Privacy Policy

Last updated: September 16, 2026

This Privacy Policy explains and lists the transparency information regarding what personal data is collected when you use our mobile applications, websites and the services provided through them (together "App" or "Service") and how such personal data will be processed.

1. What data we process and why

Registering for a programme and providing our services

When you complete our questionnaire and subscribe, you give us your questionnaire answers (which may include the health-related data described above), your first name and your email address.

We use this to select a programme for you, to create your account, to unlock the application, to keep your subscription running, and to contact you about the service — receipts, access links, renewal reminders, failed-payment notices and changes to our Terms.

We receive these data directly from you. The basis for processing is your consent and the necessity of performing our contract with you. Some of it is essential — without it we cannot assess your situation and you will not be able to use our services.

It is important that what you give us is accurate, particularly your email address. If you enter an address that is wrong or that you cannot access, we cannot deliver your access, and we will not be responsible for loss arising from that. We have no way to verify what you enter, and when we accept your questionnaire we treat your details as accurate and your consents as freely given.

Retention: while you use our services, and for 12 months after your last login or visit. We may keep a record of your consent for longer where we need it to defend a claim.

Payments, invoicing and other legal obligations

We process your name, purchase history and payment records to the extent required to meet obligations imposed on us by law.

The basis is compliance with a legal obligation.

Retention: as long as the law requires — for accounting and tax records, 10 years. This applies even if you ask us to delete everything else.

Direct marketing

We may process your name, email address, account information and purchase history in order to send you relevant news, tips and offers.

The basis is your consent, which you can withdraw at any time by using the unsubscribe link in any of our emails or by contacting support@glowsy.app.

Retention: no longer than 2 years from the date of your consent. We may keep the consent and evidence of it longer where we need it to defend a claim.

Note that unsubscribing from marketing does not stop messages directly related to the provision of our services.

Enquiries, complaints, requests and feedback

We process your name, email address, the content of your enquiry, your account information, and anything else needed to resolve it.

We use this only to examine your enquiry properly, give you the information you need, and resolve your request. We may also analyse enquiries in order to improve our services.

The basis is your consent, expressed by contacting us.

Retention: until the matter is resolved and for up to 6 months afterwards, and in any event not less than:

• email enquiries — 6 months
• complaints — up to 5 years
• social media messages — 6 months

If an enquiry leads to a legal dispute, or one appears likely, we may keep the data longer, until the limitation periods expire or a final decision takes effect.

Managing our social media accounts

Where you interact with our pages on Instagram, Facebook or TikTok, we may process your profile name and picture and your reactions, comments and shares.

The basis is your consent, which you may withdraw at any time by removing your comment or interaction. In some cases we may rely on our legitimate interest — for example in investigating a dispute between you and us.

Retention: as long as your interaction and our page both exist, unless you ask us to remove it sooner.

The platform itself also processes your data under its own policy, which we do not control.

Running the website and application, and statistical analysis

We may process your device data, which can include IP address, browser type and version, operating system, device type and screen resolution, together with information about how you use our website and application — where you arrived from, how long you stayed, which steps of the questionnaire you completed and where you left, and how often and how long you use the services.

We obtain these data through cookies and similar technologies. The basis is your consent, which you may withdraw at any time by changing your cookie settings.

Retention: no longer than 2 years from the date of your consent. Where processing is based on our legitimate interest in running the website, the application and our business properly, we process the data for as long as that interest requires. See section 11.

Establishing, exercising and defending legal claims

To bring, defend or resolve legal claims, we may process any of the data described in this Policy, to the extent necessary for the particular dispute or claim.

The basis is a legal obligation and our legitimate interests.

Retention: as long as necessary — for example while proceedings continue, or in order to defend our rights and respond to claims.

Once the retention period set out in this Policy ends, we destroy or irreversibly anonymise the data as soon as reasonably practicable.

2. If you gave us your details but did not subscribe

If you complete part of our questionnaire and give us your email address but do not go on to subscribe, we keep your email, first name and answers on the basis of our legitimate interest in following up an enquiry you began, for no longer than 90 days, after which they are deleted. Unsubscribing from our emails stops them and deletes your record.

3. Advertising

If you consent, we use tools provided by Meta to measure which of our advertisements bring people to us. This sends Meta a scrambled version of your email address and certain technical identifiers about your visit. Your email address is never sent in readable form.

For this, we and Meta Platforms Ireland act as joint controllers; Meta is separately responsible for what it does with the data afterwards. You can bring any request to us at support@glowsy.app.

Nothing is shared unless you consent, and you can withdraw at any time in your cookie settings.

4. Your rights

The right of access. You have the right to obtain confirmation of whether we process your personal data, to see the data we hold, and to be told the purposes of processing, the categories of data and of recipients, the retention period, the sources of the data and so on.

The right to rectification. If the details you gave us have changed, or you believe what we hold is inaccurate, incomplete or incorrect, you have the right to ask us to change, supplement, update or correct it.

The right to withdraw consent. Where we process your data on the basis of your consent, you may withdraw it at any time and processing on that basis will stop. In some cases this may mean we can no longer provide our services to you.

The right to erasure ("the right to be forgotten"). In the circumstances set out in law — where data is processed unlawfully, where you have withdrawn consent, where the basis for processing has ceased, and others — you may ask us to erase your personal data. Please send a written request to support@glowsy.app.

Note that in certain cases provided for by law — for example where processing is necessary to meet a legal obligation, or to bring, exercise or defend legal claims — we will not be able to grant a request for erasure.

The right to restrict processing. In certain cases you have the right to restrict processing of your data — for example where you contest its accuracy, or where processing is unlawful but you prefer restriction to erasure.

The right to object. You have the right to object to our processing of your data on grounds relating to your particular situation, to the extent that the processing is based on our legitimate interests or those of a third party. If you object, we will stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary to bring, exercise or defend legal claims. You may object to direct marketing at any time, without giving a reason.

The right to data portability. Data that we process on the basis of your consent by automated means, you have the right to transfer to another controller. We will provide it in a commonly used, machine-readable format, and where you ask and it is technically feasible, send it directly to the controller you name.

The right to lodge a complaint. We ask that you come to us first — we believe most matters can be resolved in good faith. If you are not satisfied with the solution we offer, or you believe we have not taken the action your request required, you have the right to lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, Vilnius, https://vdai.lrv.lt, or with the supervisory authority in the country where you live.

5. Deleting your account

You can delete your account in the application, under Profile → Settings, or by writing to support@glowsy.app.

Deleting your account removes your access to everything in it, including your progress. Deleting the application does not cancel your subscription. If you subscribed through the App Store, cancel in your Apple account settings; if you subscribed on our website, cancel at your account log-in.

Some data survives deletion because the law requires us to keep it — principally payment and invoice records.

6. Processing of minors' personal data

Our website and application are intended only for people over 18 years of age.

If we have reason to believe we are processing data about a person younger than that, we will delete it. If you have learned that your child has provided us with personal data without your consent, contact us at support@glowsy.app.

7. Data security

We use a range of technologies and procedures to protect your personal information against unauthorised access, use or disclosure.

Organisational measures include restricting access to authorised persons with a legitimate need, confidentiality undertakings, and adopting and applying appropriate policies and procedures. Technical measures include measures for internet security, reducing the risk of data loss, alteration or unauthorised access, access control and authentication, and physical security. Our providers are selected carefully and we require them to apply appropriate measures to protect the confidentiality and security of your data.

That said, the security of information transmitted over the internet or mobile networks cannot be guaranteed, and any transmission to us by those means is at your own risk.

8. How we handle your requests

On receiving a request to exercise any of your rights, we undertake to provide you with information about the action we have taken without undue delay, and in any event within one month of receiving it. In the cases provided for by law, and taking account of the nature and complexity of the request, we may extend that period to the extent the law permits.

To protect your data we will normally need to verify your identity — usually by confirming that the request comes from the email address on your account.

We will refuse a request with a reasoned reply, and inform you in writing, where the circumstances set out in law apply — for example where a request is clearly unfounded, excessive or repetitive.

For any questions about data processing, contact us at support@glowsy.app.

9. Cookies

Cookies are small text files saved on your device (computer, phone, tablet) when you visit our website or use our application. They keep the website working and secure, support sign-in, allow us to analyse traffic, and — with your consent — deliver personalised offers and advertising.

On your first visit you are shown a cookie notice where you can choose which categories to allow. You can withdraw or change your consent at any time by changing your cookie settings on the website or in your browser, and by deleting cookies already saved.

Necessary. Required for the website to work properly and securely. They support core functions such as secure sign-in, fraud prevention, session continuity, remembering your place in the questionnaire, and remembering your cookie choices. They are set automatically and cannot be switched off through our cookie settings, because without them the website could not work. They are not intended to identify you directly, although some technical identifiers such as a session or device ID may be used for security and functionality.

Analytics. Used so that we can understand how visitors use the website and application — the number of visitors, how long they stay, which pages and steps they view, traffic sources, repeat visits, errors and performance. This helps us improve our content, usability and functionality. These are set only with your consent. If you decline or later withdraw consent, our analysis may be less accurate, but the main functions of the website will not be affected.

Advertising. Used so that more relevant advertising can be shown to you based on your browsing and interests, to limit how often the same advertisement is shown, and to measure how effective our advertising campaigns are. These are set only with your consent. If you decline or withdraw consent, advertising may be less relevant to your interests, but the main functions of the website will not be affected.

Blocking necessary cookies may mean the website does not work properly and that some functions become unavailable.

10. Changes to this Policy

We reserve the right to amend this Policy at any time. All changes will be published on the website, and where changes are material we may inform you by email or by other means we consider appropriate in the circumstances.

All changes take effect from the day they are published on the website.