Privacy Policy

1. Privacy Notice

This Privacy Policy explains how GLNZY Ltd. (“Glanzy”, “we”, “us”) collects, uses, shares and protects personal information when you visit glanzy.ai, join our waitlist, or use the Glanzy app and marketplace (together, the “Services”).

Who we are. Glanzy is a marketplace where independent beauty brands list their products and where prices move in real time based on the collective demand of all shoppers. For the personal information described in this policy, the data controller is GLNZY Ltd., contactable at support@glanzy.ai.

Data-protection regimes. We are established in the United Kingdom and Austria and make the Services available internationally. Your information is processed under the UK GDPR and Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR), and, depending on where you live, other local data-protection laws may also apply. We apply UK/EU GDPR standards as our global baseline and, where local law gives you stronger protection, we apply that.

Data Protection Officer / contact. We are not currently required to appoint a Data Protection Officer. You can raise any privacy matter with us at support@glanzy.ai.

2. Personal Information We Collect

We collect personal information in three ways: directly from you, automatically as you use the Services, and from third parties. The specific information depends on how you interact with us — for example, joining the waitlist involves far less data than placing an order.

2.1 Personal Information We Collect Directly from You

We collect what you choose to provide, including:

• Waitlist sign-up: first name, surname and email address.
• Account registration: name, email, password, and optional profile details.
• Target prices and watchlist (“Radar”): the products you save, the target price you set, and alert preferences.
• Orders: delivery address, order contents and order history. Payment card details are entered directly with our payment processor (Stripe) and are not stored by Glanzy.
• Communications: messages, reviews, feedback and support requests you send us.

2.2 Personal Information We Collect Automatically

When you use the Services, we automatically collect:

• Behavioural demand signals: saves, watchlist/Radar additions, product clicks, views, revisits and the timing of these actions. These signals are the core input to our live-pricing engine.
• Device and technical data: IP address, device type, operating system, browser, app version and identifiers.
• Usage data: pages and products viewed, session duration, referring links and in-app navigation.
• Cookies and similar technologies: see Section 7 (Cookie Preferences).

2.3 Personal Information We Receive From Third Parties

We may receive information about you from:

• Payment processor (Stripe): confirmation of payment, partial card data (e.g. last four digits), and fraud/risk signals.
• Brands / merchants: order fulfilment and delivery status for items you purchase from them.
• Analytics and advertising partners: aggregated audience and campaign measurement data.
• Authentication / social login providers: if you choose to sign in via a third-party account, your basic profile information.

2.4 Aggregated, Deidentified, or Anonymized Information

We create aggregated and de-identified data — for example, total watchers on a product, demand trends, or category-level savings statistics — that does not identify any individual. We may use and share this information for any purpose. Where data has been truly anonymised so that re-identification is not reasonably possible, it is no longer “personal data” under UK/EU law. We do not attempt to re-identify de-identified data except to test our anonymisation.

3. Our Legal Bases for Processing

Under UK and EU GDPR we must have a lawful basis for each processing purpose. We rely on:

• Contract (Art. 6(1)(b)): to create your account, operate Radar/target alerts, process orders and provide support.
• Legitimate interests (Art. 6(1)(f)): to operate and secure the marketplace, prevent fraud, run our live-pricing engine on aggregated demand, and improve the Services — balanced against your rights.
• Consent (Art. 6(1)(a)): for non-essential cookies, marketing communications and personalised advertising. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to meet tax, accounting, consumer-protection and other legal requirements.

4. How We Use Personal Information

We use personal information to:

• Provide, operate and maintain the Services, your account and your orders;
• Operate the Radar watchlist and send target-price alerts you have set;
• Calculate live, demand-driven prices from aggregated shopper behaviour (see Section 6);
• Process payments through Stripe and coordinate fulfilment with brands;
• Communicate with you about transactions, security and service updates;
• Send marketing communications where permitted and personalise content you see;
• Detect, prevent and investigate fraud, abuse and security incidents;
• Analyse and improve the Services and develop new features;
• Comply with legal obligations and enforce our Terms.

5. How We Disclose Personal Information

We do not sell your personal information. We share it only as follows:

• Brands / merchants: the details needed to fulfil an order you place (e.g. name and delivery address).
• Service providers (processors): hosting, payments (Stripe), email, analytics, customer support and security vendors, acting on our instructions under data-processing agreements.
• Advertising and analytics partners: where you have consented, for measurement and personalised advertising (see Section 7).
• Legal and safety: to comply with law, respond to lawful requests, or protect our rights, users and the public.
• Corporate transactions: in connection with a merger, acquisition, financing or sale of assets, subject to this policy.

6. Live Pricing and Automated Processing

Prices are collective, not personalised. Glanzy prices are driven by the combined demand of all shoppers — signals such as saves, watchlist additions, clicks and revisits across the whole marketplace — and, during a campaign, only ever hold or fall, never rise. At any given moment, every shopper sees the same price for the same product. We do not set a different price for you based on your individual profile, identity or personal characteristics.

No automated decisions with legal or similar effects. Because our pricing is aggregate and not individualised, it does not constitute a decision based solely on automated processing that produces legal or similarly significant effects under Article 22 of the UK/EU GDPR. Setting a target price in Radar simply asks us to notify you; it does not make a decision about you.

7. Managing Your Marketing and Personalized Advertising Preferences

7.1 Marketing Communications

We send marketing emails only where you have opted in or where otherwise permitted by law. You can unsubscribe at any time using the link in any marketing email or by emailing support@glanzy.ai. Transactional messages (order confirmations, security notices, target-price alerts you set) are not marketing and will continue.

7.2 Cookie Preferences

We use strictly necessary cookies to run the Services, and — with your consent — analytics, functional and advertising cookies. You can set and change your preferences through our cookie banner or in your account settings, and through your browser controls. Under UK PECR and EU ePrivacy rules, non-essential cookies are set only after you consent.

7.3 Personalized Advertising Preferences

Where you consent, we and our partners may use cookies and identifiers to show you more relevant ads and measure their performance. You can withdraw consent at any time via our cookie settings, and use device-level controls and opt-out signals such as Global Privacy Control, which we honour where required.

8. International Transfers of Personal Information

We are established in the UK and Austria and operate internationally, and some of our service providers and users are located outside the UK and the European Economic Area (for example, in the United States and other countries). When we transfer personal information across borders, we rely on appropriate safeguards, including:

• UK–EU data flows under the relevant adequacy decisions;
• the EU Standard Contractual Clauses for transfers from the EEA;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs for transfers from the UK;
• adequacy regulations where a country has been recognised as providing adequate protection.

You can request a copy of the relevant safeguards by contacting support@glanzy.ai.

9. User-Generated Content

If you post reviews, ratings, comments or other content, it (and any personal information you choose to include) may be visible to other users and the public. Please do not include sensitive information you would not want shared. You are responsible for content you post; we may remove content that breaches our Terms. You can request removal of your content by contacting us, subject to any legal record-keeping obligations.

10. How We Protect Your Information

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, tokenised payments via Stripe (we do not store full card numbers), and monitoring for unauthorised access. No system is perfectly secure; where a personal-data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected individuals in line with our legal obligations.

11. How We Retain Your Information

We keep personal information only as long as necessary for the purposes described, then delete or anonymise it. Indicative periods:

• Waitlist data: until launch or until you unsubscribe / we no longer need it, whichever is sooner.
• Account data: for the life of your account and a reasonable period afterwards.
• Order and transaction records: for the period required by applicable tax and accounting law.
• Behavioural / demand-signal data: kept in identifiable form only for as long as necessary for the purposes described, then aggregated or anonymised.

12. Your Privacy Rights

Subject to conditions and exemptions in UK and EU GDPR, you have the right to:

• Access — obtain confirmation of and a copy of your personal information.
• Rectification — correct inaccurate or incomplete information.
• Erasure — ask us to delete your information in certain circumstances.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive certain data in a portable format, or have it sent to another controller.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, without affecting prior processing.
• Complain — lodge a complaint with a supervisory authority (below).

12.1 How do I exercise my rights?

Email support@glanzy.ai or use your account settings in the app. We may need to verify your identity. We respond within one month (extendable by two further months for complex requests) and will tell you if we cannot fully comply and why. Exercising your rights is free unless a request is manifestly unfounded or excessive.

Supervisory authorities. If you are in the UK, you can complain to the Information Commissioner’s Office (ICO), ico.org.uk. If you are in Austria or the EEA, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at) or your local authority. We would appreciate the chance to address your concern first.

12.2 Region-specific rights

Depending on where you live, you may have additional rights. For example, residents of certain US states such as California may have rights to know, delete and correct their personal information, and to opt out of its sale or sharing and of targeted advertising. We do not sell personal information for money, and we honour recognised opt-out preference signals where required. To exercise any such right, contact support@glanzy.ai.

13. Children’s Privacy

The Services are not directed to children. You must be at least 16 years old to use the Services or join the waitlist. We do not knowingly collect personal information from children below the applicable age of digital consent. If you believe a child has provided us information, contact support@glanzy.ai and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (e.g. by email or in-app).

15. Contact Us

Questions about this policy or your personal information:

• Email: support@glanzy.ai
• Controller: GLNZY Ltd., company no. 17286640, registered office: 128 City Road, London, EC1V 2NX, United Kingdom