Privacy Policy

1. Who processes the data

AUTOMATIZA AI TECNOLOGIA LTDA, CNPJ 51.010.116/0001-42, operator of the Glow.ai by Glow Creators platform and responsible for the glowcreators.io website.

Data Protection Officer (DPO), as required by Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, "LGPD"): Eduardo Carezia, privacy@glowcreators.io.

2. Roles under the LGPD

Glow acts in two distinct roles, and the difference matters:

• Controller of the data of people who sign up for and use the platform (section 3): registration, billing, support and security.
• Processor of the data that the Customer enters or collects through the platform, including creator data (sections 4 and 5). In that case, the Customer decides the purpose and answers as the controller.

Glow processes this data only to perform the contracted service and according to the Customer's instructions.

3. Data of people who use Glow

Data	Purpose	Legal basis
Name and email	Create and authenticate an account	Performance of a contract
Billing data	Process the subscription	Performance of a contract
Access and audit logs	Security and traceability	Legal obligation
Support communications	Handle requests	Performance of a contract

Payment is processed by a partner payment institution. Glow does not store full card numbers.

4. Creator data

This is the part that deserves a careful read. The platform lets the Customer gather and process data about creators, people who did not sign up for Glow and may have no direct relationship with it.

The following may be processed: name or public identifier, social media profile, phone number provided by the creator in the conversation, message history exchanged with the Customer, sample records and public performance metrics.

• The Customer is the controller of this data. It is up to the Customer to have an adequate legal basis (as a rule, performance of a contract or legitimate interest in the business relationship) and to respond to data subject rights.
• Glow, as processor, does not use one Customer's creator data to benefit another, does not sell it and does not build its own database from it.
• Market data shown in search comes from an external provider and consists of performance information about public business profiles.
• A creator who wants to exercise their rights should contact the brand they dealt with. Glow supports the Customer in responding and can be reached at privacy@glowcreators.io.

4-A. Leads, merchants and prospecting conversations

Glow is also the controller of the data of companies and merchants it talks to in order to present its own services, for example when someone answers the creator list quiz or writes to Glow on TikTok or WhatsApp.

• Data processed: name of the person in charge, store name and handle, phone number and email provided by the person, quiz answers (category, revenue range, sales channels), and the history of messages exchanged with Glow.
• Purpose: respond to the person's request (such as sending the requested list), understand their interest, schedule a conversation with the sales team and record the interaction.
• Legal basis: consent, when the person provides their number and authorizes contact by WhatsApp; legitimate interest, in the business-to-business relationship, always with the possibility to object.
• Request to stop: anyone who asks not to receive more messages is honored immediately and the request is recorded.

TikTok messages. When a TikTok Business account authorizes Glow, we receive and reply to that account's direct messages through the TikTok Business Messaging API, only for that service. We do not use this data for any other purpose. If the authorization is revoked, we delete the account's data within a reasonable period.

Service supported by automation and AI. Part of the service uses automated systems and artificial intelligence, which read the incoming message and draft the reply. The person can ask for a human at any time, including by phone call.

5. Conversations and messages

The platform stores messages exchanged between the Customer and creators on the connected channels, to keep a history and allow the conversation to continue.

• The WhatsApp history import, when triggered by the Customer, copies existing conversations into the platform. This is a deliberate action by the Customer, who is responsible for its legal basis.
• Attachments sent in conversations are stored with an object storage provider under restricted access.
• Glow does not read conversations for any purpose other than operating the service, handling a support request from the Customer or complying with a legal obligation.

6. Artificial intelligence

To generate drafts and classify conversations, excerpts of messages and documents registered by the Customer are sent to a language model provider.

• Sending occurs only when the feature is enabled in the Customer's settings.
• The content is used to produce the response to that request. Glow does not use this content to train models, its own or third-party. Content is sent to the provider through an API on a paid service whose terms state that submitted content is not used to improve the provider's products.
• Decisions with significant commercial effect, such as approving or declining a sample, are made by a deterministic rule configured by the Customer, not by a language model.

7. Who we share data with

We share data only with those needed for the service to work:

• Infrastructure and database: hosting of the application and the data.
• Authentication: login and identity management provider.
• Payments: payment institution, for subscription billing.
• Messaging: WhatsApp integration provider, the official TikTok Shop API and the TikTok Business Messaging API.
• Artificial intelligence: language model provider, under section 6.
• Market data: creator research provider.

We do not sell personal data and do not share it for third-party advertising.

Vendors that process data on our behalf (subprocessors):

• Convex (USA): database and system functions.
• Railway (USA): hosting of the application, the website and the WhatsApp connection.
• Cloudflare (USA): file and media storage.
• Clerk (USA): login and identity management.
• Google (USA): artificial intelligence model (Gemini) and calendar with video calls (Calendar and Meet).
• Asaas (Brazil): subscription billing.
• Melhor Envio (Brazil): quotes and shipping of samples, when the Customer uses the feature.
• TikTok (Business Messaging API and TikTok Shop): messaging channel, only for accounts that authorize Glow.
• Glow sales team: independent contractors (MEI), with role-restricted access and a contract that provides for confidentiality and data protection.

The market data provider (Kalodata) supplies public performance information about stores and creators and does not receive personal data of leads or customers.

This list is updated whenever a vendor is added or replaced.

8. International transfers

Glow is a Brazilian company, but some of the vendors above (Convex, Railway, Cloudflare, Clerk and Google) operate in the United States. This means that data processed on the platform may be transferred outside Brazil. The transfer takes place under article 33 of the LGPD, through contractual clauses with each vendor, under which they commit to protect the data at a level compatible with Brazilian law.

9. How long we keep data

• While the subscription is active: the data remains available to the Customer.
• After cancellation: the data remains available for export for 30 days and is then deleted.
• Access logs: kept for 6 months, as required by the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet).
• Tax and billing documents: for the period required by law.

10. Security

We adopt technical and administrative measures to protect the data, including: encrypted traffic in transit, role-based access control, segregation by organization, audit logging of sensitive actions and storage of integration credentials outside the browser.

No system is immune. In the event of a security incident with relevant risk, we will notify data subjects and the Brazilian National Data Protection Authority (ANPD) within the deadlines set by the LGPD.

11. Your rights

The LGPD guarantees the data subject: confirmation of processing, access, correction, anonymization or deletion of unnecessary data, portability, information about sharing, withdrawal of consent and objection.

To exercise them, write to privacy@glowcreators.io. We reply within 15 days.

If you are a creator and were contacted by a brand that uses Glow, the controller of your data is that brand. We can forward your request to it.

12. Cookies

This website does not use advertising cookies and does not load third-party scripts. Fonts are served by our own server.

On pages that measure where visits come from (today, the quiz and the blog), Glow sets one first-party cookie, called glw_vid, containing a random number that identifies the browser. It does not contain a name, email, phone number or any other personal data. It is used to know where the visit came from (for example, which post or article), what was read and whether the person went on to answer the quiz. If you complete the quiz, this number is linked to your registration, so that Glow can understand which content brought you here.

• Legal basis: legitimate interest (measuring the origin of our content), with the right to object.
• Validity: up to 12 months; browsing records are deleted after 13 months.
• How to decline: turn off tracking in this browser. We also honor the browser's “Do Not Track” signal and Global Privacy Control, and you can delete the cookie at any time.

The application, after login, uses strictly necessary cookies to keep the session authenticated.

13. Changes

This Policy may be updated. Relevant changes will be communicated by email or through the platform with reasonable notice, and the update date at the top will always reflect the version in force.

14. Information for US residents

Glow is a Brazilian company and the Platform is aimed at businesses. If you live in the United States, including California, this section adds to the rest of this Policy. We do not claim to meet every requirement of each US state law; we describe what we do.

• Roles. For the data of people who use Glow, Glow decides the purposes (in US terms, a "business"). For the data that a Customer enters in the platform, including creator data, Glow acts on the Customer's instructions (in US terms, a "service provider").
• We do not sell or share. We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA). We disclose personal information only to the vendors listed in section 7, which may use it only to provide the service to us.
• What we collect. The categories in sections 3 and 4-A: identifiers (name, email, phone number, social media handle), commercial information (subscription and billing), internet activity (access logs and the glw_vid cookie) and message content. Account login credentials are used only to authenticate you. Retention periods are in section 9.
• Your rights. You may ask to know what personal information we hold about you, to access it, correct it or delete it, and to limit the use of sensitive information. We do not treat you differently for exercising these rights. We treat the Global Privacy Control signal as an opt-out request.
• How to ask. Write to privacy@glowcreators.io. We may ask for information to confirm your identity. An authorized agent may ask on your behalf, with proof of authorization. We reply within 15 days.
• Transfers to Brazil. Your information is processed on the servers of our vendors, mostly in the United States, and is accessed and processed by Glow in Brazil, which has its own data protection law (the LGPD).
• Children. The Platform is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information of anyone under 16. If we find that we did, we delete it. Customers must not collect data of minors through the platform.
• Security incidents. Where applicable, we also notify affected US residents as required by state breach-notification laws.

15. Contact

Privacy questions: privacy@glowcreators.io
Other matters: contato@glowcreators.io