Privacy Policy

Glot is a real time speech translation service and a trading name of Proveden Ltd (“Glot”, “we”, “us” or “our”), a private limited company registered in England and Wales under company number 16274553, whose registered office is at The Work Project Level 23 - 21, 1 Leadenhall Street, London, United Kingdom, EC3V 1AB.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (“EU GDPR”), we are the controller of the personal data described in this policy, except where section 16 (Developers and the API Platform) explains that we act as a processor on a developer’s behalf.

You can contact us about anything in this policy, or to exercise your rights, by emailing privacy@glot.com or by writing to the registered office address above, marked for the attention of the Privacy Team.

This policy applies to personal data we process when you:

• visit our websites at glot.world, glot.com and their subdomains (the “Website”), including when you join our waitlist or read our blog;
• use our web application at app.glot.com, including Chat, Multi-Device and Meeting modes (the “App”);
• use the Glot desktop application (the “Desktop App”);
• use the Glot API Platform, developer console or documentation as a developer (the “API Platform”);
• take part in a Glot session as a guest, with or without an account; or
• communicate with us by email, through support channels or on social media.

We refer to the Website, App, Desktop App and API Platform together as the “Services”.

This policy does not cover:

• third party services that you use alongside Glot, such as Google (sign in) or Stripe (payments), which have their own privacy notices; or
• applications built by other companies using our API Platform. The developer who built the application is responsible for telling you how it handles your data, as described in section 16.

The full policy follows, but these are the points that matter most to the people who use Glot:

• Your conversations are processed in real time to translate them. Your voice is streamed to our translation engine, converted to text, translated and spoken back in the other language. This happens live, as a necessary part of the service you have asked for.
• We do not keep recordings of your conversations. Conversation audio is handled in memory while the session runs and is not stored on our servers once the session ends. What we keep afterwards is information about the session (such as its length and the languages used), not what was said.
• We do not use your conversations to train AI models without your explicit consent, and our AI processing providers are not permitted to use them to train theirs.
• We do not sell personal data. We share it only with the service providers we need to run Glot, on strict terms, and in the other limited situations set out in section 10.
• Other people in your conversation are your responsibility too. Tell them Glot is translating, and make sure you have any agreement the law requires before including them.
• You have rights over your data, including access, correction, erasure and objection, and you can complain to the Information Commissioner’s Office. Section 14 explains how.

4.1 Account data

When you sign in with Google we receive your name, email address, profile picture and a Google account identifier. We never receive or store your Google password. We also hold the settings you choose within Glot, such as your preferred languages, and the date your account was created.

4.2 Conversation content

When you use Glot to translate, we process your voice and the words you say, the live transcript of your speech, the machine translation of it, and the synthesised speech we produce in the other language. In Multi-Device and Meeting modes we also process the same content from the other participants, and in Meeting mode your camera video and any emoji reactions you send. In single device Chat mode, the voice of the person speaking with you through your device is processed in the same way as yours.

Conversation content is the most sensitive information we handle. Section 6 explains in detail how it is processed and how long it exists.

4.3 Session and usage data

For each session we record the mode used (Chat, Multi-Device or Meeting), the languages selected, when it started and ended, how long it lasted, how many translations were delivered, whether it connected successfully and why it ended, your role in it (host or guest), and the type of device you used. Across sessions we record when you first and last used Glot, the languages you use most, invitations you create and invitations you accept, and how you first found us (for example a referral or campaign code in the link you followed).

4.4 Technical data

Our servers and real time media infrastructure automatically log your IP address, browser type and version, operating system, device type, timestamps, error reports, and connection quality measurements such as latency and packet loss. Your IP address gives us your approximate location at the level of a city or region. We use this to run the service, keep it secure and diagnose faults.

4.5 Payment data

Payments are handled by Stripe. When you buy credits or a subscription we receive confirmation of the transaction, the amount and currency, your billing country, the card brand and last four digits, and a Stripe customer identifier. We never receive or store your full card number. We keep a record of your credit balance and how it is used.

4.6 Waitlist and marketing data

If you join our waitlist we collect your first name, email address and the use you have in mind for Glot, together with the marketing channel or campaign link, if any, that brought you to the Website.

4.7 Communications

When you contact us we keep the correspondence, including your contact details, the content of your message and any information you choose to share to help us resolve a question.

4.8 Developer data

If you use the API Platform we collect your name, email address and organisation, the API keys issued to you (stored in a form that cannot be reversed), metadata about your API requests (endpoints, timestamps, volumes, response codes and session durations), and your billing records. Audio and text that your application sends to us on behalf of its users are processed on your instructions as described in section 16.

4.9 Information from cookies and similar technologies

See section 9.

4.10 Where the data comes from

Most of this data comes directly from you or is generated by your use of the Services. We receive account details from Google when you sign in, payment confirmations from Stripe, and campaign information from the links you follow to reach us. We do not buy personal data from data brokers.

Data protection law requires us to have a lawful basis for each use of personal data. The table below sets out what we do, which data is involved and the basis we rely on. Where we rely on legitimate interests we have weighed those interests against your rights and concluded that they are not overridden by them; you may object to any such processing under section 14.

Special category data

We do not deliberately collect special category data (such as information about health, religion, ethnicity, sexuality or political opinions). Your voice is processed to understand what you are saying, not to identify you; we do not create voiceprints or carry out speaker identification, so we do not treat voice audio as biometric data. What you and others choose to say in a conversation may nonetheless reveal special category data. We process such content only as a transient and necessary part of delivering the translation you have requested, we do not analyse it for any other purpose, and we ask you not to use Glot to disclose sensitive information about other people without their explicit consent.

6.1 How a session works

With your permission your browser or device captures audio from your microphone (and, in Meeting mode, video from your camera). That audio is streamed over an encrypted connection to our real time media infrastructure and from there to our translation engine. The engine converts speech to text, translates the text into the other language and produces synthesised speech, which is streamed back to the participants together with the text of the transcript and its translation. All of this happens while the session is live.

6.2 Who processes it

Conversation content is processed by us and by the specialist providers we use for real time media transport and for speech recognition, translation and speech synthesis. They are listed in section 10. Each acts on our documented instructions under a written contract that prohibits them from using your content for any purpose of their own, including training their models.

6.3 How long conversation content exists

• Audio and video are processed in memory and streamed between participants. We do not record sessions and we do not store audio or video on our servers after the session ends.
• Transcripts and translations are displayed in your browser during the session and are not stored on our servers once the session ends. If you copy or save them, that copy is under your control.
• Session information (such as duration, languages and translation counts, but not content) is kept as described in section 12.
• Provider processing. Our AI providers may hold content for the short period needed to process it and, where their terms require, for a limited period to detect abuse of their systems. We select providers whose terms limit this retention and prohibit training.

6.4 Human review

Nobody at Glot listens to or reads your conversations as a matter of routine. A member of our team may access conversation content only where: you have shared it with us yourself, for example to help us investigate a fault; we are investigating a credible report that the Services have been used in breach of our Terms of Service or the law; or we are required to do so by law. Such access is limited to the people who need it, is logged and is subject to confidentiality obligations.

6.5 Accuracy of machine translation

Glot produces machine translation. It is designed to be fast and to be good enough for natural conversation, but it can misrecognise speech and mistranslate meaning, and it is not a substitute for a qualified human interpreter where accuracy is critical. Our Terms of Service set out the uses for which Glot is not suitable.

6.6 Automated decision making

We do not make decisions about you that have legal or similarly significant effects solely by automated means. Our systems may automatically limit or suspend an account where they detect activity that appears to breach our Terms of Service, for example abusive volumes of invitations or attempts to circumvent credit limits. If that happens to you, you can ask us to review the decision and a person will do so.

Glot is designed for conversations between people, so it will usually process the voice and words of someone other than you: the person in front of you in Chat mode, or the people who join a Multi-Device session or Meeting from their own devices.

• Tell people that Glot is translating. You must let the other participants know that their speech is being processed by a translation service and give them the chance to decline. Some countries require the consent of everyone taking part before a conversation may be captured or processed; you are responsible for knowing and complying with the law that applies to you.
• Guests. A person who joins a session from an invitation link does not need an account. We process their conversation content, session data and technical data on the bases set out in section 5, and we create a random identifier in their browser so that the session works. That identifier is not linked to their identity unless they later create an account, in which case their earlier guest sessions may be associated with it.
• Invitation links. An invitation link lets anyone who holds it join your session. Share it only with the people you intend to talk to and do not post it publicly.
• Recording by others. We do not record sessions, but we cannot prevent another participant from recording their own device. Bear this in mind before discussing anything confidential.

The Services are intended for adults. You must be at least 18 years old to create a Glot account or to buy credits. We do not knowingly collect personal data from anyone under 18, and if we learn that we have done so we will delete it. If a person under 18 takes part in a session as a guest, the host is responsible for ensuring that a parent or guardian has agreed to this.

If you are a parent or guardian and believe that a child has provided personal data to us, please contact privacy@glot.com.

A cookie is a small text file that a website stores on your device. We also use browser local storage, which works in a similar way, and third party scripts that read information about your device and connection. This section explains each one we use and why.

Strictly necessary cookies and storage are needed for the Services to work and do not require your consent. Where the law (including the Privacy and Electronic Communications Regulations 2003) requires your consent before a cookie or similar technology is used, we will ask for it before it is set, and you can withdraw that consent at any time.

You can also control cookies through your browser settings, which let you refuse or delete cookies for any site. Blocking strictly necessary cookies or storage will prevent parts of the Services from working. Browser extensions that block third party scripts will prevent the analytics and visitor identification technologies above from running without affecting your use of Glot.

We do not sell personal data and we do not share it with third parties for their own marketing. We share it in the following circumstances.

10.1 Service providers (processors)

We use specialist companies to host and run parts of the Services. Each processes personal data only on our documented instructions, under a written contract that meets the requirements of Article 28 UK GDPR, and is subject to our due diligence. The categories and providers we use at the date of this policy are:

We will update this table when we change providers. If you would like to be notified of changes to the providers that process conversation content, write to privacy@glot.com.

10.2 Other participants

By design, your transcript, its translation and your translated speech are shared with the other participants in your session, and in Meeting mode so is your video.

10.3 Developers

If you use Glot through an application built on our API Platform, the developer of that application receives the results of the processing it has requested. See section 16.

10.4 Professional advisers, authorities and legal requirements

We may share personal data with our lawyers, accountants, auditors and insurers where necessary for them to advise us, and with courts, regulators, law enforcement and other public authorities where we are required to do so by law, where we reasonably believe it is necessary to protect the safety of any person, or to establish, exercise or defend legal claims. We review every request for personal data and disclose only what the law requires.

10.5 Corporate transactions

If we sell, merge or reorganise our business, or seek investment, personal data may be shared with the prospective counterparty and its advisers under confidentiality obligations, and transferred to a successor who will be bound by this policy in respect of the data transferred.

10.6 With your consent

We may share personal data in other ways where you have asked us to or agreed.

Some of the providers listed in section 10 process personal data outside the United Kingdom and the European Economic Area, including in the United States. Whenever we transfer personal data out of the UK or the EEA we ensure that it is protected by one of the following safeguards:

• a decision by the UK Government (adequacy regulations) or the European Commission (adequacy decision) that the destination country provides adequate protection, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it;
• the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment; or
• for transfers governed by the EU GDPR, the European Commission’s Standard Contractual Clauses.

You can ask for a copy of the safeguards we rely on for a particular transfer by contacting privacy@glot.com. Commercially sensitive terms may be redacted.

We keep personal data only for as long as we need it for the purposes described in this policy, to meet our legal obligations, or to resolve disputes. Our standard periods are set out below. Where a shorter period is stated for conversation content it takes precedence over any general period.

Data in encrypted backups may persist for up to 90 days beyond the periods above before the backup cycle overwrites it. Backups are not used to restore deleted personal data except where necessary to recover from a system failure.

We protect personal data with technical and organisational measures appropriate to the risk, including encryption of data in transit using TLS and of real time media using the encryption built into the WebRTC standard, encryption of stored data at rest, access controls based on least privilege, logging and monitoring of access to production systems, secure software development practices, and contractual and due diligence requirements for our providers.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours where the law requires and will tell you without undue delay where the risk is high. If you discover a security vulnerability in the Services, please tell us at privacy@glot.com so that we can fix it; we ask that you do not access or alter other people’s data while doing so.

You can help by keeping your Google account secure, by signing out of shared devices and by sharing invitation links only with the people you intend to talk to.

Under the UK GDPR and, where it applies, the EU GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it together with information about how we use it.
• Rectification of personal data that is inaccurate or incomplete.
• Erasure of your personal data in certain circumstances, for example where it is no longer needed or where you withdraw consent. You can close your account at any time, which triggers the deletion described in section 12.
• Restriction of processing while a dispute about accuracy or our lawful basis is resolved.
• Object to processing based on our legitimate interests, which we will stop unless we can show compelling legitimate grounds that override your interests, and to object at any time to direct marketing, which we will always stop.
• Portability of the personal data you have provided to us, in a structured, commonly used and machine readable format, where we process it by automated means on the basis of contract or consent.
• Withdraw consent at any time where we rely on it, without affecting the lawfulness of processing before withdrawal.
• Not be subject to solely automated decisions with legal or similarly significant effects, and to obtain human intervention where such a decision is made (see section 6.6).

How to exercise your rights

Email privacy@glot.com from the address linked to your account, or write to us at the address in section 1. We may need to ask you for information to confirm your identity before acting, and to clarify what you are asking for. We will respond within one month; if your request is complex or you have made several, we may extend this by up to two further months and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act and will explain our reasons.

Because conversation content is not stored after a session ends, we are unable to provide copies of past conversations in response to an access request; we can provide the session information we do hold.

Complaints

If you are unhappy with how we have handled your personal data we would welcome the chance to put it right, so please contact us first. You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or online at ico.org.uk/make-a-complaint. If you live in the EEA you may instead complain to the supervisory authority in the country where you live, work or where the alleged infringement took place.

We send marketing email only to people who have joined our waitlist or who are existing customers, and only about Glot. Every marketing email includes an unsubscribe link that takes effect promptly, and you can also opt out by emailing privacy@glot.com. Opting out of marketing does not stop service messages that we need to send to run your account, such as receipts, security notices and changes to our terms.

We do not send unsolicited bulk email and we do not buy or rent mailing lists. Our Anti-Spam Policy sets out our commitments in full.

The API Platform lets developers add Glot’s real time translation to their own products. This changes who is responsible for what.

• Developer account data. We are the controller of the personal data we hold about you as a developer: your name, email address, organisation, API keys, request metadata, security logs and billing records. We use it on the bases set out in section 5.
• End user content. When your application sends audio or text to our API on behalf of its users, you are the controller of that personal data and we are your processor. We process it only to provide the API to you and on your documented instructions, using the sub-processors listed in section 10.1, and we do not use it to train models. Our Data Processing Agreement, which forms part of our Terms of Service for developers, sets out the detailed terms.
• Your obligations. You are responsible for having a lawful basis to process your users’ data, for giving them a privacy notice that describes Glot’s role, and for obtaining any consents that your use of speech processing requires.
• Users of developer applications. If you use an application built on Glot and have questions about how it handles your data, contact the developer of that application. If you contact us we will refer your request to them and assist as required by law.

The Desktop App brings Glot to calls that you make in other applications on your computer. With your permission, and only while you have started a translation session, it captures audio from your microphone and audio from the call you have selected, and streams both to our translation engine in the same way as the App. To do this it installs an audio driver that routes call audio to and from Glot; the driver does not capture audio when a session is not running.

Call audio is processed as described in section 6 and is not recorded or stored. Your settings are stored locally on your computer. The Desktop App periodically checks for updates, which sends its version number and your operating system version to our servers. The other people on your call are participants in your conversation, and section 7 applies to them.

The Services rely on, and may link to, services operated by other companies, including Google for sign in, Stripe for payments and the platforms through which you download or install our applications. Those companies process your data under their own privacy notices, which we encourage you to read. We are not responsible for their content or practices.

We will update this policy when our practices or the law change. The date at the top shows when it was last revised. If a change materially affects how we use your personal data, for example a new purpose or a new category of recipient for conversation content, we will notify you by email or through the Services before the change takes effect and, where the law requires, ask for your consent. Earlier versions are available on request.

Privacy questions, requests and complaints: privacy@glot.com

Post: Proveden Ltd, The Work Project Level 23 - 21, 1 Leadenhall Street, London, United Kingdom, EC3V 1AB, marked for the attention of the Privacy Team.