Glarity

GDPR overview

The site never claims GDPR compliance: the word GDPR does not appear anywhere, and compliance is not denied either. What section 4 of the privacy policy does offer is a list of GDPR-style rights for people in the EEA, the UK and across the globe: access, deletion, correction, portability, restriction, withdrawal of consent, objection and complaint to a local supervisory authority. Rights are exercised through the Glarity account or by emailing support@felo.ai, and the publisher may verify your identity first. A named privacy contact is given, Tatsuya Kanada, at the Tokyo address. Against that: no Article 27 EU representative, no DPO named as such, no DPA, no sub-processor list, no certification. Section 5(c) of the terms pushes notice and consent duties onto users who process personal data through the service, and section 8 applies Japanese law and Tokyo courts. Both documents are dated 04.07.2023.

Who owns the data?

Section 3(a) of the terms groups your inputs and the outputs generated from them under a single label, Content. As between the parties and as far as the applicable law allows, you own all Input, and you stay responsible for that Content, including its lawfulness. The publisher states that it may use Content to provide and maintain the service, to comply with the law and to enforce its policies; nothing broader is claimed, and model training is never mentioned in either document. Feedback is treated separately: section 2(b) lets the publisher use any comment, idea or suggestion without restriction or compensation. Section 2(e) puts the burden of holding the rights over the source material you submit for summarizing on you.

Reuse rights

The privacy policy lists account data (name, contact details, credentials, payment card, transaction history), User Content (prompts, files, feedback), communication information and social information, plus technical data collected automatically: log data such as IP address, browser type and settings and timestamps, usage data, device information and cookies. Google Analytics is used, and the policy states that the data collected is shared with other Google services and may serve to personalize advertising across the Google network. The stated purposes are providing, administering, maintaining and analyzing the service, improving it and conducting research, communicating with users, developing new programs, preventing fraud, business transfers and legal obligations. Aggregated or de-identified data may be analyzed, shared with third parties or published, with an undertaking not to re-identify it except where the law requires. Disclosure is possible to vendors (hosting, cloud, IT, emailing, analytics), in a business transfer, to the authorities and to affiliated companies, and not one vendor is named. Whether any of this content feeds AI model training is not addressed at all: the documents neither allow it nor rule it out.

Data retention & training

Hosting summary

No hosting location is published. Neither the privacy policy nor the terms names a country or a region where data is stored, and the site has no trust or security page. Section 3 of the privacy policy says the publisher relies on hosting, cloud and IT service providers, but not one of them is named, so there is no sub-processor list to inspect. On security, section 6 promises commercially reasonable technical, administrative and organizational measures to protect personal information, without detail and without any certification such as SOC 2 or ISO 27001. What is known is the legal frame rather than the physical one: the publisher is Japanese and section 8 of the terms applies Japanese law with exclusive jurisdiction in Tokyo, which says nothing about where the data actually sits. The domain's IP address (104.21.32.145, Cloudflare AS13335, anycast) is a CDN front end and is no indication of hosting either. Anyone with a data-residency requirement should treat this point as unanswered.