This Privacy Policy explains how Glisting collects, uses, shares, and protects your personal data and your images. It is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act, as amended by the CPRA (CCPA/CPRA), among other applicable laws. It forms part of our Terms of Service.
By using Glisting, you agree to the practices described here.
1. Data controller and contact
The controller responsible for processing your data is Glisting, operating internationally.
Contact / privacy requests: support@getglisting.com. Use this channel for any privacy-related request or to exercise your rights (Section 9).
Where required, we will appoint a representative under Article 27 GDPR; their details will be added here.
2. Scope
This Policy applies to all users of Glisting worldwide. Depending on where you live, you may have specific rights under the GDPR, the UK GDPR, the CCPA/CPRA, or other local laws, as described below.
3. What data we collect
a) Account data: name, email, password (stored encrypted), and account preferences.
b) Payment data: payments are processed by Stripe. We do not collect or store your card details. We receive from Stripe only the information needed to manage your subscription and credits (for example, payment status, plan, and billing details).
c) Images you upload: the property photos you submit for editing (original images) and the edited images generated for you. See Section 4, which covers these specifically.
d) Usage and technical data: access logs (date, time, IP address), device and browser type, credits consumed, projects created, and interactions with the platform. Collected for security and to operate the Service.
e) Cookies: see Section 7.
4. Your images: how we handle them
We know your property photos matter to your business. Therefore:
- We never use your images to train artificial-intelligence models: neither we nor our providers do.
- Your images are processed solely to generate the edit you requested and to deliver it to you.
- Editing is performed via the OpenAI image-generation API ("GPT Image"). Under that provider's API data policy, data submitted through the API is not used to train its models and is retained by it, at most, for a short period for security purposes before being deleted.
- Automatic deletion: original and edited images are kept only as long as needed for you to access and download them. 30 days after the project is completed/delivered, they are automatically deleted from our systems.
- We never sell your images and never share them for third-party advertising.
We recommend you download and save your edited images within the period above, because they cannot be recovered after deletion.
5. Who we share data with (sub-processors)
We do not sell your data. We share the minimum necessary with providers that help us operate the Service, under confidentiality and security obligations:
| Provider | Purpose | Data involved |
|---|---|---|
| OpenAI (image API "GPT Image") | Generate the image edits | Images submitted for editing |
| Stripe | Process payments, subscriptions, and refunds | Billing and payment data |
| Supabase | Database, authentication, and image storage | Account, images, usage data |
| Cloudflare | Application hosting and content delivery | Usage and technical data |
| Lovable | Platform on which the application is built and runs | Application usage data |
We may also disclose data to comply with a legal obligation, court order, or to protect rights, as permitted by law.
6. International data transfers
Some of the providers above (such as OpenAI and Stripe) process data outside your country, including in the United States. Where we transfer personal data from the EU/EEA or the UK, we rely on appropriate safeguards required by the GDPR/UK GDPR, such as the European Commission's Standard Contractual Clauses and the providers' data-protection commitments, to ensure an adequate level of protection. By using the Service, you understand that your data may be processed in these locations.
7. Cookies and similar technologies
We use essential cookies (for login and functionality) and, with your consent where required, analytics cookies to understand how the platform is used. You can manage cookies in your browser settings; disabling essential cookies may affect functionality.
8. Data retention
- Account data: kept while your account is active and, after closure, for the period needed to meet legal obligations.
- Images: automatically deleted 30 days after delivery (Section 4).
- Access logs: kept for the period required by applicable law.
- Payment / tax data: retained by Stripe for the legally required periods.
9. Your rights
If you are in the EU/EEA or the UK (GDPR / UK GDPR), you have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent at any time. The legal bases we rely on are: performance of a contract (to provide the Service), our legitimate interests (security and improving the platform, without using your images), your consent (e.g., marketing), and compliance with legal obligations. You may also lodge a complaint with your local supervisory authority.
If you are a California resident (CCPA/CPRA), you have the right to: know what personal information we collect and how we use it; access and delete it; correct it; and opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising your rights.
To exercise any right, email support@getglisting.com. We will respond within the timeframes required by applicable law. You may use an authorized agent where the law allows.
10. Security
We use technical and organizational measures to protect your data, such as password encryption, access controls, and secure transmission (HTTPS). No system is 100% secure; in the event of a significant security incident, we will notify you and the relevant authorities as required by law.
11. Children
Glisting is intended for users aged 18 and over. We do not knowingly collect data from children. If we learn that we have collected such data, we will delete it.
12. Changes to this Policy
We may update this Policy to reflect changes in the Service or the law. Material changes will be communicated by email or in the app. The date at the top shows the latest update.
13. Contact
Privacy questions or to exercise your rights: support@getglisting.com.
Glisting: your privacy and your images, protected.