Privacy Policy

This Privacy Policy explains what personal data Glyfa ("we", "us") collects when you use the Glyfa PDF generation API and dashboard at glyfa.dev, why we collect it, who we share it with, and the rights you have. For any privacy question, contact [email protected].

1. Data we collect

Account data — your email address, used as your account identifier and to communicate with you about the Service.
API keys — we store only a SHA-256 hash of each key, never the key itself.
Usage data — counts and timestamps of the documents you generate, used for metering and billing.
Payment data — if you subscribe, payments are processed by Stripe. We store your Stripe customer and subscription identifiers; we never see or store your card details.
Technical data — your IP address (used transiently for rate limiting and abuse prevention) and basic request logs.
Analytics — we use a self-hosted, cookieless analytics tool (Umami) that records aggregate page views without tracking you across sites or storing personal identifiers.

2. What we do NOT do

We do not store the HTML or JSON you send for rendering beyond the brief time needed to produce your document.
We do not sell your personal data, and we do not use your content to train AI models.
We do not use advertising or cross-site tracking cookies. The dashboard stores your API key in your browser's local storage, on your device only — it never leaves your browser except as the Bearer token on requests you make.

3. How we use your data

To provide and operate the Service — authenticate your requests, render documents, and deliver results.
To meter usage and bill you on paid plans.
To communicate with you about your account, security, and material changes to the Service.
To detect and prevent abuse and keep the Service secure.

Our lawful bases for processing (under UK and EU GDPR) are: performance of our contract with you, our legitimate interests in operating and securing the Service, and your consent where it applies.

4. Who we share data with

We share the minimum necessary with infrastructure providers that help us run Glyfa:

Stripe — payment processing. Their privacy policy governs how they handle payment data.
Cloudflare — CDN, DNS, and secure tunnel; processes your requests in transit.

These providers act as our processors and are contractually bound to protect your data. We do not sell or rent your personal data to anyone.

5. Generated documents and backups

Documents you generate are stored in object storage so you can retrieve them via a time-limited signed URL. You are responsible for downloading and retaining your own generated documents. Database backups — which contain account metadata such as your email, but never card data — are encrypted before being stored.

6. Data retention

Account data is kept while your account is active and deleted on request or after account closure.
Backups are encrypted, rotated, and retained for a limited period.
Logs are retained for a short period for security and debugging.

7. Your rights

Depending on where you live (including under UK and EU GDPR), you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email [email protected]. You may also delete your data by closing your account.

8. Security

We hash API keys, encrypt backups, serve all traffic over HTTPS, and restrict access to production systems. No system is perfectly secure, but we take reasonable measures to protect your data.

9. International transfers

We may process data in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

10. Children

Glyfa is not intended for anyone under 16, and we do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated date.

12. Contact

Privacy questions or requests: [email protected].