Last updated: 13 October 2026
1. Roles
You are the controller of personal data you put into Shareglow; Shareglow, operated by Brandon Ta, an individual trading as Shareglow, is your processor. The operator is the controller of account and billing data needed to run your account.
2. Processing
We process personal data only on your documented instructions and to provide the service: storing workspace content, rendering images, scanning URLs and serving short links with aggregated click analytics.
We do not store visitor IP addresses with click analytics. For password-protected links the visitor's IP address is kept in a rate-limit counter for up to 15 minutes after a failed attempt. Sign-in sessions record your IP address and browser. Abuse reports record the reporter's email address.
3. Sub-processors
Cloudflare (hosting and storage), Contabo (database and headless browser worker server), Google (Gemini API for AI features) and Anthropic (Claude API, AI fallback), Google Safe Browsing (receives destination URLs), Meta Graph API (receives the page address when you use Refresh preview), Zoho ZeptoMail (email), Sentry (error monitoring) and PostHog (analytics, with consent). Polar is an independent merchant of record and controller of payment data; it is not our sub-processor. We flow the same obligations down to sub-processors and give notice of changes.
4. Security
Encryption in transit, access limited to staff who need it, signed URLs for paid-plan images, SSRF protection on every outbound fetch and breach notification without undue delay, within 72 hours of becoming aware.
5. Your rights and deletion
We help you answer data-subject requests. On termination we delete or return workspace data within 35 days, unless the law requires us to keep it.
6. International transfers and audits
Where data leaves the EEA or UK we rely on Standard Contractual Clauses. We give you the information needed to show compliance and allow reasonable audits. To countersign, email privacy@getshareglow.com.