Using a help widget on a manufacturer’s website? Section 5 covers the questions you type into it. Go to section 5
Summary
Plain language, about 1 minute- What we collect
- Your account details, the manuals you upload and the questions people type into the help widget, plus the logs we need to run the service.
- What we don’t do
- We don’t sell personal data, and it isn’t used to train AI models: not by us, and not by our AI providers under their current terms.
- Where it’s stored
- In the United States: our database and file storage are hosted on AWS in us-east-1.
- Your choices
- You can ask to access, correct, delete or export your personal data. Write to privacy@glassleaf.ai.
1. Who we are
Glassleaf is operated by 9to5Central. This policy describes how Glassleaf handles personal data when you use our service or visit glassleaf.ai.
We’re a business-to-business platform: most of the data we process belongs to the manufacturers who use us, not their end users. You can reach us about privacy at privacy@glassleaf.ai.
2. What this policy covers
This site (glassleaf.ai), the dashboard at app.glassleaf.ai, and the help widget that manufacturers embed on their own websites. Our Terms of service govern your use of Glassleaf.
The service is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children.
3. Information we collect
| Category | Examples | Why | Kept for |
|---|---|---|---|
| Account details | Email, name, company name and password (hashed). With Google sign-in, the email and profile name Google shares with us. | To run your account and send account, security and billing email. | While your account is active. |
| Manuals you upload | The PDFs and other source material you upload, and the content generated from them. | To provide the service to you and your end users. | While your account is active. |
| Widget questions | The question text, the answer served, citations, timestamps and an anonymous session ID. | To answer the question and show your team what customers ask. See section 5. | While your account is active. See section 8. |
| Usage and operational data | Logs of API calls, dashboard activity and system events. | To operate the service and detect abuse. | Agreed before a production pilot. See section 8. |
| Billing data | Payment is handled by Stripe. We don’t store payment cards. | To take payment for paid plans. | Held by Stripe, subject to its own privacy practices. |
Manual content. The PDFs and other source materials you upload, plus the AI-generated content derived from them, are customer content. Original PDFs are stored privately. Rendered page previews are stored in private storage and delivered only through short-lived signed URLs generated per response, so the embedded widget can show visual citations without the underlying images being addressable by URL.
4. How we use it
- To provide and improve the service for you and your end users
- To process payments and manage your account
- To send transactional email (account, security, billing)
- To detect and prevent abuse, fraud and security incidents
- To comply with legal obligations and respond to lawful requests
Data sharing. We don’t sell personal data. We share data only with the subprocessors in section 6 to provide the service, and when required by law. Aggregated, de-identified usage statistics may be shared publicly, for example the number of manuals processed in a year.
5. Help widget conversations
When people use the help widget on a manufacturer’s website, we collect the question text, the answer served, citations, timestamps and an anonymous session ID.
A person may type personal information into a free-text question. Before a question is stored for Insights, contact details such as email addresses, phone numbers, serial numbers, names and addresses are replaced with tokens. This redaction is best effort and can miss unusual formats.
For questions asked in a manufacturer’s widget, the manufacturer who controls that widget is the controller and we are the processor. We coordinate with them on any request about that data.
6. Subprocessors
We send manual content and end-user questions to third-party AI providers (Anthropic, OpenAI) to generate responses. These providers process the data on our behalf under their commercial terms; under their current policies, API content is not used to train their public models. Embeddings and short-lived caches are stored on our infrastructure.
Our infrastructure providers are listed in section 7. A current subprocessor list is available on request: privacy@glassleaf.ai.
7. Where data is stored
Production data lives in Supabase (Postgres and Storage) hosted in AWS us-east-1. Background jobs run on Trigger.dev. Web traffic is served by Vercel. Caching uses Upstash Redis. Each provider has its own SOC 2 or ISO 27001 certifications; we can share details on request.
International transfers. Our infrastructure is in the United States. If you access the service from outside the U.S., your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses or comparable mechanisms when required.
Security. All traffic is served over TLS. Data at rest is encrypted in our providers’ storage layers. Access to production data is restricted to engineers with operational need. We will notify affected customers without undue delay if a security incident materially impacts their data.
8. How long we keep it
We retain account, manual and content data for as long as your account is active. Organization deletion removes database records and attempts to remove associated source files and rendered pages. Configurable retention, automatic chat-log expiry, backup-deletion guarantees and self-serve data export are not shipping features today. Until they are, export, deletion or retention requests are handled through privacy@glassleaf.ai and must be agreed in writing for production pilots.
9. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete or export your personal data, or to object to processing. Contact privacy@glassleaf.ai to exercise any of these rights. For end-user data, we coordinate with the manufacturer who controls the widget on which you interacted; we are the processor, they are the controller.
10. Changes to this policy
We may update this policy periodically. Material changes will be communicated by email or in-product notice before they take effect.
11. Contact
- Privacy questions
- privacy@glassleaf.ai
- General contact
- hello@glassleaf.ai
See our Terms of service for the broader agreement governing your use of Glassleaf.