Who this covers#
Glowwer is a service that reads a business’s public website, drafts a week of social-media posts for it, and — once the business owner approves them and chooses to publish them — publishes them to the social accounts the owner connects. It is operated by DesignersGrid, Inc., whose details are under Operator and contact.
This policy applies to glowwer.com, the Glowwer application, and the messaging channels we offer (such as WhatsApp, where enabled). It does not cover the social platforms you connect or the websites we read on your behalf; each has its own privacy policy.
Glowwer is built for businesses and the people who run them. It is not directed to children, and you must be at least 18 to use it (see Children).
What we collect#
Information you give us
- Account identity. Your name, email address and the sign-in identifiers our authentication provider issues. If you sign in through a third-party identity provider, we receive the name and email that provider shares. We do not receive or store your password.
- Your business and brand. The website address you paste, and anything you add or correct in your brand profile: business name, what you sell, tone, colours, fonts, locations, and the instructions you give the Creative Director in plain words.
- Uploaded assets. Photos, logos and other files you upload or choose to keep from your website. They are stored so they can appear in your posts.
- Generated content and your edits. The captions, images and plans Glowwer drafts for you, the changes you ask for, your approvals and skips, and the history of those actions.
- Messaging, when you enable it. If you link a WhatsApp number to a brand, we store that phone number, the verification you send from it, and the messages exchanged with Glowwer through it, so the conversation can drive your week. Nothing is linked until you verify the number from the phone itself.
- Support and other communications. What you send us when you write to us, and our replies.
Information collected automatically
- Device and log data. IP address, browser and device type, the pages and actions you request, timestamps, and errors that occur. Our hosting provider records request logs. When something breaks, an error report goes to our error-monitoring provider with the page, the error and the browser type; we strip cookies, request headers, form contents and account identifiers from it before it is sent. Session replay is not enabled.
- Product analytics. Page views and product events (a brand started, a week generated, a post approved) under pseudonymous identifiers, sent to our analytics provider — in your browser only after you allow it, and never before. See the Cookie Policy for how this is stored in your browser and what you can change.
- Cookies and browser storage. Listed, one by one, in the Cookie Policy.
Information from other sources
- Public information about your business. To build your brand profile, Glowwer reads your website (text, images, colours, fonts, links) and may look up public listings, reviews, app-store pages and social profiles that describe your business. This is public information about a business, gathered because you asked us to read it; some of it may include the names of people who run or review the business.
- From platforms you connect. When you connect a social account, our publishing provider handles the platform’s authorisation and returns account and profile identifiers plus the status of each post it publishes. Glowwer stores those identifiers and statuses — not your platform password and not the platform’s access tokens, which stay with the provider.
- From our payment processor. If you subscribe to a paid plan, the processor tells us the plan, its status and renewal dates, plus the identifiers it uses for your subscription. Full card numbers never reach Glowwer.
Before you have an account#
You can paste a website and see a drafted week without creating an account. To make that work, Glowwer sets a cookie holding a random anonymous session identifier and creates a brand record tied to it. The draft is reachable by anyone who has its link, so treat the link as you would a shared document.
If you create an account, the brand is claimed by it and the anonymous cookie is cleared. If you do not, an unclaimed anonymous brand becomes eligible for deletion about 7 days after it is created and is removed, together with its drafts and records, when our clean-up runs; until then the record remains in our database. Image files already written to storage for such a brand are not removed by that clean-up and may remain until we remove them by hand (see Your rights). Such a brand is linked to no account, but an email or phone number you typed into it stays with the brand until the brand is removed.
How we use it#
- To read your website and build a brand profile you can review and correct.
- To draft, design and revise your posts, and to check them against your brand before you see them.
- To publish the posts you approve to the accounts you connect, and to report back what happened.
- To run the conversation with the Creative Director, on the web and, if you enable it, over WhatsApp.
- To create and secure your account, keep you signed in, and prevent abuse (including rate-limiting by IP address).
- To bill subscriptions and keep required records of them.
- To understand how the product is used and where it fails, and to fix it.
- To answer you when you write to us, and to send you service messages about your account.
- To comply with law and enforce our Terms of Service.
We do not use your content to build advertising profiles, and we do not sell personal information. See Who we share it with.
AI and media processing#
Glowwer is built on third-party AI models. Your website content, brand profile, uploaded assets, instructions and drafts are sent to AI providers to produce text, images and plans, and to check them. Those providers are listed on the Subprocessors page with what each one receives.
We do not train models on your content for use by other customers, and we do not use one customer’s brand to generate another’s posts. Each provider handles the content it receives under its own terms; how long a provider retains it may differ from how long we do, and the Subprocessors page is the place we keep that current.
Generated content can be wrong. You review every post before it publishes, and the Terms of Service explain what generated content does and does not give you.
How long we keep it#
We keep personal information for as long as it is needed for the purpose it was collected, and then delete or de-identify it. In practice:
- Account, brand and content data is kept while your account is active. When you ask us to delete your account (see Your rights), we delete it, except where we must keep a record — for example billing records the tax and payment rules require, or logs of abuse.
- Anonymous, unclaimed brands become eligible for deletion about 7 days after they are created and are removed, with their drafts and records, when our clean-up runs; the record remains until then. Their image files in storage are not removed by that clean-up and may remain until we remove them by hand; ask and we remove them.
- Archived brands are kept until they are deleted at your request, or with your account.
- Privacy-request tickets — the record that you asked, which kind of request and when, with no free-text contents — are kept with your account as the record of the request and our answer.
- Logs, error reports and analytics are kept by the providers that hold them under their own retention settings.
We do not promise fixed retention periods that the product does not enforce. Where a provider keeps a copy of data we sent it, that provider’s retention may differ from ours; the Subprocessors page names each one so you can read its terms.
Security#
We use encryption in transit, an authentication provider for sign-in and sessions, row-level access controls in our database, and signed webhooks from our providers. Public endpoints are rate-limited when a rate-limit store is configured for the deployment (see Subprocessors). Access to production systems is limited to the people who need it.
No system is perfectly secure, and we do not promise that yours will never be affected. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires.
Where it is processed#
Glowwer and the providers that run it process data on servers that may be in a different country from you, including the United States. If you use Glowwer from outside the United States, your information will be transferred to, stored and processed there and wherever our providers operate.
Where legally required, we rely on the safeguards available for such transfers and will describe them on request.
Your rights and choices#
Depending on where you live, you may have the right to ask us to access the personal information we hold about you, correct it, delete it, give you a copy in a portable format, restrict or object to some processing, or opt out of certain uses. We offer these request routes to everyone, wherever you live; where a law gives you a right, we honour it as that law requires.
How to ask, what we need to verify it is you, and what happens next are on the Privacy Rights Requests page — signed in, you can open each kind of request there with one tap; each one becomes a ticket handled by a person. You can also write to privacy@glowwer.com. We will not treat you differently for exercising a right.
Account deletion is handled as a verified request: start it from the Privacy Rights Requests page or the Delete account button in Settings, and we confirm at your account email before anything is removed. Nothing is deleted the moment you ask; there is no instant self-service switch, and this page will not claim otherwise.
- Marketing email. Glowwer does not send marketing email today. If we start, every message will carry an unsubscribe link and our postal address, and we will only send it where the law allows.
- Analytics. Off until you allow it; allow or withdraw at any time in Cookie settings (see the Cookie Policy).
- Connected accounts. Disconnect any of them in Settings.
California notice at collection#
This section is for California residents. Some California privacy laws apply only to businesses above certain size thresholds; we make this notice and the request routes available regardless, and we honour the rights they describe where they apply.
Categories of personal information collected in the last 12 months
- Identifiers
- Name, email address, sign-in identifiers, IP address, anonymous session identifier, phone number (WhatsApp, if enabled).
- Commercial information
- Plan, subscription status and billing history (not card numbers).
- Internet or network activity
- Pages and actions requested, product events, device and browser details, error reports.
- Content you provide or we generate for you
- Brand profile, uploaded assets, instructions, drafts, edits, approvals, messages (if messaging is enabled).
- Professional information
- The business you represent and its public details.
- Inferences
- A brand profile (tone, audience, style) derived from your website and your instructions, used only to draft your posts.
Purposes, sources and sharing
We collect these for the purposes in How we use it, from the sources in What we collect, and disclose them to the service providers on the Subprocessors page for business purposes. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly collect personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that would require a right to limit.
Retention
As described in How long we keep it.
Your California rights
To know, to delete, to correct, to a portable copy, to non-discrimination, and to designate an authorised agent to act for you. Submit a request on the Privacy Rights Requests page or by writing to privacy@glowwer.com; we verify requests using the email on your account.
If you are in the EEA, the UK or Switzerland#
Our legal bases for processing your personal information are: performance of a contract (providing Glowwer to you), legitimate interests (securing the service, understanding and improving it, preventing abuse — balanced against your rights), consent (where we ask for it — analytics runs only after you opt in, and you can withdraw that choice at any time from Cookie settings), and legal obligation (keeping records the law requires).
You have the rights described in Your rights and choices, plus the right to lodge a complaint with your supervisory authority. Our messaging and AI providers may process data outside the EEA / UK; see Where it is processed.
We have not designated an EU or UK representative or a data protection officer. If we are required to, we will list them here.
Children#
Glowwer is for businesses and is not directed to children. You must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 13, or under 16 in California. If you believe a child has given us personal information, write to privacy@glowwer.com and we will delete it.
Changes to this policy#
When we change this policy we post the new version here and update the date at the top. If a change materially reduces your rights or changes how we use personal information we already hold, we will tell account holders by email or with a notice in the product before the change takes effect.
Contact#
Privacy questions and requests: privacy@glowwer.com. Everything else: hello@glowwer.com. Post reaches us at the address under Operator and contact.
Social publishing and connected accounts#
Connecting a social account authorises our publishing provider, on your behalf, to publish the posts you approve to that account and to read what it needs to confirm they went out. The platform’s own consent screen tells you what you are granting; the platform’s terms and privacy policy govern that account.
Nothing publishes without your approval. You can disconnect any account from Settings at any time; disconnecting stops future publishing and does not remove posts already on the platform.