Privacy Policy

GLINR Studios ("we", "us", or "our") operates glinr.com and the products built under it. This policy explains what personal information we collect, why we collect it, how long we keep it, and what rights you have over it.

We are incorporated in Delaware, USA. If you have questions, email [email protected].

Account data: name, email address, hashed password (bcrypt, cost 12). We never store your plaintext password.

Usage data: pages visited, features used, error events. Collected anonymously via PostHog with IP anonymization enabled.

Payment tokens: when you subscribe, Stripe handles card data directly. We store only a non-reversible Stripe customer ID and subscription status.

Communications: emails you send to support or legal. Retained to resolve your request.

Browser metadata: IP address (hashed within 24 h), browser type, OS, referrer. Used for security and aggregate reporting.

To provide the service you signed up for (contract performance).

To send transactional emails: receipts, password resets, security alerts (contract performance).

To detect abuse, fraud, and unauthorized access (legitimate interest).

To improve the product through aggregate usage data (legitimate interest).

To comply with tax and financial regulations (legal obligation).

For anything else, we ask first (consent).

We use a small number of cookies. Essential cookies are required for the site to work. Analytics cookies are anonymized and help us understand usage. See our Cookie Policy at /legal/cookies for the full list and instructions on how to manage or disable them.

We share data with the third-party services below, strictly to operate the platform. Each has its own privacy policy linked in our Cookie Policy and in the full list at /legal/subprocessors.

Vercel (hosting), Neon (database), Stripe (payments), Plaid and SimpleFIN (read-only bank connections for Quarter), AWS SES (email), PostHog (analytics), Inngest (background jobs), Cloudflare R2 (document storage).

We do not share data with advertising networks, data brokers, or anyone not on this list.

Access: request a copy of the data we hold on you.

Portability: export your account data as JSON or CSV from Account -> Privacy -> Export.

Correction: ask us to fix inaccurate data.

Erasure: request deletion of your account and personal data. We comply within 30 days, subject to legal hold requirements.

Restriction: ask us to pause processing while a dispute is resolved.

Objection: object to processing based on legitimate interest.

Withdraw consent: for any processing that relies on your consent, you can withdraw at any time.

To exercise any of these rights, email [email protected]. We respond within 30 days. EU/UK residents may also lodge a complaint with their local supervisory authority.

Account data: kept while your account is active, plus 30 days after deletion to allow data export.

Transaction records: 7 years for tax and legal compliance.

Support communications: 3 years from last interaction.

Analytics: anonymized within 24 hours of collection; aggregate reports retained indefinitely.

Backups: automatically purged 7 days after creation.

Our services are not intended for anyone under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has created an account, email [email protected] and we will delete it promptly.

We are based in the USA and our sub-processors operate in the USA. If you are accessing from the EU or UK, your data is transferred under EU Standard Contractual Clauses (SCCs) and, where applicable, the UK Addendum.

Vercel and Neon both hold SOC 2 Type II certifications. Stripe is PCI DSS Level 1 certified.

We may update this policy. When we do, we post the new version here with an updated date. For significant changes affecting your rights, we email registered users at least 14 days in advance.

Privacy questions: [email protected]

Security reports: [email protected]

General: [email protected]

GLINR Studios, incorporated in Delaware, USA.