Privacy policy

Glevu is a platform that lets local businesses build a website and run their operations online. This policy explains how we handle personal data for the people who visit glevu.com, the merchants who run a business on Glevu, and the shoppers who interact with a merchant site.

The data controller for this website and for merchant accounts is Starq Agency AB, the Swedish company that provides Glevu (organisation number 559165-9353). Our published company and contact details are set out in the Imprint. You can reach us about privacy at privacy@glevu.com.

Glevu plays two different roles, and it matters which one applies to a given piece of data.

• Glevu as controller. For visitors to glevu.com and for the merchant account holders who sign up with us, we decide why and how data is processed. We are the controller. This policy governs that data.
• Glevu as processor. For the shopper and customer data that a merchant collects through their own Glevu site (orders, bookings, contact messages, reviews), the merchant is the controller and Glevu is the processor. We process that data only on the merchant's documented instructions, under the data processing terms in our Terms of service. If you are a shopper asking about data a specific business holds, contact that business first; we will support them in responding.

Merchant account data

When you create a Glevu account we process your name, email address, password (stored only as a secure hash), business name, and the settings and content you add to your site. We also process operational records such as sign in times and support correspondence.

Billing data

Glevu subscriptions are billed by invoice and paid by bank transfer, so we do not receive card numbers for them. We keep the billing records needed to issue invoices and meet our bookkeeping obligations, such as plan, billing period, amount, and invoice history.

Website and product usage

We measure visits and clicks on glevu.com with Umami, without cookies and without reading or storing anything on your device. Measurement includes page paths, referral origins, device and browser language, and bounded campaign codes. We do not send form contents or use this data to build profiles across other sites. Server logs record technical data for security and service operation.

Migration waitlist

If you join the migration waitlist on glevu.com, we store your email address, your name if you give it, the language of the page, and the wording and version of the consent you ticked. We use them to confirm your sign-up and to write to you about moving your data to Glevu, based on your consent (Art. 6(1)(a)). To be removed, write to hello@glevu.com.

Shopper data processed for merchants

When a shopper buys from, books with, or contacts a merchant site, we process the data needed to deliver that (for example name, contact details, order or booking details) as the merchant's processor, not for our own purposes. Merchants can use the Glevu admin to export or anonymize a shopper's personal data upon request.

Under the GDPR, the Swedish Data Protection Act (2018:218) and the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH 12/25), we rely on the following bases:

• Performance of a contract (Art. 6(1)(b)): to create and run your account and provide the platform you signed up for.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse, and improve the product using aggregate usage data.
• Legal obligation (Art. 6(1)(c)): to keep accounting and tax records for the periods the law requires.
• Consent (Art. 6(1)(a)): where we ask for it, for example optional product emails. You can withdraw consent at any time.

We do not sell personal data. We use the providers below to run the platform. Each acts under a data processing agreement and processes data only for us:

The current subprocessor list is maintained here. We will update it before adding a new subprocessor that handles personal data.

• Vercel Inc.: application hosting, content delivery and storage for uploaded media (logos, product images). Where: Application functions run in Frankfurt (EU); content is delivered worldwide. Vercel is a United States company and data may be processed in the United States.
• Neon (Databricks, Inc.): the managed Postgres database that holds account, site and customer data. Where: United States company; data may be processed in the United States.
• Trigger.dev: background jobs such as site setup, scheduled tasks and sending email. Where: United States (AWS US East). Trigger.dev is a United Kingdom company.
• Anthropic PBC: AI model for the AI Copilot and writing help. It receives what you ask and the site content needed to answer. Where: United States company; data may be processed in the United States.
• Google Cloud: AI models (Vertex AI and Gemini) for the AI Copilot and writing help. They receive what you ask and the site content needed to answer. Where: United States company; data may be processed in the United States.
• Sentry (Functional Software, Inc.): error reports, which can include the page address and technical details of the request. Where: United States company; data may be processed in the United States.
• Upstash, Inc.: a fast cache that maps custom domains to sites, and a shared cache for rendered pages. Where: United States company; data may be processed in the United States.
• Resend: transactional email, and the contact lists for our waitlists. Where: United States company; data may be processed in the United States.
• Stripe: card payments on sites that switch them on. Card payments are off by default. Where: Stripe Payments Europe, Ltd. (Ireland); data may also be processed in the United States.
• Google (Sign in with Google, Google Calendar): Sign in with Google, and calendar connections that a staff member chooses to set up. Where: United States company; data may be processed in the United States.
• Apple (Sign in with Apple): Sign in with Apple, when you choose it. Where: United States company; data may be processed in the United States.
• Umami (self-hosted): cookieless visit and click counts on glevu.com and traffic reports for merchant sites. Where: Runs on a server we operate. No data is sent to Umami Software.

Several providers above are United States companies or process data there. We run the application in the European Union where we can. Where a provider processes data outside the EEA, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed, so your data keeps an equivalent level of protection.

We keep account data for as long as your account is active and for a short period afterwards to handle wind down. Invoices and other accounting records are retained for the statutory bookkeeping period. When a business is closed on Glevu, personal data is purged after a grace window (default 30 days), while invoices and order records are retained in anonymized form for the period the law requires (typically 11 years for accounting). Backups roll off on their own schedule.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where the law allows;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent you gave, without affecting past processing.

To exercise these rights, contact us at privacy@glevu.com. You can also complain to a supervisory authority. In Bosnia and Herzegovina this is the Personal Data Protection Agency (Agencija za zaštitu ličnih podataka, AZLP). In Sweden it is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

We use encryption in transit, hashed passwords, tenant isolation so one business cannot see another's data, least privilege access for our team, and audited change control on the database. No system is perfectly secure, but we work to protect your data and to detect and respond to issues quickly.

Glevu is a tool for businesses and is not directed at children. We do not knowingly collect personal data from children through glevu.com.

We may update this policy as the platform evolves or the law changes. We will post the new version here with an updated date, and for material changes we will notify account holders by email or in the admin.