Trust Center

The third parties that may process customer data on Glitter’s behalf, what each one does, which data it handles, and where it is located. The list is Annex III of the Data Processing Addendum and is kept current on the legal page.

Glitter AI’s Data Processing Addendum is published at glitter.io/legal/dpa and applies to every customer whose use of Glitter involves personal data. It contains the Article 28 GDPR processor terms, names the customer as controller (or processor for its own clients) and Glitter as processor, commits Glitter to using customer content only to provide the service and never for AI training, gives advance notice of sub-processor changes with a right to object, and promises breach notice within 72 hours. It also carries the transfer mechanisms for EEA, UK and Swiss data, and the US state privacy law terms.

Glitter AI is based in the United States and processes customer data there. Transfers from the EEA, the UK and Switzerland are covered by the transfer mechanisms built into the Data Processing Addendum: the European Commission’s 2021 Standard Contractual Clauses (Module Two controller to processor, Module Three processor to processor, with Ireland as the governing law and forum), the UK International Data Transfer Addendum issued by the ICO, and the Swiss adjustments for the FADP. The DPA’s Annexes I, II and III serve as the SCC annexes, so no separate signature is needed. Onward transfers to sub-processors are made under written contracts with the same safeguards, and every sub-processor and its location is listed on the sub-processor page. Glitter maintains the records required by Article 30(2) GDPR, assists customers with their obligations under Articles 32 to 36, and processes data subject requests for access, correction, portability and deletion within 30 days.

Glitter AI signs a Business Associate Agreement (BAA) with organizations that document workflows touching Protected Health Information. It is a paid add-on, and setup starts with a conversation at sales@glitter.io. Once HIPAA is enabled for an organization, all AI processing of its recordings and guides (transcription, step extraction, guide generation) runs on HIPAA-eligible infrastructure covered by BAAs Glitter holds with its vendors, and the platform enforces the privacy controls: public sharing is locked off organization-wide and existing public guides are made private, embedding is limited to token-protected secure embeds, and guides are visible to signed-in members only. Users cannot weaken these controls. Every vendor that could access ePHI operates under a BAA with Glitter, listed on the subprocessor page.

Glitter AI processes data subject access and correction requests via support@glitter.io with 30-day response time. Handles GDPR and privacy rights including data portability, deletion, and rectification under established privacy policy procedures.

Glitter AI provides Master Service Agreements available for enterprise customers upon request.

Glitter AI’s privacy-by-design policy protects customer PII across cloud-hosted SaaS platform. Includes data redaction features, consent management, data subject rights, and SOC 2 Privacy Criteria compliance with quarterly reviews by Security Officer.

Glitter AI maintains target system availability of 99.9% as documented in internal capacity management procedures. Incident response includes defined SLA remediation times based on severity levels with monitoring and performance tracking through Sentry and capacity management processes.

Glitter AI’s comprehensive Terms of Use and Subscription Terms covering service description, payment terms, data ownership, security commitments, acceptable use policy, intellectual property rights, and user responsibilities. Available publicly at website.