Skip to content

Legal · updated 2026-09-04

Privacy

Short version: we collect what we need to reply to you, we keep it only as long as that takes, and we don't sell it. If you talk to Aurelius — by text or on a call — that conversation is processed by the AI providers named below.

Who we are

The data controller is Glowbright LTD, Limassol, Cyprus, registration number HE 493253, registered office 78 Griva Digeni, Floor 2, Office B1, Neapoli, 3101 Limassol, Cyprus. Glowbright was founded in 2020 in Bruges, Belgium and operates from Cyprus. Privacy contact: hello@glowbright.io.

What we collect, and why

  • When you send a brief (form, the site agent, or POST /api/brief): name, email, company, what you need, budget band, timeline, your message, the source of the lead, UTM parameters if present, and your IP address for spam control. Basis: steps at your request before a contract (GDPR art. 6(1)(b)) and our legitimate interest in keeping spam out (art. 6(1)(f)).
  • When you chat with Aurelius: the conversation transcript. It is sent to an AI model to generate the replies and kept to improve answers. If you share contact details, the transcript is attached to your lead record. Basis: your request; legitimate interest in running the agent.
  • When you call Aurelius: your microphone audio is streamed to ElevenLabs, which transcribes it, runs the conversation through an AI model, and speaks the reply. ElevenLabs keeps the audio and transcript of the call; we see the transcript. Your approximate city and time zone are sent into the call so he can offer meeting times in your local time. If you book a meeting, the name and email you give are used to create the calendar invite and to send you a recap. Basis: your request; consent to the microphone, which you give in the browser and can withdraw by hanging up.
  • When you book a call with Fede: name, email and topic go into Federico's Google Calendar as an invite with a Google Meet link, and a recap email is sent to you from aurelius@glowbright.io with Federico in copy. Basis: your request.
  • The opening sequence: on your first visit the site may greet you with coarse signals your browser already sends (approximate city from the request, device type, local time, referring site). Nothing from this is stored.
  • Analytics: PostHog (EU cloud) and Vercel Analytics, in memory-only mode with no cookies. PostHog session replay is on and masks what you type into fields. Basis: legitimate interest in understanding how the site is used.
  • Ad measurement: only if you accept cookies. See Cookies. Basis: consent.

Who processes it for us

Each of these acts on our instructions under a data-processing agreement. We never sell personal data.

  • Vercel — hosting and edge network (EU/US).
  • Neon — database for lead records (EU).
  • Resend — email notifications to us when a lead arrives.
  • Anthropic — the language model behind Aurelius in text chat.
  • ElevenLabs — voice calls: speech recognition, the language model that runs the call, and speech synthesis (US, under EU standard contractual clauses).
  • Google — Calendar and Meet for booked meetings; Gmail for the recap email from aurelius@glowbright.io.
  • PostHog — analytics (EU cloud).
  • Google Tag Manager and the ad platforms it loads — only after you accept cookies.

How long we keep it

  • Lead records: up to 24 months after the last contact, then deleted.
  • Text-chat transcripts without contact details: up to 90 days.
  • Voice-call audio and transcripts: up to 90 days at ElevenLabs, then deleted.
  • Calendar invites and recap emails: as long as the meeting record is useful, then deleted with the lead record.
  • Analytics: aggregated, retained per the provider's defaults.

Your rights

Access, correction, deletion, portability, restriction, objection, and withdrawal of consent at any time. Email hello@glowbright.io and we handle it within 30 days. You can also complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or the authority where you live.

Talking to an AI

Aurelius is software and says so when asked. He can make mistakes, and nothing he says is a binding offer. Please don't share health, financial-account, or other sensitive personal data with him; if you do, it is processed as described above. Children under 16 should not use the agent.

Changes

When this page changes, the date at the top changes with it.