Scope

This Privacy Policy explains how GLAIR, as the Data Controller, collects, uses, discloses, stores, and/or otherwise processes Personal Data (“Personal Data Processing”) in the provision of the GLChat service, including through web, mobile, API, SDK, and any other implementation models, such as cloud, on-premise, hybrid, and private deployments.

This Privacy Policy applies to:

• Individual users who access or use GLChat

• Organizations or enterprise customers that use GLChat

• Organizations or enterprise customers that use GLChat

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• Personal Data: any data concerning an identified or identifiable individual, either directly or indirectly.

• Personal Data Subject: an individual to whom the Personal Data is attached.

• Personal Data Processing: any activity on Personal Data, including obtaining, collecting, storing, using, disclosing, transferring, deleting, and/or destroying.

• Personal Data Controller: the party that determines the purpose and control of Personal Data Processing, namely GLAIR.

• Personal Data Processor: the party that carries out Personal Data Processing on behalf of the Personal Data Controller.

• Consent: lawful, explicit, and informed consent from the Personal Data Subject or their representative for the Processing of Personal Data.

• Business Partner: affiliated parties, customers, suppliers, vendors, or cooperation partners that have a contractual relationship with GLAIR.

• Third Party: a party outside GLAIR who is not an employee, user, or business partner, who may access Personal Data within certain limits and in accordance with applicable laws.

Personal Data Processed by GLAIR

Personal Data Provided by Users

GLAIR may process Personal Data that you provide directly when using GLChat, including but not limited to:

• Name and contact details (such as email address)

• Organization or tenant information

• User roles and access permissions

• Authentication identifiers, such as SSO references or tokens

• Other information relevant to the use of the services

Chat and Content Data

In the use of GLChat, GLAIR may process:

• Chat messages and conversation content

• Uploaded documents or files

• Knowledge base content

• AI-generated responses

• Conversation memory data, if such features are enabled by your organization

GLChat does not use user content to train external AI models unless explicitly agreed with customers.

Data Collected Automatically

When you access GLChat, certain data may be collected automatically, including:

• IP address (subject to masking or anonymization policies)

• Device, browser, and operating system information

• Usage logs, performance logs, and security logs

• Cookies and similar technologies

Such data is used to support service functionality, maintain system security, and improve the quality and performance of GLChat.

Purpose and Legal Basis of Personal Data Processing

GLAIR processes Personal Data in the provision of the GLChat service for the following purposes:

• To provide, operate, and improve GLChat services;

• To manage business relationships and the implementation of agreements with customers;

• To maintain system security, user authentication, and to prevent misuse and fraud;

• To conduct service performance analysis and improve user experience;

• To fulfill legal obligations and comply with applicable laws and regulations.

Personal Data Processing is carried out based on one or more of the following legal bases:

• Your Consent

• Performance of a contract

• Compliance with a legal obligation

Cookies and Analytics Tools

GLChat uses cookies and analytics tools to support service functionality, maintain security, and understand and improve service usage.

Cookies are small files stored on your device that help manage user sessions, support authentication, and enable basic system functions. Cookies are not used to identify you personally outside the context of your use of the GLChat service.

Analytics tools are used to analyze system usage, service performance, and user interaction patterns in an aggregated and/or anonymized manner, for the purpose of improving the quality, reliability, and security of GLChat.

GLChat will display a notification to Users when they first access the Website and/or Services in the form of a Cookies usage notice, which contains information regarding the types of Cookies used, the purposes of Data Processing, and the preference options that may be determined by the User.

Users are given the opportunity to:

• Give consent to all Cookies;

• Reject non-essential Cookies; and/or

• Set Cookies preferences based on certain categories.

GLAIR uses several types of Cookies to support the operation of the website and Services, improve security, and understand how users interact with our website, as follows:

1. Strictly Necessary Cookies (Mandatory / Essential)

   • Data/Information Collected: 

     • Session ID

     • Authentication token

     • IP address (limited)

     • Device and browser information

     • Security data (e.g., anti-CSRF tokens, technical error logs)

   • Consequences for the User:
     If the User chooses to disable these Cookies, the Website cannot guarantee basic service functions, including the login process, session security, and access stability, so some or all main features may become unavailable or experience operational failure.

2. Functional Cookies (Preferences)

   • Data/Information Collected: 

     • Preferred language

     • Time zone

     • Display preferences (theme, layout)

     • Non-directly identifiable personal settings

   • Consequences for the User:
     If the User rejects these Cookies, preferences will not be saved and the User must reconfigure settings each time they access the Website, although the main service functions can still be used.

3. Performance / Analytics Cookies

   • Data/Information Collected:

     • IP address (anonymized/limited)

     • Page visit history

     • Session duration and feature interactions

     • Device and browser information

     • Error data and system performance data

   • Consequences for the User:
     If the User rejects these Cookies, there will be no direct impact on service usage; however, the User’s experience cannot be analyzed for the purpose of improving service quality.

4. Marketing / Advertising Cookies

   • Data/Information Collected:

     • Browsing history and advertisement interactions

     • Content preferences and interests

     • Advertising identifier (advertising ID)

     • Device and browser data

     • Cross-site activity (if using third parties)

   • Consequences for the User:
     If the User rejects these Cookies, the User can still access the services; however, the advertisements displayed will not be personalized and behavioral tracking for marketing purposes will not be carried out.

5. Third-Party Cookies

   • Data/Information Collected:

     • Transaction data (if using a payment gateway)

     • Communication data (if using a chatbot)

     • Social media account information (if using social login)

     • Technical integration data (IP, device, session)

   • Consequences for the User:
     If the User rejects third-party Cookies, some integrated services may not function optimally or may not be usable.

The consent given by the User will be recorded and may be changed or withdrawn at any time through the Cookies settings feature available on the Website.

Cookies processing will only be carried out in accordance with the preferences and consent chosen by the User.

If the User rejects or restricts the use of certain Cookies, some features, service personalization, and/or analytics and marketing functions may become limited or unavailable; however, the User can still access the essential basic functions of the Website.

Processing in the Business and Enterprise Context

When GLChat is used by organizations or enterprise customers, Personal Data Processing may be carried out in accordance with system configurations, the customer’s internal policies, and the applicable contractual arrangements.

Enterprise customers may:

• Define additional purposes for Personal Data Processing in line with their internal policies;

• Configure system features, data storage, and data management settings;

• Manage user access and controls within their organizations.

In such cases, GLAIR acts as a Data Processor where Personal Data Processing is performed based on the instructions of the enterprise customer acting as the Data Controller.

Data Sharing and Disclosure

GLAIR may disclose or share Personal Data with the following parties, as necessary and in accordance with applicable laws and regulations:

• Business Partners who process data on behalf of GLAIR (Personal Data Processors);

• Technology infrastructure providers, including cloud service providers, security service providers, and supporting systems;

• Authorized parties, if required by laws and regulations or by a lawful order from the competent authority.
  

All parties receiving Personal Data are bound by confidentiality obligations and data protection requirements under contractual agreements and applicable information security standards.

International Data Transfers

Where Personal Data is transferred outside the territory of Indonesia, GLAIR ensures that such transfers are conducted with an adequate level of protection in accordance with applicable laws and regulations.

Cross-border data transfers are carried out only if:

• The destination country provides an adequate level of personal data protection or

• Appropriate safeguards are in place, including contractual agreements and suitable technical and organizational security measures.

• If the destination country does not have a level of protection equivalent to the protection of Personal Data in Indonesia, GLChat shall first conduct a Data Privacy Impact Assessment (DPIA) and obtain renewed consent from the Personal Data Subject or the lawful party responsible for the Personal Data.
  

In the context of enterprise customers, international data transfers shall be subject to and governed by the applicable contractual arrangements between GLAIR and the customer.

Personal Data Security

GLChat implements adequate physical, technical, and organizational security measures to protect Personal Data from information security risks related to Confidentiality, Integrity, and Availability (CIA), in accordance with the ISO/IEC 27001:2022 standard.

Personal Data Retention

GLAIR retains Personal Data only for as long as necessary to fulfill the purposes of Personal Data Processing as described in this Privacy Policy and in accordance with applicable laws and regulations.

The retention period may vary depending on the deployment model of the GLChat service and the contractual arrangements with customers, including:

• Personal Data will be deleted and/or destroyed after the service relationship ends, in accordance with the applicable data retention policy.
  

• For enterprise Users, data retention applies from the time the Cooperation Agreement ends and is not renewed.

• For individual Users, data retention applies when the User is declared inactive, namely when the User does not log in to the GLChat system for 1 (one) consecutive year.

• Certain data may be retained for a longer period if required by law or necessary for audit and compliance purposes.
  

• Customers may submit requests for data deletion, anonymization, or copying in accordance with the applicable agreement.

Requests related to data retention or deletion may be submitted via email to dataprotection@glair.ai.

Data Subject Rights

In accordance with applicable laws and regulations, you have the right to:

• Access your Personal Data

• Correct or update inaccurate Personal Data

• Request the deletion of your Personal Data in accordance with legal requirements

• Withdraw your Consent to the processing of your Personal Data

• Object to or request restriction of the processing of your Personal Data

• Lodge a complaint with GLAIR or with the competent authority

Requests for the exercise of these rights may be submitted via email to dataprotection@glair.ai.

Children’s Privacy

The GLChat service is not intended for use by children under the age of 16 (sixteen), unless specifically governed by a written agreement with an enterprise customer.

GLAIR does not knowingly collect or process Personal Data of children without a valid legal basis and lawful consent in accordance with applicable laws and regulations.

Data Breach and Incident Handling

In the event of a security incident or a Personal Data breach, GLAIR will take the necessary measures in accordance with applicable laws and information security standards, including:

• Conducting an assessment of the impact and risks of the incident;

• Taking immediate actions to handle the incident;

• Taking mitigation measures to prevent further losses or damages;
  

• Providing notification to the relevant Personal Data Subjects or the responsible Personal Data Controllers;
  

• Providing notification to the authorized authorities and/or the public, if required by law;
  

• Documenting the incident as part of information security management.
  

Changes to This Privacy Policy

GLAIR may update this Privacy Policy from time to time.
Any changes will be published through GLAIR’s official website, the GLChat service, or other official communication channels.
‍
By continuing to use the GLChat service after the updated Privacy Policy becomes effective, you are deemed to have acknowledged and agreed to such changes.