Privacy Policy

At the time of this Privacy Policy, GLOXA is provided as an early-stage product (MVP). Our publicly available services currently consist of:

• the GLOXA website;
• the Early Access waitlist;
• the feedback submission form; and
• related communications regarding the project.

At this stage, GLOXA does not provide user accounts, paid subscriptions, cloud-based message storage, AI conversation history, enterprise workspaces, or similar account-based services. If these features are introduced in future releases, this Privacy Policy may be updated to explain how any additional personal data is processed.

GLOXA is designed with a privacy-first approach. Our objective is to minimize the collection of personal data and process only the information necessary to operate, improve, secure, and communicate about our services.

Please read this Privacy Policy carefully. By accessing or using our website or submitting information through our available forms, you acknowledge that you have read and understood this Privacy Policy.

If you do not agree with this Privacy Policy, please discontinue use of the website and refrain from submitting personal information to GLOXA.

This Privacy Policy applies solely to the processing of personal data in connection with the services made publicly available by GLOXA at the time of publication, including the GLOXA website, the Early Access waitlist, feedback and contact forms, and related communications with users and prospective users.

At the time this Privacy Policy was published, GLOXA does not provide user accounts, subscription services, cloud-based message storage, enterprise workspaces, AI conversation history, or other account-based functionality.

As GLOXA evolves, additional products, features, integrations, desktop application functionality, AI-powered services, subscription plans, or enterprise offerings may become available. Where those services involve the processing of additional categories of personal data or materially different processing activities, this Privacy Policy will be updated and, where required by applicable law, supplemented with additional privacy notices before such processing begins.

This Privacy Policy does not apply to third-party websites, applications, platforms, or services that are not owned or controlled by GLOXA, even if they are accessible through links or integrations provided by GLOXA.

Contents

1. Introduction
2. Scope of This Privacy Policy
3. Website and Desktop Application
4. Definitions
5. Who We Are
6. What Personal Data We Collect
7. How We Use Personal Data
8. Lawful Bases for Processing
9. How We Share Personal Data
10. International Data Transfers
11. Data Retention
12. Your Privacy Rights
13. Data Security
14. Automated Processing and Artificial Intelligence
15. Children's Privacy
16. Third-Party Websites and Services
17. Service Providers and Subprocessors
18. Changes to This Privacy Policy
19. Regional Privacy Notices
20. Contact Us

This Privacy Policy applies to both:

• the GLOXA website available at https://gloxa.app (the "Website"); and
• the GLOXA desktop application, including all related software, updates, installers, AI-powered functionality, licensing mechanisms, and associated services (the "Desktop Application").

The Website and the Desktop Application may process different categories of information depending on the functionality you use.

Certain processing activities apply only to the Website (such as website analytics and cookies), while others apply only to the Desktop Application (such as software licensing, application diagnostics, crash reporting, update delivery, and AI-assisted translation functionality).

Unless expressly stated otherwise, references to the "Services" throughout this Privacy Policy include both the Website and the Desktop Application.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

"Applicable Data Protection Laws" means all laws and regulations governing the collection, use, disclosure, storage, transfer, or other processing of personal data that apply to GLOXA or the processing activities described in this Privacy Policy.

"GLOXA," "we," "our," or "us" means the operator of the GLOXA website and related services.

"Personal Data" means any information relating to an identified or identifiable natural person, or any equivalent definition under applicable law.

"Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, deletion, or destruction.

"Services" means the GLOXA website, Early Access waitlist, feedback forms, related communications, and any other services made available by GLOXA from time to time.

"User," "you," or "your" means any individual who visits our website, joins the Early Access waitlist, contacts us, submits feedback, or otherwise interacts with GLOXA.

For the purposes of applicable data protection laws, including the General Data Protection Regulation ("GDPR"), GLOXA is the controller of the personal data described in this Privacy Policy unless otherwise stated.

Data Controller

GLOXA

Website: https://gloxa.app

Email: hello@gloxa.io

If you have any questions about this Privacy Policy, our privacy practices, or the processing of your personal data, you may contact us using the details above.

If GLOXA appoints a legal entity, representative, Data Protection Officer ("DPO"), or an EU or UK representative in the future where required by applicable law, this Privacy Policy will be updated to include the relevant contact information.

The personal data we collect depends on how you interact with GLOXA. At the current MVP stage, we collect only the information necessary to operate our website, manage our Early Access program, respond to inquiries, improve our services, and maintain the security and reliability of our website.

Information You Choose to Provide

You may voluntarily provide personal data when you:

• join the Early Access waitlist;
• submit feedback or feature requests;
• contact us by email;
• respond to surveys or questionnaires;
• otherwise communicate with GLOXA.

Please avoid submitting sensitive personal data unless it is reasonably necessary for your communication with us.

Information We Do Not Currently Collect

At the time of this Privacy Policy, GLOXA does not intentionally collect or maintain:

• user account information;
• payment or billing information;
• subscription management data;
• cloud-stored conversations or message history;
• AI conversation history linked to identifiable users;
• enterprise workspace information; or
• user profile data beyond the information voluntarily submitted through our website.

If additional features requiring the processing of personal data are introduced in future releases, this Privacy Policy will be updated before those features become available.

We use personal data only where we have a legitimate business purpose and a valid legal basis under applicable data protection laws.

Depending on how you interact with GLOXA, we may use your personal data for the following purposes:

No Sale of Personal Data

GLOXA does not sell your personal data. We do not disclose personal data to third parties for their own independent marketing purposes.

Future Services

If future versions of GLOXA introduce user accounts, subscriptions, cloud-based features, enterprise services, AI-powered functionality, or additional integrations, we may process additional categories of personal data necessary to provide those services.

Before such processing begins, this Privacy Policy will be updated to describe the additional data collected, the purposes of processing, and any applicable legal bases.

Where the General Data Protection Regulation ("GDPR") or other applicable data protection laws apply, GLOXA processes personal data only where a valid legal basis exists.

Depending on the specific circumstances, we rely on one or more of the following legal bases:

Legitimate Interest Assessment

Where we rely on our legitimate interests as the legal basis for processing, we carefully assess whether the processing serves a legitimate business purpose, is necessary to achieve that purpose, and does not override the interests, rights, and freedoms of individuals. Where appropriate, we implement technical and organizational safeguards to minimize any impact on individuals' privacy.

Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.

Additional Jurisdictions

If you reside in a jurisdiction that provides additional privacy rights or requires different legal bases for processing personal data, GLOXA will process your personal data in accordance with the applicable laws of that jurisdiction to the extent they apply.

We do not sell, rent, or license your personal data to third parties for their own marketing or commercial purposes.

We share personal data only where necessary to operate GLOXA, comply with legal obligations, protect our legitimate interests, or with your consent where required by law.

Service Providers

We engage carefully selected third-party service providers that perform services on our behalf. These providers process personal data only under our instructions and only to the extent necessary to provide their services.

Depending on the services you use, we may share personal data with providers supporting:

• website hosting and infrastructure;
• website analytics and performance monitoring;
• email delivery and communications;
• website security and abuse prevention;
• software development, diagnostics, and operational monitoring.

Our current technology stack includes services provided by companies such as Vercel (website hosting and infrastructure), Resend (transactional email delivery), Google Analytics (website analytics), and Microsoft Clarity (website analytics and user behavior insights). The specific third-party providers we use may change over time as GLOXA evolves.

Business Transfers

If GLOXA is involved in a merger, acquisition, investment transaction, corporate restructuring, asset sale, or similar business transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate confidentiality obligations.

Legal Requirements

We may disclose personal data where we reasonably believe disclosure is necessary to:

• comply with applicable laws or regulations;
• respond to lawful requests from public authorities;
• comply with court orders or legal process;
• protect the rights, safety, property, or security of GLOXA, our users, or others;
• investigate fraud, abuse, security incidents, or violations of our Terms of Service.

Professional Advisors

Where necessary, we may disclose personal data to our professional advisors, including legal counsel, accountants, auditors, insurers, or other consultants, provided such recipients are subject to appropriate confidentiality obligations.

No Third-Party Marketing

We do not provide personal data to third parties so they can market their own products or services to you. Where a third party processes personal data on our behalf, they are contractually required to process that data only for the purposes authorized by GLOXA and in accordance with applicable data protection laws.

GLOXA operates internationally and works with service providers located in various jurisdictions. As a result, your personal data may be processed, stored, or accessed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where personal data originating from the European Economic Area ("EEA"), the United Kingdom, or Switzerland is transferred internationally, we take appropriate measures designed to ensure that such transfers comply with applicable data protection laws.

Depending on the circumstances, these safeguards may include:

• adequacy decisions adopted by the European Commission or other competent authorities;
• the European Commission's Standard Contractual Clauses ("SCCs") or equivalent contractual safeguards;
• transfers to organizations participating in recognized international data transfer frameworks where applicable; or
• other lawful transfer mechanisms permitted under applicable data protection laws.

We also seek to work with service providers that implement appropriate technical and organizational security measures designed to protect personal data regardless of where it is processed.

International data transfer practices may change as our infrastructure, service providers, or legal obligations evolve. Where required by law, we will update this Privacy Policy to reflect material changes affecting international transfers.

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with applicable legal obligations, resolve disputes, enforce our agreements, and protect our legitimate business interests.

The retention period for particular categories of personal data depends on the nature of the information and the purpose for which it was collected. As a general principle:

When personal data is no longer required for the purposes for which it was collected, we will delete, anonymize, or securely dispose of the information, unless continued retention is required or permitted by applicable law.

Where technically feasible, we also seek to minimize the amount of personal data we retain and periodically review whether stored information remains necessary for the purposes described in this Privacy Policy.

Depending on your location and the applicable privacy laws, you may have certain rights regarding your personal data. Where required by law, GLOXA will honor applicable privacy rights and respond to verified requests within the timeframes established by applicable legislation.

Your rights may include the following:

Exercising Your Rights

To exercise any applicable privacy rights, please contact us at hello@gloxa.io. To protect your privacy and the security of personal data, we may request information reasonably necessary to verify your identity before responding to your request.

We may decline or limit a request where permitted or required by applicable law, including where we are unable to verify your identity, where disclosure would adversely affect the rights of others, or where another legal exemption applies.

California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), including the right to know, access, correct, delete, and limit the use of certain personal information, subject to applicable exceptions.

At the time of this Privacy Policy, GLOXA does not sell or share personal information for cross-context behavioral advertising as those terms are defined under applicable California law.

Other Jurisdictions

Residents of other jurisdictions may have additional privacy rights under applicable local laws. Where such laws apply, GLOXA will provide those rights in accordance with the applicable legal requirements.

We take the security of personal data seriously and implement appropriate technical, organizational, and administrative measures designed to protect personal data against unauthorized access, accidental loss, misuse, alteration, disclosure, or destruction.

Our security measures are designed taking into account the nature of the personal data processed, the risks involved, the current state of technology, and the cost of implementation, consistent with applicable data protection laws and industry practices. Depending on the nature of the services provided, these measures may include:

• encryption of data in transit where appropriate;
• access controls based on the principle of least privilege;
• authentication and authorization mechanisms;
• infrastructure and application security controls;
• monitoring and logging of security-related events;
• regular software updates and security maintenance;
• restricted access to personal data by authorized personnel only; and
• contractual confidentiality obligations for employees, contractors, and service providers where applicable.

While we strive to protect personal data using commercially reasonable safeguards, no method of transmitting information over the Internet or storing electronic information can be guaranteed to be completely secure. Accordingly, GLOXA cannot guarantee or warrant the absolute security of any information transmitted to or stored by our systems.

In the event we become aware of a personal data breach, we will respond in accordance with applicable legal requirements, including notification obligations where required by law.

GLOXA is an AI-powered product designed to help users communicate across language barriers. Artificial intelligence technologies are used to support certain functionality of our services.

Current MVP

At the time of this Privacy Policy, GLOXA's publicly available services are limited to the website, Early Access waitlist, feedback forms, and related communications. The current public MVP does not process users' private messenger conversations, maintain AI conversation history, create user profiles, or make automated decisions that produce legal or similarly significant effects on individuals.

Future AI Functionality

Future releases of GLOXA may introduce AI-powered translation features, desktop application functionality, language assistance, personalization, or other intelligent capabilities. If such features involve the processing of additional categories of personal data, this Privacy Policy will be updated before those features become generally available.

Automated Decision-Making

GLOXA does not currently use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals, as described under applicable data protection laws, including Article 22 of the GDPR. Should this change in the future, we will implement appropriate safeguards, provide any notices required by applicable law, and update this Privacy Policy accordingly.

Human Oversight

Where appropriate, we seek to design AI-assisted functionality with appropriate human oversight, transparency, security, and privacy considerations, consistent with applicable laws, industry standards, and responsible AI principles.

GLOXA is intended for use by individuals who are legally permitted to use our services under the laws applicable in their jurisdiction.

Our website and services are not directed to children, and we do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If we become aware that we have collected personal data from a child in violation of applicable law, we will take reasonable steps to delete that information as soon as practicable.

If you believe that a child has provided personal data to GLOXA in circumstances where such collection is not permitted, please contact us at hello@gloxa.io so that we can investigate and take appropriate action.

Our website may contain links to third-party websites, applications, platforms, or services that are not owned, operated, or controlled by GLOXA.

This Privacy Policy applies solely to GLOXA and does not apply to the privacy practices of third parties. We encourage you to review the privacy policies of any third-party websites or services you choose to visit, as we are not responsible for their content, privacy practices, or data processing activities.

The inclusion of a link to a third-party website or service does not constitute an endorsement, recommendation, or representation by GLOXA unless expressly stated.

GLOXA relies on carefully selected third-party service providers to operate, secure, maintain, and improve its website and related services. These providers process personal data only to the extent necessary to perform services on our behalf and are required to protect personal data in accordance with applicable contractual obligations and data protection laws.

At the time of this Privacy Policy, our primary service providers include:

As GLOXA develops, we may engage additional service providers for functions including, but not limited to:

• cloud infrastructure;
• customer support;
• payment processing;
• subscription management;
• authentication;
• security monitoring;
• AI services;
• operational analytics;
• software diagnostics; and
• other services necessary to operate and improve GLOXA.

Any additional providers will be selected based on appropriate security, privacy, and legal standards applicable to the services they provide. Where required by applicable law, we will update this Privacy Policy or publish an updated list of significant service providers to reflect material changes.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, business operations, or applicable laws.

When we make material changes, we will update the "Last Updated" date at the beginning of this Privacy Policy and, where required by applicable law, provide additional notice through appropriate means.

Your continued use of GLOXA after an updated Privacy Policy becomes effective constitutes your acknowledgment of the revised Privacy Policy. Where applicable law requires your consent for specific changes, we will obtain such consent before those changes take effect.

Privacy and data protection laws vary across jurisdictions. This Privacy Policy is intended to provide a general description of how GLOXA processes personal data on a global basis. However, additional rights, obligations, or disclosures may apply depending on your country, state, or region of residence.

Where required by applicable law, GLOXA may publish supplementary privacy notices, regional addenda, or jurisdiction-specific disclosures to address local legal requirements. Such notices shall supplement this Privacy Policy and, in the event of any inconsistency, shall prevail to the extent required by applicable law.

Nothing in this Privacy Policy is intended to limit or exclude any rights that you may have under mandatory provisions of applicable data protection or privacy laws.

If you have any questions about this Privacy Policy, our privacy practices, or how we process personal data, please contact us:

GLOXA

Website: https://gloxa.app

Email: hello@gloxa.io

We will make reasonable efforts to respond to privacy-related inquiries within the timeframes required by applicable law.