only its signed statement of who you are. If no login has the address yet, signing in with a provider makes one, as signing up does (Section 3.1). Your sign-ins with a provider, and the providers you link and take off, go into the security record of your login with the provider and your username or address there (Section 3.1).

We use this only to sign you in and to contact you about your account. We never sell it and never use it for advertising. To disconnect a provider, take it off in the console (Your settings, How you sign in), as long as another way to sign in is left (a password or the other provider): the link and what we kept with it are deleted then, apart from the security record’s entries, which last 90 days (Section 10). Deleting your login deletes every link it has. You can also remove the access you gave us in your GitHub settings (Applications, Authorized OAuth Apps) or in your Google Account (third-party connections); what we kept stays until you take the provider off in the console or delete your login.

4. How we use personal data, and our legal bases

We do not sell personal data, and we do not use it to build advertising profiles.

5. Decisions made automatically

5.1 Some decisions about your Account are made automatically:

• how much you can top up each month starts low and rises automatically 30 and 90 days after your first payment if there have been no disputes or fraud warnings;
• if your card’s issuer warns that a payment to us may be fraudulent, or a payment is disputed, the Account is put on hold automatically, and we may refund that payment;
• if the evidence of where you are disagrees, we may ask you to confirm your billing address, and some payments are held for review.

5.2 Our software makes these decisions from your payment history, the fraud warnings and disputes that card issuers report through Stripe, and the evidence of where you are (Section 3.3). A person reviews every hold before it is released. You can ask us to review any of these decisions, and to explain it, at privacy@glac.ai.

6. Cookies and similar technologies

6.1 Console. The console sets only the cookies it needs to keep you signed in: __Host-console, which keeps you signed in and expires 30 days after you last used it, and, while you sign in with GitHub or Google, __Host-console-oauth, which ties that sign-in to your browser and expires after ten minutes. Both are strictly necessary, can only be read by our server (not by scripts on the page), and are sent only over HTTPS to the console’s own host. The console also keeps, in your browser’s local storage, which Account and Project you used last, and, while you accept an invitation by signing in with GitHub or Google, the invitation in the tab’s session storage. The console loads nothing from other sites: no analytics, no advertising and no third-party scripts.

6.2 Stripe’s pages. When you pay or manage your card, you use pages hosted by Stripe (checkout.stripe.com, billing.stripe.com). Stripe’s privacy policy and cookie policy apply to them. In the same way, when you sign in with GitHub or Google, you use their pages, under their own policies.

6.3 Website. Our website sets no analytics or advertising cookies and loads no analytics or advertising scripts, so it has no cookie notice. It may keep a display preference in your browser’s storage, such as the color theme you choose, which stays in your browser. If we ever add analytics, we will ask for your consent first and change this policy as Section 14 says.

7. Who we share personal data with

7.1 Our service providers, who process it for us under contract:

• hosting providers, which run the servers of the Service;
• object storage providers, which keep encrypted backups of our database and other copies, and Cloudflare, Inc. (R2), which keeps the copy of our database that the standby follows (Section 8.2);
• Stripe, which processes payments, issues invoices, calculates tax and helps prevent fraud. Stripe also uses payment data for its own purposes as an independent controller, under its own privacy policy;
• Cloudflare, Inc. (Cloudflare Email Service), which sends our emails;
• Cloudflare, Inc., which hosts our website and answers our DNS.

The current list, with each provider’s location, is at https://glac.ai/subprocessors.

7.2 People in your Account. Owners and admins can see the Account’s members and invitations and the Account’s security record (who invited whom, who joined, role changes, the IP addresses of those requests). People who can read a Project’s audit log see which user or API key made each change.

7.3 Places you choose. Webhooks and log export endpoints that your Account sets up receive the events and logs you send to them.

7.4 Certificate authorities. When you add your own domain, we obtain a TLS certificate for it from a public certificate authority (Let’s Encrypt). Certificate authorities publish every certificate in public Certificate Transparency logs, so the domain name becomes public.

7.5 Others, when needed: our professional advisers, auditors and insurers; authorities and courts when the law requires it; and a buyer or successor of our business, or another company in our group, if the business is reorganized or sold.

8. Where personal data is kept, and transfers abroad

8.1 We run the Service in three Regions, North America, Europe and Asia-Pacific, on servers in the United States (North America) and the United Kingdom (Europe); Asia-Pacific has no servers yet.

8.2 Account, billing, usage and audit records are kept by our control plane in the United States, with a standby copy in the United Kingdom that is updated through object storage, and encrypted backups of them are kept in object storage in [country].

8.3 Our service providers process data in [countries].

8.4 Europe. We are based in Australia, which has no adequacy decision under the GDPR, the UK GDPR or Swiss law. If you give us personal data from the European Economic Area, the United Kingdom or Switzerland, those laws apply to how we handle it. When we pass personal data on to a service provider in a country without an adequacy decision, we protect it with the European Commission’s Standard Contractual Clauses, together with the UK Information Commissioner’s Addendum to them and the changes Swiss law requires, or, for a provider in the United States that is certified under the Data Privacy Framework, with that framework. You can ask us for a copy of these safeguards at privacy@glac.ai.

8.5 Australia. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988. We keep personal information on servers outside Australia (Section 8.1), and we are likely to disclose it to service providers in [countries] (Section 7.1). Before we disclose it to anyone outside Australia, we take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles.

8.6 Singapore. If you are in Singapore, the Personal Data Protection Act 2012 applies to the personal data we collect from you. Our data protection officer under that Act can be reached as Section 1.4 says.

8.7 United States. We do not sell or share personal information, as the California Consumer Privacy Act defines those words, and we do not use it for targeted advertising. Wherever in the United States you live, you can use the rights in Section 12, and we will not treat you differently for using them.

9. When you visit an app or site that a customer runs on the Service

9.1 Our edge servers pass your request to the customer’s Sandbox or App, and add your IP address to the request (the X-Forwarded-For header), so the customer receives it.

9.2 For Apps, we keep a log line for each request the customer’s instance answers: the time, a request ID, the method, the path without the query string, the status, how long it took, the size of the answer, which instance answered, and a trace ID if your request carried one. These lines do not contain the request’s headers or body, the query string, or your IP address. They belong to the customer, are kept for 3 or 30 days depending on the customer’s plan unless the customer deletes them sooner, and are sent wherever the customer exports its logs.

9.3 If an edge server cannot pass a request on, its system log records the request: the host name and address requested, your IP address and the request headers. Before writing, it replaces the signatures in host names and the tokens in addresses, and it leaves out the Cookie, Authorization and Referer headers and our own token header. These system logs are kept for [system log retention].

9.4 Everything else about your visit is up to the customer. Contact the customer first about your data.

10. How long we keep personal data

When you close an Account, we keep the Account and its Projects (closed), usage records, statements, the ledger, charges, audit records and the notices we sent, because tax, accounting and security require them, each for the period in the table. Data we delete from our database stays in its encrypted backups for about 30 days, as the last row says. What happens to the content of your Account after deletion is set out in Section 12 of our Data Processing Agreement.

11. How we protect personal data

11.1 Passwords are stored only as Argon2id hashes, and API keys and session cookies only as hashes. Secrets in our database (for example webhook signing keys and the values of your secrets) are encrypted with AES-256-GCM before they are written. Backups of our database are compressed and encrypted to a key that is not kept on our servers.

11.2 Connections to the console and the API use TLS. Our control plane and servers in other places talk to each other over WireGuard tunnels.

11.3 Every API call that changes something in an Account is recorded in the audit log of its Project. [Only staff who need it for their work can reach our servers.]

11.4 [Drafting note — remove before publishing: the database copy that keeps the standby up to date is not encrypted by our software, only by the storage provider (control/README.md, 热备). Write 11.1 to match production.]

12. Your rights

12.1 Wherever you live, you can ask us to:

• show you the personal data we hold about you and give you a copy of it;
• correct it;
• delete it;
• stop using it, or use it only in limited ways, if you object to our use of it;
• give it to you in a machine-readable form, or send it to someone else;
• stop using it for something you consented to, when you withdraw that consent.

12.2 You can do much of this yourself: see and end your sessions, read your own security record, change your password and your login’s email address, delete your login, change the Account’s email address, billing address and tax ID, read your usage, statements and invoices, and (as an owner) close the Account. For anything else, write to privacy@glac.ai. We answer within one month and may ask you to prove who you are.

12.3 We may keep some data even after you ask us to delete it, where the law requires us to (for example invoices and tax evidence) or where we need it to establish or defend legal claims.

12.4 Complaints. If you think we have mishandled your personal data, write to privacy@glac.ai; we answer within 30 days. You can also complain to a data protection authority: in the European Union, the authority of the country where you live or work; in the United Kingdom, the Information Commission, which took over from the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner; in Australia, the Office of the Australian Information Commissioner; in Singapore, the Personal Data Protection Commission.

13. Children

The Service is not meant for anyone under 16, and we do not knowingly collect personal data about them. If you think a child under 16 has given us personal data, write to privacy@glac.ai and we will delete it.

14. Changes to this policy

We may change this policy. We tell you by email at least 14 days before a change that affects how we use your personal data takes effect, and we publish every version with its date.

15. Contact

GLAC PTY LTD, 5 Kalimna Ave, Campbelltown SA 5074, Australia. Privacy: privacy@glac.ai. Our representatives in the European Union and the United Kingdom are in Section 1.3.