Glinky

GDPR overview

The privacy policy, effective 1 January 2026, carries a dedicated GDPR section. It cites the legitimate interest of the business as legal basis and allows consent to be withdrawn. Listed rights are access, rectification, erasure, restriction, objection, objection to automated processing and profiling, portability and complaint to a supervisory authority, all exercised through privacy@glinky.ai or by phone on +1 630 2808690, with a stated 45-day response window that can be extended in writing. CCPA and CPRA, Colorado CPA and Virginia VCDPA rights are covered separately. Two gaps stand out: no Article 27 EU representative and no data protection officer are named, and no transfer mechanism is cited although the policy says information may be stored and transmitted in the United States and other countries. The claim of being GDPR compliant appears four times, in blog articles only, never in the policy itself.

Who owns the data?

The privacy policy splits ownership in two. For content submitted to the Copilot, transcripts, scans and text excerpts, G LNK acts solely as a data processor on behalf of the organization, which remains its controller at all times. For data collected through the website itself, G LNK operates as the data controller. The controller of record is G LNK, Inc., 455 W 37th St, APT 1208, New York City, NY 10018, reachable at privacy@glinky.ai. On business accounts, organization administrators can access accounts, settings, usage and certain content. The publisher states, in CCPA wording, that it does not sell or share personal information.

Reuse rights

There is no service contract to read: the Terms and Conditions page linked in the footer and declared in the sitemap returned a 404 on 24 August 2026, so no licence terms on user content are published anywhere. What the privacy policy does say is that Copilot content is processed exclusively to deliver Copilot features, such as summarization, drafting, or search, and only in line with the organization's configuration and instructions. Customers keep control of that content, can delete it at any time, and can export lead lists to CSV or push them to a CRM without asking permission. Website data serves service delivery, security and fraud prevention, support, personalization, commercial offers, surveys, product improvement and marketing, through session and persistent cookies, Google Analytics, web beacons, tracked links and ad retargeting; the advertising opt-out runs through privacy@glnkco.com, an address on the publisher's other domain. Nothing on the site states whether customer data feeds model training, in either direction.

Data retention & training

Hosting summary

The publisher gives two answers and never reconciles them. The privacy policy states that any personal data we collect from you is processed in the United States, and warns non-US visitors that information may be stored, processed and transmitted in the United States and other locations around the world, including countries whose privacy and security laws differ. Two articles on the publisher's own blog say the opposite for meeting content: only encrypted text is stored, on EU servers in Frankfurt, described as GDPR compliant. Both sources are first-party. On audio the publisher is consistent: it is processed on the device and deleted immediately after transcription, leaving only encrypted transcripts and summaries. Google Play's data safety section adds that data is encrypted in transit, that no data is shared with third parties, and that deletion can be requested. No trust or security page names a hosting region, and no subprocessor is disclosed. The site's own domain resolves to an Amazon anycast node in Amsterdam, but that describes the marketing site, not customer data.