Privacy Policy

Last updated: October 16, 2026

Who we are

Glauda (“we”, “us”) is operated by AFFARI IN RETE S.r.l., a company registered in Italy with registered office at Via Antonio Rosmini 45, 91022 Castelvetrano (TP), Italy (VAT, P.IVA: IT02864800814). We are the data controller for the personal data described in this policy. You can reach us at support@glauda.com.

What we collect

• Email address: used to sign you in via magic link, to contact you about your account, and to send you a small number of emails about your own trial and practice. See Emails we send below.
• Conversation transcripts: text of what you said (transcribed by our AI provider) and what the bot said back. We store these so you can review your past sessions in your account.
• Saved cards: words and phrases you save or import as flashcards (from a conversation's suggestions, its transcript, typed in yourself, or imported from a list you upload or paste, which is read in your browser: only the cards reach us, never the file), with their translation, an example sentence, what you originally said when a card corrects it, any tags you add, the romanization of words written in another script (such as pinyin for Mandarin) once it has been computed, and your review schedule. We store these so you can review them and so they can come up in your next conversations.
• Card audio: a spoken version of a saved card's word or phrase, generated by OpenAI's text-to-speech the first time you press play and cached so it plays instantly afterwards. It is computer-generated from the card's text, never a recording of your voice.
• First phrases you can say: at the total beginner level (A0), which of its first phrases you have said in each language, worked out from your own conversations, and any phrases you marked yourself as known or not yet. We use this only so your conversation partner can start from what you already know and move on to new phrases, and so you can see your progress. It is deleted with your account.
• Session metadata: language, level, scenario, voice or text, duration, timestamps. Used for usage tracking and product analytics.
• Country of sign-up: the two-letter country code (for example IT) that our hosting provider derives from your connection when you first sign in. We store the country only, never your IP address, and use it to understand where Glauda is used.
• Payment data: handled entirely by Stripe. We store only your Stripe customer and subscription IDs, never your card details.
• One authentication cookie set by our auth provider (Supabase) so you stay signed in. Strictly necessary for the service to work. No advertising or marketing cookies.
• Cookieless analytics via Vercel Analytics: anonymized, aggregated page-view counts and basic browser type. Not tied to any user identifier, no cross-session tracking. See our Cookie Policy for the full list and our analytics provider's privacy notes.
• Marketing cookies (with your consent): if you choose to allow marketing cookies, we set Meta's _fbp and _fbc cookies and forward page-view and conversion events (signup, free trial start) to Meta. This lets us measure which ads bring in real users so we can stop wasting money on the ones that do not. We set these only after you click Accept all or enable Marketing in Customize. See the Cookie Policy for the full list, duration, and how to withdraw consent.
• Your cookie consent choice: stored in a first-party cookie (glauda_consent_v1) for 6 months so we do not ask you again on every visit. If you are signed in, your choice may also be saved on your account so it follows you across devices.

What we do not store

Your voice is not retained. The microphone stream goes directly from your browser to OpenAI's Realtime API over an encrypted WebRTC connection. We only ever see the resulting text transcript. The only audio we store is the generated pronunciation of your saved cards (see Card audio above).

When you tap Translate on a message, its text is sent to our AI provider (OpenAI) to translate it. Neither the request nor the translation is stored.

Third parties we share data with

• Supabase: managed Postgres, auth and file storage provider. Hosts our database and the cached card audio in the EU (eu-west-1).
• OpenAI: provides the speech-to-speech model powering conversations, the text model that writes recaps, fills in saved cards, writes the romanization of Japanese, Korean and Arabic (Mandarin pinyin is computed on our own server) and translates a message when you ask, and the text-to-speech that voices saved cards. Subject to OpenAI's data usage policies; conversation content is not used to train their models for API customers per their data policy.
• Stripe: payment processing. Stores card details and billing information.
• Vercel: hosts the application.
• Resend: delivers our email. Receives your email address and the contents of the message being sent, and nothing else. EU and US infrastructure.
• Meta (Facebook / Instagram): processes advertising and conversion events only with your consent via the Marketing cookie category. We share the page URL, standard browser information (IP, user agent), and, after you sign up, a hashed (one-way) version of your email for ad attribution. Meta is a US processor; the transfer is covered by the EU-US Data Privacy Framework. You can withdraw at any time from Cookie preferences.

We never sell your data to advertisers or data brokers. We share data with the providers above only to the extent necessary to operate the service.

Emails we send

Two kinds, and nothing else. There is no newsletter, we do not buy or rent mailing lists, and we never share your address with anyone for their own marketing.

• Account and billing email: sign-in links, receipts, and anything else needed to run the service. These are part of the contract and cannot be turned off while you have an account.
• Emails about your own practice: at most four in total, ever, and never less than three days apart. They tell you what you have used of your free trial, what it costs to carry on, and ask why you stopped. Every one of them carries a one-click unsubscribe link, and one click stops all of them permanently. We keep a record of which ones we sent you and when, so that you are never sent the same one twice.

The second kind is sent under legitimate interest (Art. 6(1)(f)): you made an account, the message concerns that account and nothing else, the frequency is capped, and you can stop it in one click. Unsubscribing from it never affects your sign-in or billing emails. Email is delivered by Resend (see Third parties we share data with).

Lawful basis

We rely on the following lawful bases under GDPR Article 6:

• Contract (Art. 6(1)(b)): for everything strictly necessary to provide the service you signed up for. Account, sign-in, conversations, billing.
• Legitimate interest (Art. 6(1)(f)): for cookieless aggregated analytics (Vercel), for security and error monitoring, and for the small number of emails about your own trial described above. For analytics and monitoring the impact is minimal because no personal identifiers are involved; for those emails it is minimal because they concern only the account you created, are capped in number, and stop on one click.
• Consent (Art. 6(1)(a)): for marketing cookies (Meta pixel) and any other non-essential tracking. You can withdraw consent at any time from Cookie preferences; withdrawal does not affect the lawfulness of processing before withdrawal.

Your rights

You can export or delete your data at any time from your account page. If you delete your account, all your transcripts, saved cards, card audio, first phrases and metadata are permanently removed within 30 days; your Stripe subscription is canceled immediately.

If you're in the EU/UK, you have additional rights under GDPR (access, rectification, restriction, portability, objection). Email support@glauda.com to exercise them.

Retention

Your data stays as long as your account exists. After deletion, our automated processes purge it within 30 days. Backup snapshots are retained by Supabase for up to 7 days; we cannot manually purge those, but they expire automatically.

Changes

We'll update this page when material things change and email you if those changes meaningfully affect what we do with your data.

Contact

Questions, complaints, takedowns: support@glauda.com.