Privacy Policy

1. Introduction & Data Controller

Glowai is provided by QORVEL LTD, a company registered in England and Wales under company number 17329544, with its registered office at Dept 6940, 43 Owston Road, Carcroft, Doncaster, England, DN6 8DA. In this Privacy Policy, “QORVEL LTD”, “we”, “us” and “our” refer to QORVEL LTD, while “Glowai” or the “Service” refers to the Glowai platform, the website at glowai.me, and the AI-powered tools, features and related services available through it.

QORVEL LTD acts as the data controller in relation to personal data for which we determine the purposes and means of processing. This means that we are responsible for deciding why and how personal data is processed in connection with Glowai, except where another organisation acts as an independent controller for its own processing activities.

This Privacy Policy explains how we collect, use, store, disclose, protect and otherwise process personal data when you visit Glowai, create or use an account, purchase tokens or credits, use our AI-powered tools, submit prompts or other content, generate Output, communicate with us or otherwise interact with the Service.

We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Where the EU General Data Protection Regulation (“EU GDPR”) applies to particular processing activities, we process relevant personal data in accordance with its requirements as well.

This Privacy Policy should be read together with our Terms of Service and Cookie Policy. It does not override any rights available to you under applicable data protection law.

Questions about this Privacy Policy, our processing of personal data or the exercise of your data protection rights may be sent to [email protected]. You may also contact us by telephone at +44 7488 811236 or by post at our registered office.

2. Personal Data We Collect

The personal data we collect depends on how you interact with Glowai, which tools you use and the information you choose to provide.

When you create or manage a Glowai account, we may process account and identification information such as your name, email address, account identifier, account status and other information necessary to create, authenticate and administer your account. We also process login and authentication information, including password hashes, authentication tokens, session information and security-related records. We do not store passwords in plain text.

When you make a purchase, we process information relating to the transaction, which may include the amount paid, currency, date and time of purchase, token pack or other product purchased, order or transaction reference, payment status, refund status and information necessary to investigate payment disputes or chargebacks. Full payment-card credentials are processed by our authorised payment provider and are not stored in full on QORVEL LTD systems.

When you use Glowai's AI-powered functionality, we process the content you provide to the Service, including prompts, instructions, text, images, code, documents, files and other material you upload or submit (“Input”). We also process the text, images, code, audio, music, marketing material or other content generated through the Service in response to your Input (“Output”).

Input and Output may contain personal data about you or other individuals depending on the information you choose to provide. You are responsible for ensuring that you have an appropriate legal basis, permission or other right to provide personal data relating to another person where required by applicable law.

We may process information associated with your projects and use of Glowai, including project or file names, tools and features used, models used, timestamps, token consumption, purchase and balance information, request status, error information and other operational metadata necessary to provide and administer the Service.

When you access Glowai, we may automatically receive technical and device information such as your IP address, browser type and version, device type, operating system, language settings, approximate location derived from an IP address, session identifiers, access times, referring information, pages or tools accessed and technical logs relating to the operation and security of the Service.

We also use cookies and similar technologies, including browser storage and comparable identifiers, to operate the Service, maintain sessions, protect accounts, remember preferences, measure performance and, where permitted, understand how Glowai is used. More information about these technologies and the choices available to you is provided in our Cookie Policy.

If you contact us for customer support, submit a complaint, request a refund, report misuse or otherwise communicate with us, we process the information contained in those communications together with relevant account, technical or transaction information required to investigate and respond to the matter.

We may also receive limited personal data from third parties involved in providing Glowai, such as payment providers confirming transaction status, fraud-prevention and security providers providing risk information, authentication providers where applicable, analytics and infrastructure providers, or other service providers supporting the operation of the platform. The information received depends on the relevant service and our relationship with that provider.

We do not intentionally require users to provide special category personal data, such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health information or information concerning a person's sex life or sexual orientation. You should avoid including such information in Input unless it is genuinely necessary, lawful and appropriate for your use of the Service.

3. How We Collect Personal Data

We collect personal data in several ways depending on how you interact with Glowai.

We collect information directly from you when you create or update an account, make a purchase, submit Input, upload files, configure your preferences, contact customer support, request a refund, report a problem, exercise a data protection right or otherwise provide information to us.

Certain information is collected automatically when you access or use Glowai. This may include IP addresses, device and browser information, session identifiers, timestamps, usage information, security events, diagnostic information and other technical records generated by the operation of the Service. Cookies and similar technologies may also collect information automatically, subject to the consent requirements and choices described in our Cookie Policy.

We generate certain information through your use of Glowai, including Output, token consumption, account balance changes, project metadata, feature usage, transaction history, security records and information relating to the performance and reliability of the Service.

We receive transaction-related information from our payment providers when you make or attempt a purchase. This may include confirmation that a payment was approved or declined, transaction identifiers, payment method category, limited card information such as card brand or last digits where provided, refund information, chargeback information and fraud or risk indicators. Full card credentials are handled by the payment provider rather than QORVEL LTD.

We may also receive information from other service providers that help us operate, secure and support Glowai, including hosting and infrastructure providers, authentication services, analytics services, email delivery providers, fraud-prevention services and technical providers. We process such information only where it is relevant to the provision, security or administration of the Service or another lawful purpose described in this Privacy Policy.

4. How We Use Personal Data

We use personal data to create, authenticate, maintain and administer Glowai accounts, provide access to the Service, maintain account settings and preferences, manage login sessions and communicate with you about your account.

We process Input, Output, uploaded files and associated technical information to provide the AI-powered tools and other functionality you request. This includes receiving and processing prompts, transmitting information to relevant technical systems or service providers where necessary, generating Output, displaying results, storing projects where applicable and calculating token usage.

We use payment and transaction information to process and record one-time purchases, credit tokens to accounts, maintain token balances, issue receipts, administer refunds, investigate billing concerns and chargebacks, reconcile transactions and maintain appropriate financial records. Glowai does not operate subscription or automatic recurring billing arrangements.

We process account, technical and communication information to provide customer support, respond to enquiries and complaints, investigate errors, process refund requests, resolve payment issues and communicate important operational or security information relating to the Service.

We use personal data where reasonably necessary to administer, maintain and secure Glowai. This includes authentication, access control, detecting suspicious activity, preventing fraud and abuse, protecting accounts, identifying security incidents, enforcing technical restrictions and investigating potential violations of our Terms of Service.

We may process relevant account, Input, Output, technical and usage information to investigate and enforce our rules governing acceptable use. Depending on the circumstances, this may include detecting prohibited activity, reviewing reported content, restricting functionality, suspending accounts, preserving evidence and making disclosures to competent authorities where required or permitted by law.

We use technical, diagnostic and usage information to monitor the availability, reliability and performance of Glowai, identify errors and service interruptions, troubleshoot technical problems, manage infrastructure and determine whether service-level targets have been met.

We may use aggregated, statistical and appropriately de-identified information to understand how Glowai is used, evaluate features, improve usability, optimise performance and develop the Service. Where information has been irreversibly anonymised so that it no longer relates to an identifiable individual, it is not personal data for the purposes of applicable data protection law.

We process transaction, invoicing and related information to comply with accounting, tax, corporate record-keeping and other legal obligations. We may also process personal data where necessary to respond to lawful requests from courts, regulators, law-enforcement authorities and other competent bodies.

Personal data may be processed where reasonably necessary to establish, exercise or defend legal claims, investigate disputes, enforce contractual rights, respond to regulatory matters or protect the legal rights and interests of QORVEL LTD, our users or third parties.

Where permitted by applicable law, we may send communications concerning Glowai features, products or services that may be relevant to you. Where consent is legally required for marketing communications, we will obtain it before sending them. You may withdraw consent or opt out of marketing communications at any time. Operational, transactional, security and legal communications relating to your account or use of Glowai are not marketing communications and may continue where necessary.

5. Legal Bases for Processing

We process personal data only where we have a lawful basis for doing so under applicable data protection law. The legal basis depends on the type of information involved, the purpose for which it is processed and the circumstances in which the processing takes place.

We rely on performance of a contract where processing is necessary to provide Glowai in accordance with our Terms of Service or to take steps at your request before entering into that contract. This includes creating and administering your account, authenticating access, processing your Input, generating and delivering Output, maintaining your token balance, processing one-time purchases, providing paid functionality, handling eligible refunds and providing customer support relating to the Service.

We rely on compliance with legal obligations where we are required to process or retain personal data under applicable law. This may include accounting and tax requirements, corporate record-keeping, responding to valid requests from courts, regulators or law-enforcement authorities, complying with applicable consumer protection requirements and handling security or other matters where the law imposes a specific obligation on us.

We rely on our legitimate interests, or those of a third party where appropriate, where processing is necessary for a legitimate business or operational purpose and those interests are not overridden by your rights and freedoms. These interests may include protecting Glowai, our users and third parties against fraud, abuse and security threats, maintaining the reliability and integrity of the Service, preventing misuse, enforcing our Terms, investigating complaints and disputes, improving platform performance, maintaining appropriate business records, protecting our legal rights and establishing, exercising or defending legal claims. Where we rely on legitimate interests, we consider the nature and impact of the processing and the reasonable expectations of affected individuals.

We rely on consent where applicable law requires it. This may include the use of certain non-essential cookies or similar technologies and particular forms of electronic marketing. Where processing is based on consent, providing consent is voluntary unless the relevant functionality cannot technically operate without the information concerned.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. After withdrawal, we will stop the processing based on that consent unless another lawful basis permits or requires us to continue processing the relevant information. Cookie consent can be managed through the available cookie controls, and marketing consent can be withdrawn using the unsubscribe mechanism provided in relevant communications or by contacting us.

Different legal bases may apply to different processing activities involving the same category of personal data. Where circumstances change, the lawful basis relied upon may also change where permitted by applicable law, but we will not use personal data for an incompatible new purpose without an appropriate legal basis.

6. AI Content, Prompts & Model Training

When you use Glowai's AI-powered tools, we process the prompts, instructions, text, images, code, documents, files and other material you submit as Input, together with the Output generated in response. Processing may also include associated information such as timestamps, the tool or model used, token consumption, project information, request status and technical metadata necessary to provide the requested functionality.

We process Input and Output primarily to provide the Service you request. Depending on the relevant Glowai feature, this may involve receiving and analysing Input, transmitting it to the technical systems necessary to perform the requested operation, generating Output, returning the Output to your account or browser, storing content where the relevant feature provides saved projects or history, calculating token usage, preventing abuse and maintaining the security and reliability of the Service.

Input and Output may be processed through automated systems as an inherent part of providing AI functionality. Limited human access may occur where reasonably necessary for customer support, investigation of a technical or security incident, enforcement of our Terms, investigation of suspected abuse, compliance with applicable law or resolution of a dispute. Access to user content is restricted to personnel or service providers who require it for an authorised purpose and is subject to appropriate access controls and confidentiality requirements.

We do not use your Input or Output to train our AI models. We also do not permit service providers acting on our behalf to use your Input or Output for their own independent model-training purposes where they process that information as our processor. Where an external AI or technology provider is used to deliver a Glowai feature, we take reasonable steps to select and contract with providers whose processing arrangements are compatible with the commitments described in this Privacy Policy.

Where Glowai provides functionality that allows you to save projects, prompts or generated content, the relevant Input and Output may remain associated with your account until you delete it, close your account or the applicable retention period expires. Some copies may remain temporarily in backups, security systems or logs after deletion and may also be retained where necessary to comply with law, prevent fraud or abuse, resolve disputes or establish, exercise or defend legal claims.

You should exercise particular care before submitting confidential, sensitive or proprietary information to an AI system. Do not submit trade secrets, confidential business information, credentials, financial account information, health information, government identifiers or other sensitive information unless you have determined that doing so is necessary and appropriate for your intended use and you have the legal right to provide that information.

Glowai is not designed to require special category personal data. If you choose to include information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric information, sex life, sexual orientation or other specially protected information in your Input, you are responsible for ensuring that its submission and use are lawful. We may restrict processing of particular categories of information where necessary for legal, security or safety reasons.

Your Input may contain personal data or confidential information relating to another person. You must have an appropriate legal basis, permission or other authority to provide and process third-party information through Glowai where required by applicable law. You should not use Glowai to disclose personal or confidential information about another person unlawfully.

7. Payments & Transaction Information

Glowai operates on a one-time payment model. We do not operate subscriptions, automatic renewals or recurring billing arrangements. Each purchase is separately initiated and confirmed by you.

When you make or attempt a purchase, we may process transaction information including the amount, currency, purchase date and time, token pack or other item purchased, transaction or order reference, payment status, token crediting information and related account information. We use this information to complete and record purchases, maintain token balances, issue transaction confirmations, provide customer support, reconcile payments and comply with applicable financial record-keeping obligations.

Payment transactions are processed by authorised third-party payment providers. Payment information required to authorise the transaction is transmitted to the applicable provider. The payment provider may process your information under its own legal and regulatory obligations in addition to any processing it performs on our behalf.

QORVEL LTD does not store full payment-card credentials on its systems. Depending on the information returned by the payment provider, we may receive limited payment-method information such as card brand, payment method type, country, transaction identifier or the last digits of a payment card. This information may be used to identify transactions, provide support, investigate billing concerns and prevent fraud.

We maintain records of completed, failed, refunded and disputed transactions where reasonably necessary for operation of the Service and compliance with applicable law. These records may include transaction identifiers, amounts, currencies, timestamps, payment status, token allocations and relevant correspondence.

If you request a refund or a payment becomes subject to a chargeback or other dispute, we may process information relating to the original transaction, the reason for the request or dispute, supporting evidence, communications with you and information exchanged with the payment provider, card network, acquiring institution or other parties involved in resolving the matter.

Payment and transaction information may also be used to detect and prevent fraud, unauthorised transactions, payment abuse and attempts to circumvent our commercial or security controls. Where appropriate, we may receive or generate fraud and risk indicators associated with a transaction or account and use them to decide whether additional verification, review or protective measures are reasonably necessary.

We retain transaction, invoicing, refund and accounting records for the period necessary to satisfy applicable corporate, accounting and tax obligations, including records that must be retained for HMRC or other competent authorities. Where a record is relevant to an ongoing dispute, investigation or legal claim, it may be retained for longer where permitted or required by law.

8. Cookies & Similar Technologies

Glowai uses cookies and similar technologies to operate, secure and improve the website and platform. These technologies may include traditional browser cookies, local storage, session storage, pixels and similar identifiers. The technologies used, their purposes and the choices available to you are described in more detail in our Cookie Policy.

We use strictly necessary technologies to provide functionality that cannot reasonably operate without them. These technologies may be used to maintain authentication and sessions, protect accounts, prevent cross-site request forgery and other security threats, maintain essential platform state and remember choices necessary to deliver functionality you have requested. Where permitted by applicable law, strictly necessary technologies do not require consent because they are required to provide the Service or functionality requested by you.

We may use analytics and performance technologies to understand how Glowai is used, identify errors, measure page and feature performance, monitor reliability and help us improve the Service. Where applicable law requires consent before such technologies are placed or accessed on your device, we use them only after obtaining the required consent.

We may use preference technologies to remember choices such as language, theme, interface settings, editor preferences and recently used functionality. Whether consent is required for a particular preference technology depends on its purpose and applicable law.

Where Glowai uses advertising or campaign-measurement technologies, they may be used to understand the effectiveness of marketing campaigns, attribute visits or purchases to campaigns and limit unnecessary repetition. We do not activate non-essential advertising or measurement technologies before obtaining consent where consent is required by applicable law.

Where required, you can accept, reject or configure non-essential cookies and similar technologies through the cookie banner or preference controls made available through Glowai. Refusing non-essential technologies will not prevent the use of strictly necessary technologies required for the platform to function, but it may affect optional features that depend on the category you have disabled.

You may change your cookie preferences after making an initial choice where our preference controls provide that functionality. You may also block or delete cookies through your browser settings. Removing or blocking strictly necessary cookies may prevent authentication, account access or other essential Glowai functionality from operating correctly.

For further information about the categories of cookies and similar technologies used through Glowai, their purposes, third-party technologies and how to manage your choices, please see our Cookie Policy.

9. How We Share Personal Data

We share personal data only where reasonably necessary to provide, operate, secure and administer Glowai, process payments, comply with legal obligations, protect our rights or complete legitimate corporate activities. We do not disclose personal data to third parties simply because it may be commercially useful to them.

We may share personal data with hosting, cloud infrastructure, storage, database, security and other technical providers that supply the infrastructure required to operate Glowai. Depending on the services they provide, these providers may process account information, Input and Output, technical information, logs and other data necessary to host, transmit, store, secure or deliver the Service.

Glowai may use third-party AI models, APIs and other technology providers to provide particular AI-powered tools and functionality. Where necessary to fulfil your request, relevant Input and associated technical information may be transmitted to those providers and Output may be returned through their systems. We seek to limit the information shared to what is reasonably necessary for the relevant functionality and apply appropriate contractual and organisational safeguards where required by law.

We share transaction-related information with authorised payment providers and other parties involved in processing payments, refunds, chargebacks and payment disputes. Depending on the transaction, these parties may include payment processors, acquiring institutions, card networks, banks and digital-wallet providers. QORVEL LTD does not receive or store full card credentials where those credentials are collected directly by the payment provider.

We may use analytics, monitoring, diagnostics and performance providers to help us understand how Glowai operates, identify errors, measure reliability and improve the Service. Where these providers process personal data on our behalf, their access is limited to the purposes for which they have been engaged. Where cookies or similar technologies require consent, relevant analytics processing will take place only in accordance with the consent requirements described in this Privacy Policy and our Cookie Policy.

We may share contact and account information with email, customer-support and communications providers where necessary to send account verification messages, receipts, security notifications, service announcements, support communications and, where permitted, marketing communications.

Personal data may be disclosed to professional advisers such as lawyers, accountants, tax advisers and consultants where reasonably necessary to obtain professional advice, comply with our obligations, manage disputes or protect our legal interests. We may also provide relevant information to auditors and insurers where required for audit, insurance, risk-management or claims purposes.

We may disclose personal data to regulators, supervisory authorities, tax authorities, law-enforcement agencies and other competent public bodies where we are legally required to do so or where disclosure is otherwise lawful and necessary, including for the investigation or prevention of fraud, security incidents, serious abuse or other unlawful activity.

Personal data may also be disclosed in connection with court proceedings, arbitration, regulatory proceedings, legal claims, subpoenas, court orders or other lawful legal processes. Where legally permitted, we assess requests for personal data and seek to disclose only information that is reasonably necessary in the circumstances.

If QORVEL LTD is involved in a merger, acquisition, financing, restructuring, sale of business or assets, insolvency process or similar corporate transaction, personal data may be disclosed to prospective or actual purchasers, investors, lenders, advisers and other parties involved in the transaction where reasonably necessary and subject to appropriate confidentiality protections.

We do not sell your personal data. We also do not permit service providers acting on our behalf to sell personal data received from us or use it for purposes unrelated to the services they have been engaged to provide, except where another lawful relationship is clearly disclosed to you.

10. Processors & Third-Party Services

We use third-party service providers to support the operation of Glowai. Where a provider processes personal data on our behalf and according to our instructions, it acts as our processor for the relevant processing activity.

Processors may provide services such as cloud hosting, data storage, infrastructure, AI functionality, security, fraud prevention, analytics, customer support, communications, email delivery and payment-related technical services. We seek to provide processors only with the personal data reasonably necessary for the relevant service.

Where required by applicable data protection law, processors are engaged under written agreements containing appropriate data-processing provisions. These agreements require processors to process personal data only on documented instructions, subject to the circumstances permitted by law, and to provide appropriate protections for the information entrusted to them.

We require processors, where applicable, to implement appropriate technical and organisational security measures, maintain confidentiality, restrict access to authorised personnel, assist with relevant data protection obligations and appropriately manage any subprocessors they engage. The precise measures and obligations may vary according to the nature of the service, the information processed and the risks involved.

Not every third party involved in Glowai acts as our processor. Some organisations may act as independent data controllers because they determine their own purposes and means of processing personal data. This may apply, for example, to certain payment providers, banks, card networks, professional advisers, regulators or other organisations that process information to satisfy their own legal, regulatory or operational obligations.

Where a third party acts as an independent controller, its processing of personal data is governed by its own privacy notice and legal obligations. QORVEL LTD does not control how an independent controller processes personal data for its own purposes.

Glowai may also contain links to, integrate with or allow interaction with third-party websites, applications, platforms or services. If you choose to use those third-party services, their own terms and privacy practices may apply. You should review the relevant third party's privacy information before providing personal data directly to it.

11. International Data Transfers

Glowai is operated by a company established in England and Wales, but some of the service providers and technical systems used to provide the Service may be located outside the United Kingdom or may process personal data from other countries.

Where personal data protected by the UK GDPR is transferred to a country outside the UK that is not covered by applicable UK adequacy regulations, we use an appropriate transfer mechanism where required by law. Depending on the circumstances, this may include the UK International Data Transfer Agreement (“IDTA”), the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism recognised under UK data protection law.

Where personal data protected by the EU GDPR is transferred outside the European Economic Area (“EEA”), we rely on an appropriate transfer mechanism where required. This may include a European Commission adequacy decision, the European Commission Standard Contractual Clauses (“SCCs”), or another lawful transfer mechanism available under the EU GDPR.

Where the UK government or European Commission has formally recognised a country, territory or applicable framework as providing an adequate level of data protection, we may rely on the relevant adequacy regulation or decision for transfers covered by that recognition.

Where contractual safeguards such as the IDTA, UK Addendum or SCCs are used, we may also assess the circumstances of the transfer and the legal and practical protections applicable in the destination country where required. Additional technical, contractual or organisational safeguards may be implemented where reasonably necessary to provide an appropriate level of protection.

Such additional safeguards may include encryption, access restrictions, data minimisation, contractual confidentiality requirements, limitations on onward transfers and procedures for handling legally binding requests for access to personal data.

Some international transfers may also be permitted under specific exceptions provided by applicable data protection law, including where a transfer is necessary for the performance of a contract or the establishment, exercise or defence of legal claims. We rely on such exceptions only where legally appropriate.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing Glowai, maintaining security, complying with legal and regulatory requirements, resolving disputes and establishing, exercising or defending legal claims. Different categories of personal data are therefore subject to different retention periods.

Account information is generally retained while your Glowai account remains active. Following account closure, core account records may normally be retained for up to 90 days, unless a longer period is necessary because of a legal obligation, fraud or security investigation, payment dispute, legal claim or another legitimate and lawful reason.

Input and Output saved through Glowai are generally retained while they remain associated with your account and until you delete the relevant content or close your account. Where a particular tool does not provide persistent storage, content may be retained for a shorter operational period necessary to provide, secure or troubleshoot the Service.

When you delete content or close your account, the relevant information may not disappear immediately from every technical system. Deleted content may remain temporarily in backups, disaster-recovery systems, security records or other restricted technical copies until those systems are overwritten or the applicable retention cycle expires. Such copies are not restored to active use except where necessary for recovery, security or legal purposes.

Transaction, payment, refund, invoicing and accounting records may be retained for up to seven years, or for another period required by applicable tax, accounting, corporate or financial record-keeping law. These records may remain after an account is closed because QORVEL LTD may be legally required to retain evidence of completed transactions.

Customer-support communications and related records are retained for as long as reasonably necessary to respond to the relevant matter, maintain appropriate records of our interaction with you, improve support, resolve disputes and protect legal rights. The retention period may vary depending on the nature of the request.

Technical, diagnostic and security logs are generally retained for approximately 90 days. They may be retained for longer where reasonably necessary to investigate a security incident, suspected fraud, abuse, technical failure or other matter requiring continued investigation.

Records relating to suspected fraud, chargebacks, payment disputes, abuse, account enforcement or security incidents may be retained for longer than ordinary operational records where reasonably necessary to prevent repeated abuse, resolve a dispute, comply with legal obligations or establish, exercise or defend legal claims.

Where information is relevant to pending or reasonably anticipated litigation, regulatory proceedings, investigations, legal claims or another formal dispute, ordinary deletion schedules may be suspended and relevant information may be placed under a legal hold until the matter and any applicable retention requirements have been resolved.

At the end of the applicable retention period, personal data is deleted, securely disposed of or anonymised so that it can no longer reasonably be associated with an identifiable individual, unless continued retention is required or permitted by applicable law. Information that has been irreversibly anonymised may be retained and used for statistical, analytical, security or service-improvement purposes because it no longer constitutes personal data.

13. Data Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access, misuse or other forms of unlawful processing. The measures we apply take into account the nature and sensitivity of the information, the purposes of processing, the risks to individuals, available technology and the reasonable costs of implementation.

Where appropriate, personal data is protected using encryption in transit and at rest. Communications between your browser or device and Glowai are protected using appropriate transport security, and we apply encryption or comparable safeguards to stored information where appropriate to the nature and risk of the data.

Access to personal data is restricted according to business and operational need. We use access controls designed to ensure that employees, contractors and service providers can access personal data only where necessary for an authorised purpose. Access rights may be limited according to role and may be reviewed, modified or withdrawn as responsibilities change.

Glowai uses authentication and session-management measures designed to protect user accounts and administrative systems. You are responsible for maintaining the confidentiality of your login credentials and for taking reasonable precautions to prevent unauthorised access to your account. You should use a strong and unique password and should not share authentication credentials with other people.

We use monitoring, logging and other security controls to help identify suspicious activity, unauthorised access, technical failures, fraud, misuse and security incidents. Security and technical logs may record events such as login attempts, account activity, administrative actions, system errors and network or application events where appropriate.

We assess security considerations when selecting suppliers that process personal data on our behalf. Where appropriate, contractual requirements are used to require processors to implement technical and organisational measures appropriate to the risks associated with their processing. We may also review relevant security information, certifications, contractual commitments or other assurances provided by suppliers.

We maintain procedures for identifying, assessing, managing and responding to personal data and information-security incidents. Where we become aware of a personal data breach, we assess the nature and potential consequences of the incident and take appropriate steps to contain, investigate and remediate it. Where required by applicable data protection law, we will notify the relevant supervisory authority and affected individuals within the legally applicable timeframes.

You also play an important role in protecting your information. You are responsible for keeping your credentials secure, protecting devices used to access Glowai and notifying us promptly at [email protected] if you believe that your account has been compromised or used without authorisation.

No method of transmission, storage or information security can guarantee absolute security. Although we take measures designed to protect personal data, we cannot guarantee that unauthorised access, loss, misuse or other security incidents will never occur.

14. Your Data Protection Rights

Depending on where you live and the data protection law applicable to the relevant processing, you may have a number of rights concerning your personal data. These rights are subject to the conditions, limitations and exemptions provided by applicable law.

You may have the right of access, which allows you to ask whether we process personal data relating to you and, where applicable, obtain a copy of that personal data together with information about how it is processed.

You may have the right to rectification of personal data that is inaccurate and the right to have incomplete personal data completed, taking into account the purposes for which it is processed.

You may have the right to erasure, sometimes referred to as the “right to be forgotten”, in circumstances provided by law. This right is not absolute. We may retain information where continued processing is necessary to comply with a legal obligation, establish, exercise or defend legal claims, protect security, prevent fraud or for another lawful reason that permits continued retention.

You may have the right to restrict processing in certain circumstances, including while the accuracy of information is being verified or while an objection to particular processing is being considered. Where processing is restricted, we may continue to store the relevant information and process it where otherwise permitted by law.

Where processing is based on our legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation. We will consider the objection and stop the relevant processing unless we have compelling legitimate grounds to continue that override your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing, you may object to that processing at any time.

Where the applicable legal requirements are satisfied, you may have the right to data portability. This may allow you to receive personal data that you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, request that it be transmitted to another controller.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and does not affect processing conducted under another lawful basis.

You may also have rights in relation to decisions based solely on automated processing, including profiling, where those decisions produce legal effects concerning you or similarly significantly affect you. Where such rights apply, you may be entitled to obtain human intervention, express your point of view and contest the decision, subject to the exceptions provided by applicable law.

You have the right to make a complaint to a competent data protection supervisory authority if you believe that our processing of your personal data infringes applicable data protection law. We encourage you to contact us first so that we have an opportunity to investigate and respond to your concern, but you are not required to do so before exercising your right to complain.

15. How to Exercise Your Rights

To exercise a data protection right or make a privacy-related request, contact us at [email protected] and describe the right you wish to exercise and the personal data or processing activity concerned. Where possible, you should contact us from the email address associated with your Glowai account so that we can more easily identify the relevant information.

We may need to verify your identity before responding to a request. Verification is intended to protect personal data from unauthorised disclosure, alteration or deletion. Depending on the nature of the request and the information involved, we may ask for reasonable additional information necessary to confirm your identity or your relationship to the relevant account. We will not request more information than reasonably necessary for verification.

We will respond to valid requests within the period required by applicable data protection law. Under the UK GDPR and EU GDPR, this will normally be within one month after receipt of the request, subject to any permitted extension.

Where a request is particularly complex or you have submitted several requests, applicable law may allow us to extend the response period. Where an extension applies, we will inform you within the initial response period and explain the reason for the delay and the expected additional time required.

Data protection requests are generally handled without charge. However, where a request is manifestly unfounded or excessive, particularly because it is repetitive, applicable law may permit us to charge a reasonable fee reflecting the administrative cost of dealing with the request or to refuse to act on it. Where we refuse a request, we will provide the information required by applicable law about the reasons for the refusal and available complaint rights.

You may appoint an authorised representative to submit a request on your behalf where permitted by applicable law. We may require evidence that the representative has authority to act for you and may also need to verify your identity directly before disclosing, deleting or modifying personal data.

Some rights are not absolute and may not apply in every circumstance. Where we cannot fully comply with a request because of a legal exemption, conflicting legal obligation, rights of another person or another lawful reason, we will explain this where required by law.

16. Automated Processing & Profiling

Glowai is an AI-powered service and necessarily uses automated systems to receive requests, process Input, generate Output, allocate token usage, operate platform functionality and perform technical and security functions.

We may use automated systems to identify potentially suspicious account or transaction activity, detect security threats, protect accounts, prevent fraud and identify patterns that may indicate attempts to circumvent payment, usage or security controls. These systems may use technical, account, transaction and usage information relevant to the risk being assessed.

Automated systems may also be used to identify potential violations of our Terms of Service, including abuse, prohibited content, malicious activity, spam or attempts to interfere with the Service. Automated indicators may contribute to decisions about whether activity requires additional review or temporary protective measures.

Where reasonably necessary to protect Glowai, users or third parties, automated systems may temporarily restrict a transaction, request, feature or account while potentially suspicious activity is assessed. The use of automated restrictions does not mean that every automated detection results in permanent enforcement action.

Where appropriate, particularly where a decision may materially affect access to a paid account or otherwise have a significant impact on a user, automated signals may be reviewed by authorised personnel before or after enforcement action. You may contact us if you believe that an automated security, fraud or abuse-control measure has been applied incorrectly.

We do not intend to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you unless the processing is permitted under applicable data protection law. Where we carry out such automated decision-making and applicable law grants you specific rights, we will provide the information and safeguards required by law, which may include the ability to request human intervention, express your point of view and contest the decision.

The generation of AI Output in response to a prompt is automated processing, but it is ordinarily initiated at your request and is intended to provide content or functionality rather than make a legal or similarly significant decision about you.

17. Marketing Communications

Where permitted by applicable law, we may use your contact information to send you communications about Glowai, including information about new tools, features, products, offers, platform developments and other services that we believe may be relevant to you.

We will send electronic marketing communications only where we have an appropriate lawful basis. Where applicable law requires your prior consent, we will ask for that consent before sending marketing communications. In circumstances where the law permits us to rely on legitimate interests or another applicable basis, we may send relevant communications subject to your right to object or opt out.

Where consent is the basis for marketing, you may withdraw it at any time. You may also unsubscribe from marketing emails by using the unsubscribe link included in the relevant communication or by contacting us at [email protected]. We will process opt-out requests as required by applicable law and may retain limited information necessary to record and respect your marketing preference.

Opting out of marketing does not prevent us from sending operational, transactional, security or legal communications that are necessary in connection with your Glowai account or use of the Service. These may include account verification messages, purchase confirmations and receipts, refund or payment-dispute communications, security alerts, changes materially affecting the Service or our legal terms, responses to support requests and other non-marketing notices.

We do not sell your contact details to third parties for their own independent marketing purposes.

18. Children’s Privacy

Glowai is intended exclusively for users who are 18 years of age or older. The Service is not directed at children, and individuals under 18 are not permitted to create or use a Glowai account.

We do not knowingly seek to collect personal data from children through Glowai. Our registration and eligibility requirements are designed on the basis that users must be adults capable of entering into the agreement governing the Service.

If we become aware that a person under 18 has created an account or provided personal data to Glowai in circumstances that are inconsistent with our age requirements, we may restrict or close the relevant account and take reasonable steps to delete the personal data associated with it.

Certain information may need to be retained where deletion is not immediately possible or where retention is required or permitted by law, including for security, fraud prevention, child-safety reporting, legal claims or compliance with obligations imposed on us. Information may also remain temporarily in restricted backup systems until the relevant backup cycle expires.

If you are a parent, guardian or another person who reasonably believes that an individual under 18 is using Glowai or has provided personal data through the Service, please contact us at [email protected] and provide sufficient information for us to investigate the matter. We may request additional information where reasonably necessary to identify the relevant account or verify the circumstances of the report.

19. Third-Party Websites & Services

Glowai may contain links to third-party websites, applications, platforms or services that are not operated by QORVEL LTD. The presence of a link does not mean that we control the third party or its processing of personal data.

The Service may also allow you to interact with or use third-party integrations, APIs, payment services, AI technologies, authentication services or other external functionality. Where you choose to connect or interact with such a service, personal data may be transmitted to or received from the third party to the extent necessary to provide the requested integration or functionality.

Where a third party processes personal data on our behalf as a processor, its processing is subject to the safeguards described elsewhere in this Privacy Policy and the applicable contractual arrangements with us. Where a third party acts as an independent controller and determines its own purposes and means of processing, its handling of your personal data is governed by its own privacy policy, terms and legal obligations.

We do not control the privacy, security, retention or other data-handling practices of independent third-party controllers. Before providing personal data directly to an external service or enabling an optional third-party integration, you should review the relevant provider's privacy information and determine whether you are comfortable with its practices.

If you leave Glowai by following a link to an external website or service, this Privacy Policy generally no longer governs information you provide directly to that third party.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Glowai, the personal data we process, our technology and service providers, our operational practices, applicable law, regulatory guidance or other developments affecting how we process personal data.

We may make minor changes, such as clarifications, corrections, formatting updates or changes that do not materially affect the way personal data is processed, by publishing an updated version of this Privacy Policy.

Where a change is material and significantly affects how we collect, use, disclose or otherwise process personal data, we will take reasonable steps to bring the change to your attention before or when it takes effect, as required by applicable law.

Depending on the circumstances, notification may be provided by email to the address associated with your Glowai account, through an in-app notification, by a prominent notice on Glowai or through another appropriate method.

Where a change requires consent under applicable data protection law, we will request that consent rather than treating continued use of the Service as consent to processing for which affirmative consent is legally required.

The “Last updated” date displayed at the beginning of this Privacy Policy identifies when the current version was most recently revised. We encourage you to review this Privacy Policy periodically to remain informed about how Glowai processes personal data.

21. Complaints & Supervisory Authorities

If you have a concern or complaint about how QORVEL LTD collects, uses, stores, shares or otherwise processes your personal data, you may contact us at [email protected]. Please provide sufficient information about your concern to allow us to identify the relevant account, processing activity or personal data and investigate the matter appropriately.

We encourage you to contact us first so that we have an opportunity to investigate and address your concern. We will review privacy complaints in accordance with applicable data protection law and will aim to provide a clear response within the legally applicable timeframe. Contacting us first is not a requirement and does not restrict your right to approach a competent supervisory authority directly.

As QORVEL LTD is established in England and Wales, you have the right to lodge a complaint with the UK Information Commissioner’s Office (“ICO”) if you believe that our processing of your personal data infringes applicable UK data protection law. Information about the ICO, including its current contact details and complaint procedures, is available through the ICO’s official website.

Where the EU GDPR applies to our processing of your personal data, you may also have the right to lodge a complaint with a competent data protection supervisory authority in the European Economic Area (“EEA”), including the supervisory authority in the country of your habitual residence, place of work or the place where you believe an infringement occurred.

Nothing in this Privacy Policy limits or excludes any right to make a complaint, seek a remedy or contact a supervisory, regulatory or judicial authority where that right is provided by applicable law. You are not required to waive any statutory complaint or enforcement right as a condition of using Glowai.

Making a privacy complaint to us or exercising a data protection right will not result in discriminatory treatment or an unjustified restriction of your access to Glowai.

22. Contact Information

QORVEL LTD is responsible for the personal data processed through Glowai where it acts as the data controller.

For questions about this Privacy Policy, requests concerning your personal data, withdrawal of consent, objections to processing, privacy complaints or other data protection matters, you can contact us using the details below.

QORVEL LTD

Company No. 17329544

Registered in England and Wales

Registered office: Dept 6940, 43 Owston Road, Carcroft, Doncaster, England, DN6 8DA

Privacy email: [email protected]

Phone: +44 7488 811236

When contacting us about personal data associated with a Glowai account, we recommend using the email address linked to that account. We may request additional information where reasonably necessary to verify your identity, protect personal data against unauthorised disclosure and locate the information relevant to your request.

Please do not send passwords, full payment-card details or other authentication credentials when contacting us about a privacy matter.