Privacy Policy

GlintPost ("we", "us", "our") provides a product communication platform that enables businesses to embed changelog, roadmap, and feedback widgets on their websites. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

1. Roles and Definitions

• GlintPost Customers ("Customers") — Businesses that sign up for GlintPost and embed our widgets on their websites. Customers are the Data Controllers for end-user data collected through their widgets.
• End Users ("Visitors") — People who interact with GlintPost widgets embedded on a Customer's website (e.g., viewing changelogs, voting on roadmap items, submitting feedback).
• GlintPost — Acts as a Data Processor when handling end-user data on behalf of Customers through our widgets. Acts as a Data Controller for Customer account data (signup, billing, authentication).

2. Data We Collect

2.1 Customer Account Data (Controller)

When you create a GlintPost account, we collect:

• Name, email address, and password (hashed with bcrypt)
• Organization name
• Billing information processed by Razorpay (we do not store payment card details)

2.2 End-User Widget Data (Processor)

When visitors interact with widgets embedded on Customer sites, we process:

• Visitor ID — A pseudonymous identifier (v_UUID) stored in the visitor's browser localStorage. This is only created when a visitor takes an explicit action (like, vote, or submit feedback), never on passive page views.
• Engagement events — Likes, dislikes, votes, and view counts linked to the visitor ID.
• Feedback responses — Answers submitted through feedback forms.
• Suggestions — Feature suggestions submitted through the roadmap widget.
• Datalayer context (optional) — If provided by the Customer, may include: plan, role, region, platform, version, company, and locale.

2.3 Data We Do Not Collect

• We do not collect IP addresses through our widgets.
• We do not use browser fingerprinting.
• We do not set HTTP cookies through our widgets.
• We do not use third-party analytics or tracking pixels in widgets.

3. Browser Storage (Cookies & localStorage)

GlintPost widgets use localStorage (not cookies) to store minimal functional data. Here is a complete list of keys:

Only glintpost_visitor_id is sent to our servers. All other keys are used purely for local UI state and never leave the browser.

4. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)) — Processing Customer account data to provide our services.
• Legitimate interest (Art. 6(1)(f)) — Displaying widget content (changelogs, roadmap items) on Customer sites. No personal data is collected during passive viewing.
• Consent by action (Art. 6(1)(a)) — When a visitor explicitly clicks Like, Vote, or Submit, they initiate data processing. The visitor ID is only created at this moment. Customers may also obtain prior consent via their own Consent Management Platform (CMP).

5. How We Use Your Data

• Provide, operate, and maintain the GlintPost platform
• Process and display engagement metrics (vote counts, like counts)
• Deduplicate votes, reactions, and feedback submissions
• Send transactional emails (account verification, password reset)
• Process billing through Razorpay
• AI-powered suggestion matching (optional, configured by Customer) — suggestion text may be sent to third-party AI providers. See Section 7.

We do not use end-user widget data for our own marketing, analytics, or profiling purposes. We do not sell personal data.

6. Data Retention

• Customer account data — Retained while the account is active. Deleted upon account deletion request.
• Widget engagement data (events, votes, views) — Retained as long as the Customer's account is active.
• Feedback responses — Retained until the Customer deletes the feedback form or their account.
• Verification tokens — Automatically deleted after 1 hour (password reset) or 24 hours (email verification).

7. Sub-processors and Third-Party Services

We use the following third-party services to operate GlintPost. Each processes data on our behalf under appropriate agreements:

AI providers are only used when a Customer explicitly enables AI features and provides their own API key. See our Sub-processors page for the most current list.

8. Data Security

• Passwords are hashed using bcrypt (12 salt rounds)
• AI API keys are encrypted at rest using AES-256-GCM
• All data in transit is encrypted via HTTPS/TLS
• Widget API endpoints are protected by API key authentication
• Cross-origin access is controlled by strict domain allowlisting (no wildcards)

9. Your Rights

For GlintPost Customers

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your account and all associated data
• Export your data in a portable format
• Object to or restrict processing

For End Users (Visitors)

Since GlintPost acts as a Data Processor for widget data, end users should direct data access, deletion, or portability requests to the website owner (our Customer) who embedded the widget. Customers can fulfill these requests through the GlintPost dashboard.

End users can also clear their local widget data at any time by calling GlintPost.destroy() in the browser console, or by clearing their browser's localStorage.

10. Consent Management for Widget Embeds

GlintPost widgets support integration with Consent Management Platforms (CMPs). Customers embedding our widgets are responsible for obtaining appropriate consent from their users under applicable law.

We provide the following tools:

• GlintPostConfig.consent = false — Prevents widget interaction until consent is granted
• GlintPost.consent(true) — Enables widget interaction after CMP consent callback
• GlintPost.destroy() — Clears all GlintPost data from localStorage and removes widget DOM elements

See our documentation for detailed integration guides.

11. International Data Transfers

Data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required, and Data Processing Agreements with all sub-processors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify Customers of material changes via email or an in-app notice. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your rights, please contact us:

• Email: privacy@glintpost.com