Privacy Policy
Last updated: 29 October 2026
1. Who we are
Glideway AI is operated by Glide AI, registered in England and Wales under company number 06756978, registered office The Lowns, Norwood, London, SE19 3TP. We are the controller of the personal data described in this policy for our own sign-in and account administration. Where a business customer uses Glideway AI to answer questions from its own documents, that business is usually the controller of its document content and we act as its processor, under a data processing agreement.
Contact for privacy questions: Hengeb@GlidingAI.onmicrosoft.com
We have not appointed a Data Protection Officer because we are not required to. Send privacy questions to the address above.
2. What this policy covers
This policy covers the Glideway AI website (glidewayai.com) and the customer sign-in service (app.glidewayai.com). It does not cover the separate services of third parties that you may visit through links.
3. What personal data we collect
a) Sign-in information. When you sign in with a Google or Microsoft account, we receive from that provider your name, email address, and a unique account identifier (the "subject"). We store these so we can recognise you and show you the correct organisation's workspace.
b) Session information. When you are signed in, we store a session record. The session cookie we set is stored only as a one-way hash in our database, so a copy of the database does not contain usable session cookies. We store the time you signed in, when the session was last used and when it expires.
c) Organisation and role information. We record which organisation you belong to and your role within it (for example administrator, operator or viewer).
d) Content you provide. If you upload documents or ask questions, we process that content to provide the service. Content belongs to the customer organisation and is kept separate from every other organisation.
e) Technical and security information. Our servers keep logs of requests, errors and security events, including IP address and browser type, so we can keep the service secure and fix faults. Audit records of sign-ins and administrative actions are kept to show who did what.
f) Website visitors. We do not use advertising or analytics cookies. We use only the strictly necessary cookies that keep you signed in and protect against forged requests. The pages on glidewayai.com load no third-party analytics or marketing scripts.
We do not knowingly collect personal data from children under 18.
4. Why we use your data and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Sign you in and provide the service | Sign-in, session, organisation data | Performance of a contract (Art. 6(1)(b)) |
| Answer questions from customer documents | Content | Performance of a contract, as processor for the customer |
| Keep the service secure and prevent misuse | Logs, audit records | Legitimate interests (Art. 6(1)(f)): security and fraud prevention |
| Meet legal and tax obligations | Account and billing records | Legal obligation (Art. 6(1)(c)) |
| Respond to enquiries | Contact details you send us | Legitimate interests, or contract if you ask about a service |
We do not use automated decision-making that produces legal or similarly significant effects on you. Any AI answer is shown with its source, and changes that affect a computer are approved by a person before they happen.
5. Who we share data with
We use carefully selected service providers ("sub-processors"). They only act on our instructions. Current providers:
- Google and Microsoft: identity providers for sign-in.
- Cloudflare: network routing and security for our web addresses.
- RunPod: hosting for our servers and database.
- Stripe (only if and when paid plans are switched on): payments and subscriptions. We do not store full card numbers.
We do not sell your personal data.
6. International transfers
Some providers may process data outside the UK. Where this happens, we rely on UK-approved safeguards, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework, as applicable.
7. How long we keep data
- Sign-in and session records: until the session expires, and removed shortly after.
- Customer content: for the life of the customer's contract, then deleted or returned within 30 days of the end of the contract, unless the law requires us to keep it.
- Security and server logs: 90 days.
- Audit records of sign-ins and administrative actions: for as long as the customer's account is active, and up to 12 months after it ends.
- Billing records: 6 years, as required by UK tax law.
8. How we keep data secure
We use encryption in transit, access controls based on role, tenant separation enforced in the database, and audit logs. No system is perfectly secure. If a personal data breach is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours where required, and tell affected people without undue delay where required.
9. Your rights
Under UK GDPR you have the right to: access your data; have it corrected; have it erased in some cases; restrict or object to processing; receive a copy in a portable format; and withdraw consent where consent is the basis. To use these rights, email Hengeb@GlidingAI.onmicrosoft.com. We will respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would welcome the chance to address your concern first.
10. Changes to this policy
We will post any changes here and update the "last updated" date. For material changes we will tell customers directly.