Privacy Policy

DRAFT, not yet reviewed by a lawyer.
Effective date: [EFFECTIVE DATE]
Last updated: 11 November 2026

This Privacy Policy explains how GLAV collects and uses personal data when you visit glav.ai, create an account, buy a subscription or otherwise deal with us, and what rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.

1. Who we are

The controller responsible for the processing described in this policy is:

[LEGAL ENTITY NAME AND FORM], trading as “GLAV”
[REGISTERED ADDRESS]
OIB: [OIB]
Privacy contact: [PRIVACY CONTACT EMAIL]

[DPO DETAILS, IF A DATA PROTECTION OFFICER IS APPOINTED — OTHERWISE DELETE THIS LINE]

2. Our two roles: controller and processor

GLAV as controller. We decide how and why personal data is processed for our own purposes: running the website, managing customer accounts, billing, support, security of our platform, and business communications. This policy covers that processing.

GLAV as processor. When our customers use GLAV to test their systems, the Service may process personal data contained in targets, test results, evidence and reports (for example, names, email addresses, credentials or other records found on a tested system). For that data, our customer is the controller (or processor for its own client) and we process it only on the customer’s instructions under our Data Processing Addendum. If your personal data appears in a customer’s test results, please contact that customer; we will assist them in responding to you.

3. What data we collect and why

Category: Account data
Examples: Name, business email, organisation, role, password hash, login and MFA settings
Purpose: Creating and administering your account, authenticating you
Legal basis (GDPR Art. 6): Performance of a contract (Art. 6(1)(b))

Category: Customer contact data
Examples: Names and emails of team members and invited clients
Purpose: Providing access to shared projects
Legal basis (GDPR Art. 6): Contract with our customer; our legitimate interest in providing the Service to their team (Art. 6(1)(b), (f))

Category: Billing data
Examples: Plan, purchase history, billing country, tax ID, partial payment details provided by Polar
Purpose: Managing subscriptions, credits, invoicing and tax records
Legal basis (GDPR Art. 6): Contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c))

Category: Usage and audit data
Examples: Logins, IP addresses, actions taken in the Service, tests started, targets and scopes configured, timestamps
Purpose: Operating the Service, enforcing our Acceptable Use Policy, preventing abuse, security, audit trails
Legal basis (GDPR Art. 6): Legitimate interests in securing the Service and preventing unauthorised testing (Art. 6(1)(f)); legal obligation where applicable

Category: Authorisation records
Examples: Verification records, authorisation documents you upload, scope approvals
Purpose: Confirming tests are authorised and defending legal claims
Legal basis (GDPR Art. 6): Legitimate interests (Art. 6(1)(f))

Category: Support and correspondence
Examples: Messages, emails and attachments you send us
Purpose: Responding to requests, support and disclosures
Legal basis (GDPR Art. 6): Contract or legitimate interests (Art. 6(1)(b), (f))

Category: Website data
Examples: IP address, browser and device data, pages visited, cookie identifiers
Purpose: Delivering and securing the website; analytics where you have consented
Legal basis (GDPR Art. 6): Legitimate interests for essential functions (Art. 6(1)(f)); consent for analytics (Art. 6(1)(a)) — see our Cookie Policy

Category: Marketing data
Examples: Email address, communication preferences
Purpose: Product updates and news to business contacts
Legal basis (GDPR Art. 6): Legitimate interests or consent, as required by law (Art. 6(1)(f) or (a)); you can opt out at any time

We do not use personal data for solely automated decisions that produce legal or similarly significant effects on you.

4. Where we get your data

Mostly from you directly. We also receive data from your organisation’s administrators (when they invite you), from Polar (payment and tax information) and from our hosting and security tools (technical logs).

5. Who we share data with

We share personal data only as needed for the purposes above, with:

• Service providers (processors) who host and run the Service on our behalf, listed on our Subprocessors page, bound by data processing agreements;

• Polar Software, Inc., our merchant of record, which processes payment and tax data to sell you the subscription. Polar acts as an independent controller for that processing under its own privacy policy;

• Professional advisers such as accountants, auditors and lawyers, under confidentiality duties;

• Authorities, where required by law or to protect rights and safety, including in connection with suspected unauthorised testing (see our Acceptable Use Policy); and

• A buyer or successor in a merger, acquisition or sale of assets, subject to equivalent protections.

We do not sell personal data.

6. International transfers

Some of our providers are based in, or access data from, countries outside the European Economic Area (EEA), in particular the United States. Where personal data is transferred outside the EEA, we make sure an appropriate safeguard applies, such as:

• an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is certified under it; or

• the European Commission’s Standard Contractual Clauses (SCCs), with supplementary measures where needed.

Where we use AI model providers to power the testing engines, data sent to them may be processed in [AI MODEL PROVIDER PROCESSING LOCATION] under [TRANSFER SAFEGUARD]. You can request a copy of the relevant safeguards by contacting [PRIVACY CONTACT EMAIL].

7. How long we keep data

Data: Account data
Retention period: For the life of the account, then [ACCOUNT DATA RETENTION] after closure

Data: Billing and accounting records
Retention period: As required by Croatian accounting and tax law, [BILLING RECORD RETENTION — CONFIRM STATUTORY PERIOD]

Data: Usage and audit logs
Retention period: [AUDIT LOG RETENTION]

Data: Authorisation records
Retention period: [AUTHORISATION RECORD RETENTION], or longer if needed for a legal claim

Data: Support correspondence
Retention period: [SUPPORT RETENTION]

Data: Website analytics
Retention period: [ANALYTICS RETENTION]

Data: Marketing data
Retention period: Until you opt out, then kept on a suppression list so we respect your choice

Customer test data processed under the DPA is retained and deleted as set out in the DPA. We may keep data longer where needed to establish, exercise or defend legal claims.

8. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, per-tenant isolation, isolated test workers, access controls and audit logging. See our Security page for details. No system is completely secure, and we encourage you to use strong, unique passwords and multi-factor authentication.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;

• rectify inaccurate data;

• erase your data in certain circumstances;

• restrict processing in certain circumstances;

• data portability for data you provided to us under a contract or consent;

• object to processing based on legitimate interests, and to object at any time to direct marketing; and

• withdraw consent at any time, where processing is based on consent, without affecting earlier processing.

To exercise your rights, contact [PRIVACY CONTACT EMAIL]. We may need to verify your identity. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you.

10. Right to complain

You have the right to lodge a complaint with a supervisory authority. In Croatia this is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), azop.hr. You may also complain to the authority in your EU country of residence or work, or where the alleged infringement took place. We would appreciate the chance to address your concerns first.

11. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect children’s personal data.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “Last updated” date and, for significant changes, notify account holders by email or in the Service.

13. Contact

Questions about this policy or our handling of personal data: [PRIVACY CONTACT EMAIL], or write to us at [REGISTERED ADDRESS].