Privacy Policy

Glytos is a platform for building, testing, and running real-time voice and chat AI agents. This policy covers the Glytos website, dashboard, and APIs (the "Service"). When you use Glytos to serve your own users, you are the data controller for your end users data and Glytos acts as your processor; for your own account data, Glytos is the controller.

We collect only what the Service needs to function:

• Account data: name, email, password (stored only as a salted bcrypt hash), organization, and billing details.
• Agent and configuration data: the prompts, workflows, knowledge bases, and settings you create.
• Conversation data: transcripts, structured extractions, per-step cost and latency, and call audio when you enable recording.
• Usage and billing data: call counts, minutes, credit balance, and provider cost metering.
• Technical data: IP address, browser/device information, and request logs kept for security and debugging.

To provide and operate the Service: run your agents, render transcripts, cost and latency in your dashboard, meter usage, bill credits, secure accounts, and provide support. We do not sell your data, and we do not use your conversation content to train our own models.

Conversations are processed in real time to transcribe speech, decide responses, and synthesize voice. Recording is off unless you turn it on per agent.

You decide what is captured, and you can delete it at any time. Conversation text may also appear in our operational logs, which are kept for a limited period and used only to diagnose faults.

To deliver speech and intelligence, conversations may be routed, based on the providers you select, to third-party model, speech-to-text, text-to-speech, and telephony providers (for example OpenAI, Anthropic, Google, Deepgram, ElevenLabs, Cartesia, and Twilio or other carriers), plus our cloud hosting and storage providers.

• You choose which providers an agent uses.
• With bring-your-own-keys, requests go directly to your own provider accounts under your contracts with them, and your keys are encrypted at rest.
• Each provider processes data only to return the result for that request.

You can connect your own Google or Microsoft account so an agent can work with your calendar, and on Microsoft send mail from your mailbox. You connect it yourself on the provider’s own consent screen, and you can disconnect it at any time. Information that Glytos receives from Google APIs through such a connection is called Google user data in this section.

Who we share Google user data with. We share, transfer and disclose Google user data to two recipients, and only as far as carrying out the request you made requires. The first is our cloud hosting and storage provider, DigitalOcean, whose servers run Glytos and hold the authorization tokens in encrypted form. The second is the AI model provider your agent is configured to use, which is sent the calendar details needed to answer the request: the free times to offer and, when you ask the assistant what is on your schedule, the titles of those events. That provider is the one you chose for that agent from the list in section 5, and where you have supplied your own key the request goes to your own account with them under your own contract. We do not transfer or disclose Google user data to any other third party for any purpose other than the ones described in this policy, and we do not sell it.

Glytos’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access. From Google: events on calendars your account owns, and your email address so the connection can show whose calendar it is. From Microsoft: your calendar, your email address, and permission to send mail as you.
• How we use it. We read your existing events to work out when you are free, create or cancel the appointments your agent was asked to make, and send an email where you configured one to be sent. We use it for nothing else.
• How we store and protect it. We store only the authorization tokens, encrypted at rest, together with the account address, time zone and working hours you entered. We do not copy your calendar or your mailbox into our systems. Traffic to Google and Microsoft is over TLS, and access is scoped to your organization.
• What we never do. We do not use Google user data for advertising, and we do not use it to train or improve any AI or machine-learning model, ours or anyone else’s. No person at Glytos reads it, except with your explicit permission to resolve a support request you raised, or where security or the law requires it. Our error-monitoring provider receives technical fault reports that carry no calendar or mailbox content.
• How to revoke access and delete it. Removing the connection in Glytos deletes the tokens we hold for it. You can also revoke access directly at myaccount.google.com/permissions or myapps.microsoft.com, which stops all further access immediately; the tokens we hold then no longer work, and removing the connection clears them. To have anything that remains deleted, contact us at contact@glytos.com.

Transcripts and recordings are kept until you delete them. Deleting an agent, session, or organization removes the associated data, subject to short backup and legal-hold windows. API access logs are kept for 30 days by default and call event logs for 90 days. If your account needs a specific retention period, contact us and we will arrange it.

Data is encrypted in transit (TLS) and provider credentials are encrypted at rest. Access is scoped per organization, passwords are bcrypt-hashed, and sessions use signed, expiring tokens. See our Security page for the full posture.

Depending on your location you have rights to access, correct, export, restrict, object to, and delete your personal data. Under Turkey KVKK (Law No. 6698, Article 11) you may also learn whether your data is processed and request it be corrected or erased. You can delete an agent, a session or an organization yourself from the dashboard at any time, and you can exercise any of these rights by contacting us.

Glytos and its subprocessors may process data in countries other than yours. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

We use a small number of strictly necessary items: a language preference cookie and a session token to keep you signed in. We do not use advertising or cross-site tracking cookies.

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their data.

We will update this policy as the Service evolves and revise the date above. For any privacy request or question, contact contact@glytos.com.