Glasp

GDPR overview

The privacy policy, last updated on 2 August 2024, carries a dedicated GDPR Compliance section covering the EEA and Switzerland; the terms of service have been in force since 28 February 2024. Users are granted access, rectification, erasure, restriction, objection, portability and withdrawal of consent, plus the right to complain to a supervisory authority in the EEA or the United Kingdom. Personal data from EU users is transferred to the United States, where the servers sit, under standard contractual clauses approved by the European Commission, with EU user consent given as the declared basis. What is missing is equally concrete: no Article 27 representative, no named DPO (hi@glasp.co is the single contact), no data processing agreement, no sub-processor list and no SOC 2 or ISO 27001 certification. The service is not intended for under-13s, and browser Do Not Track signals are explicitly not honored.

Who owns the data?

Glasp Inc., 548 Market St, PMB 26241, San Francisco, is the data controller for the purposes of the GDPR. What you produce stays your material: titles, metadata, tags, highlights and annotations are handled as Customer Content, and export is deliberately not a paid feature, covering Notion, Obsidian, Readwise, Roam, Zotero, Tana, Workflowy, Anki, Markdown and CSV. The caveat is exposure. Anything you publish through the public parts of the service is treated as public, falls outside the privacy policy's protections and can be indexed by search engines, and your profile, name, username and social handle are shared publicly. Deleting your account is self-service, removes highlights, favorites, summaries and profile, and is irreversible.

Reuse rights

Glasp states what it collects data for: running the service, billing, support, security, fraud prevention, research and development, audience measurement and product communications, with legitimate interest invoked for R&D, security and fraud prevention. Recipients are described by category rather than by name: service providers, the organization a user belongs to, the public, authorities, and an acquirer in the event of a merger or sale. Two providers are named: Stripe processes payments, so card details never reach Glasp, and Google Analytics measures audience, with opt-out through Google's own tool. De-identified and aggregated data falls outside the policy. Under the CCPA, Glasp states it does not sell the personal information of California residents, and the policy rules out automated decision-making or profiling producing legal effects without human intervention. One silence matters for anyone reusing their own material: the policy never addresses whether customer data is used to train AI models, in either direction, and documents no training opt-out, even though the site's robots.txt sets ai-train=no for its own published content.

Data retention & training

Hosting summary

Glasp's servers are located in the United States, and the privacy policy states plainly that information processed by the company may be transferred, processed and stored anywhere in the world. Personal data collected from EU users may therefore leave the EEA for the United States; Glasp declares that such transfers comply with the GDPR, for instance through standard contractual clauses approved by the European Commission. No European data residency option is offered, and no additional hosting country or region is named, so a buyer who needs data to remain in the EEA has no setting to reach for. Two providers sit alongside that hosting: Stripe processes payments, meaning card data never reaches Glasp's own systems, and Google Analytics handles audience measurement, with opt-out available through Google's own tool. Beyond those two, the policy describes only categories of service providers rather than a named sub-processor list, and no hosting-related certification such as SOC 2 or ISO 27001 is displayed.