Privacy Policy, Glint
Last updated: 3 July 2026
Entity information: GLINT SAS, SIREN 104 088 703, Niort Trade and Companies Register, share capital of 2,000 EUR, registered office located at 18 Chemin de la Futaie 79200 Pompaire. Holding company: AIRAULT & CO SAS, SIREN 103 077 202, Niort Trade and Companies Register.
1. Introduction
This Privacy Policy (the "Policy") describes how GLINT, a French simplified joint-stock company (société par actions simplifiée, SAS) with a share capital of 2,000 euros, whose registered office is located at 18 Chemin de la Futaie, 79200 Pompaire, France, registered with the Niort Trade and Companies Register under number 104 088 703, represented by its President AIRAULT & CO (SAS, SIREN 103 077 202) ("Glint", "we" or "our") collects, processes, stores and shares the personal data of persons who use its services (the "Services"), accessible via the glintdata.io website, the Glint mobile application and the enterprise portal (collectively, the "Platform").
Glint operates a paid human data collection platform that connects two categories of users:
- Contributors: adult natural persons who carry out data capture missions (photos, videos, audio, screen-and-voice sessions) in exchange for remuneration;
- Clients: companies (in particular AI labs, robotics companies and world model builders) that order and acquire datasets produced via the Platform.
Glint undertakes to natively comply with Regulation (EU) 2016/679 (the "GDPR"), the amended French Data Protection Act of 6 January 1978 (loi Informatique et Libertés, the "Data Protection Act") and Regulation (EU) 2024/1689 (the "AI Act").
We reserve the right to amend this Policy at any time. Any material change will be notified to you by email at the address associated with your account and/or via an in-app notice before the effective date of the change. Continued use of the Services after the effective date constitutes acceptance of the revised version.
2. Data Controller and Contact
The data controller is:
GLINT (SAS) 18 Chemin de la Futaie, 79200 Pompaire, France SIREN: 104 088 703, Niort Trade and Companies Register Share capital: 2,000 EUR Represented by its President: AIRAULT & CO (SAS, SIREN 103 077 202) Email: privacy@glintdata.io
For any question relating to the protection of your data or the exercise of your rights, please contact us at privacy@glintdata.io with "GDPR" in the subject line.
Glint is not currently required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. This obligation will be reassessed once regular and systematic monitoring of Contributors on a large scale becomes effective.
3. Scope
This Policy applies to any person who:
- visits glintdata.io or the associated subdomains;
- creates a Contributor account on the Glint mobile application or website;
- creates a Client account on the Glint enterprise portal;
- carries out a data capture mission on behalf of Glint;
- orders, downloads or uses a dataset delivered by Glint;
- interacts with Glint by email, contact form or any other official channel.
This Policy does not apply to third-party services that you may use alongside the Platform (in particular banking services, Stripe, PayPal, Google, Apple, telecom operators, etc.). These services are governed by their own privacy policies, which we encourage you to read.
4. Data We Collect
4.1 Data you provide
4.1.1 Account and profile data (Contributors and Clients)
- First and last name, username
- Email address
- Password (stored encrypted, never in plain text)
- Phone number
- Date of birth (verification of legal adult age)
- Country and city of residence
- Profile photo (optional)
- Language(s) spoken
- Login credentials via a third-party provider (Google, Apple) where applicable
4.1.2 Data specific to Contributors
- Identity document: a copy of a valid identity document (national identity card, passport, residence permit) for the purposes of age verification, KYC and fraud prevention
- Banking information: IBAN, BIC or Stripe/PayPal identifiers for payouts
- Tax data: status (auto-entrepreneur where applicable), tax identification number (TIN), country of tax residence, collected for the DAC7 declaration to the tax authorities and for the issuance of self-billing invoices
- Professional information: occupation, specific skills, languages spoken, equipment (smartphone model)
- Postal address: only where necessary for the delivery of specialised capture equipment or for tax purposes (in particular the DAC7 declaration and the issuance of self-billing invoices)
- Balance and earnings history: amounts earned, missions completed, withdrawals made
- Contributor level: Starter, Confirmed, Expert or Ambassador
- Moderation history: warnings, suspensions, exclusions where applicable
4.1.3 Content submitted by Contributors ("Submitted Content")
When you carry out a mission, or when you freely upload content to the Catalogue outside of any commissioned mission (" Free Upload"), you submit to the Platform content that may contain personal data:
- Photo, video and audio files captured as part of missions or uploaded via Free Upload
- Screen-and-voice sessions: screen captures accompanied by voice annotations
- EXIF/IPTC metadata: date and time of capture, device model, technical settings, geolocation (if enabled on the device)
- Contextual metadata: personal description of the scene, tags, environmental context, intention/action in progress, as entered by you
- Files that may contain images of third parties, voices, licence plates, personal documents: it is your responsibility to obtain the prior written consent of any identifiable person appearing in your Submitted Content (see Section 6.4)
Content containing identifiable third parties. You must not upload Submitted Content containing identifiable third parties (faces, licence plates, voices, personal documents) without being entitled to do so. Glint applies automated filtering and human review to this type of content. As long as Glint does not offer an anonymisation feature (blurring of faces and plates, voice transformation), any Content in which an identifiable human face or a readable licence plate is detected is rejected and is neither added to the Catalogue nor delivered to a Client. No automated process is infallible, and the obligation to hold the necessary rights rests with you as a contributor.
4.1.4 Data specific to Clients
- Company name, legal form, identification number (SIREN, VAT, EIN, etc.)
- Billing and registered office address
- Contact details of the technical and commercial contact (name, position, email, phone)
- Payment information (payment card, IBAN, Stripe identifiers)
- Order history, datasets downloaded, invoices issued
4.1.5 Communications
Any content you send us via privacy@glintdata.io, the contact form, the in-app messaging, WhatsApp or any other official communication channel, including any attachments.
4.2 Data collected automatically ("Technical Data")
When you access the Platform, we automatically collect:
- Connection data: IP address, internet service provider, connection logs, dates and times of access
- Device data: device type, operating system and version, advertising identifier where applicable, browser language
- Usage data: pages viewed, missions browsed, time spent, clicks, navigation paths, features used, errors encountered
- Mobile application data: installed version, application events (launch, crash), push notifications enabled
- Cookies and trackers: see Section 7
4.3 Data received from third parties
- Third-party authentication: if you log in via Google, Apple or another provider, we receive the profile information they share with us (email, name, user identifier, photo)
- Identity verification: KYC is handled natively by Stripe Connect when the Contributor registers. Stripe collects the identity document, verifies the address, performs a check against sanctions lists and transmits the result to us (validated/refused status, reasons).
- Social networks: if you interact with our social pages (LinkedIn, X, Instagram, TikTok), we may receive limited profile data depending on your privacy settings
- Partners: as part of referral programmes or partnerships, we may receive your contact details if you have consented to this
- Public sources: for B2B prospecting or due diligence purposes, we may consult public sources (professional LinkedIn, trade registers, specialised press)
5. Purposes, Legal Bases and Retention Periods
In accordance with Article 6 of the GDPR, each processing activity is based on an identified legal basis. The table below summarises the main purposes, legal bases and retention periods.
| Purpose | Data concerned | Legal basis | Retention period |
|---|---|---|---|
| Creation and management of the Contributor or Client account | Account, profile, login credentials | Performance of the contract (art. 6.1.b GDPR) | Duration of the account + 3 years after the last activity |
| Identity verification (KYC) and fraud prevention | Identity document, photo, verification data | Legal obligation (art. 6.1.c GDPR) (fight against fraud and money laundering) | 5 years from the closure of the account (art. L.561-12 of the French Monetary and Financial Code) |
| Performance and payment of missions | Submitted Content, banking data, earnings, tax data | Performance of the contract (art. 6.1.b GDPR) | Payment data: 10 years (accounting obligation); Submitted Content: see Section 5.1 |
| Licensing and transmission of datasets to Clients | Enriched Submitted Content, pseudonymised metadata | Performance of the contract (art. 6.1.b GDPR) + Explicit consent of the Contributor (art. 6.1.a GDPR) | See Section 5.1 |
| Automatic AI enrichment of Submitted Content | Files, metadata | Legitimate interest (art. 6.1.f GDPR) (creation of dataset value) | Same as Submitted Content |
| Management of the Catalogue (Free Upload): qualification, indexing, cataloguing and listing for sale of content freely uploaded by the Contributor, assignment of a unique reference code, tracking of its lifecycle, calculation and payment of the validation-based remuneration | Files, metadata, reference code, validation and remuneration history | Performance of the contract (art. 6.1.b GDPR) (the Terms of Use) and legitimate interest (art. 6.1.f GDPR) (operation of the Catalogue) | See Section 5.1 |
| Platform security, access logs, intrusion detection | Technical data, logs | Legitimate interest (art. 6.1.f GDPR) | 12 months maximum (CNIL recommendation) |
| Service communications (notifications, invoices, alerts) | Email, phone, account data | Performance of the contract (art. 6.1.b GDPR) | Duration of the account |
| B2B commercial prospecting | Professional contact details | Legitimate interest (art. 6.1.f GDPR) (professional prospecting) | 3 years from the last contact |
| Marketing and newsletters (B2C) | Consent (art. 6.1.a GDPR) | Until consent is withdrawn, and at the latest 3 years after the last contact | |
| Analytics and audience measurement cookies | Non-essential cookies | Consent (art. 6.1.a GDPR) | 13 months maximum |
| Responses to GDPR requests | Data necessary to process the request | Legal obligation (art. 6.1.c GDPR) | 3 years after the request is processed |
| Litigation and legal defence | Relevant data | Legitimate interest (art. 6.1.f GDPR) | Applicable limitation period (generally 5 years) |
5.1 Special case: retention of Submitted Content and delivered datasets
The specificity of Glint's model requires a particular retention regime that we wish to make explicit:
-
Before quality control validation: the raw Submitted Content is stored on Glint's servers for the time necessary for validation, up to 30 days after submission. Rejected files are deleted at the latest 30 days after the rejection notice.
-
After validation and delivery to a Client: the licence granted by the Contributor to Glint, and by Glint to the Client, is granted on a perpetual and irrevocable basis, within the limits defined by the Contributor Licence (see Section 8 and the Terms of Use). Delivered datasets may be used by Clients to train and improve their AI models beyond the closure of the Contributor's account or any subsequent deletion request, within the limits provided by law and by your explicit consent collected upon registration.
-
Right to object for future missions: at any time, a Contributor may withdraw their consent and request the deletion of their data. This withdrawal takes effect for all future missions but does not affect the licence of datasets already delivered to Clients in good faith. See Section 6.
-
Content uploaded via Free Upload to the Catalogue: content freely uploaded to the Catalogue, together with its metadata and reference code, is retained for as long as it is listed for sale in the Catalogue, or until the Contributor withdraws it from sale. Content already incorporated into a Dataset delivered to a Client follows the retention rule specific to delivered Datasets (see below).
-
Retention of Submitted Content on Glint's servers after delivery: the raw Submitted Content is deleted from Glint's servers at the latest 90 days after the delivery of the dataset to the Client, unless a specific contractual retention clause has been agreed with a Client (for example, for audit, redelivery or quality monitoring purposes).
Interaction with the right to erasure (art. 17 GDPR). The legal basis for processing Submitted Content is the explicit consent of the Contributor collected at the time of submission, supplemented by the performance of the contract. The irrevocability of the licence concerns the use of Datasets already delivered to Clients in good faith, and not the Contributor's right to obtain the deletion of their directly identifying personal data (name, email, IBAN, identity document), which remain deletable on request in accordance with Section 6.
6. Your Rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:
6.1 Right of access (art. 15)
You can obtain confirmation that data concerning you is being processed and obtain a copy of that data as well as information relating to its processing.
6.2 Right to rectification (art. 16)
You can request the correction of inaccurate or incomplete data concerning you. You can also update most of your profile data directly from your account.
6.3 Right to erasure (art. 17)
You can request the deletion of your data in the cases provided for by the GDPR, in particular when the data is no longer necessary in relation to the purposes, when you withdraw your consent, or when you object to the processing.
Limitations specific to Glint's model:
- the deletion of your data does not extend to Submitted Content already delivered to Clients as part of datasets, in accordance with the licence granted and Section 5.1;
- we are required to retain certain data to comply with our legal obligations (accounting, KYC, anti-fraud) for the periods indicated in Section 5;
- data present in encrypted technical backups is deleted as part of the backup rotation cycle (generally 30 to 90 days).
6.4 Right to restriction of processing (art. 18)
In the cases provided for by the GDPR, you can request that the processing of your data be restricted (suspended without deletion).
6.5 Right to data portability (art. 20)
You can receive your data in a structured, commonly used and machine-readable format, and ask us to transmit it directly to another data controller where technically feasible.
6.6 Right to object (art. 21)
You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. You can also object at any time and without justification to the processing of your data for direct marketing purposes.
6.7 Right to withdraw consent (art. 7.3)
Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
6.8 Rights relating to automated decisions (art. 22)
You have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. Glint uses automated systems for the technical quality pre-check of Submitted Content, AI enrichment and preliminary fraud detection. Any decision that significantly affects a Contributor (suspension, exclusion, refusal of payment, level downgrade) is subject to human review before its execution.
6.9 Right to define post-mortem directives
Pursuant to Article 85 of the French Data Protection Act (loi Informatique et Libertés), you have the right to define directives concerning the fate of your data after your death.
6.10 How to exercise your rights
You can exercise your rights by sending an email to privacy@glintdata.io with "GDPR" and the nature of your request in the subject line. For security reasons, we may ask you to verify your identity before acting on your request.
We undertake to respond to your request within one month of its receipt. This period may be extended by two additional months in the event of particular complexity, in which case we will inform you.
6.11 Right to lodge a complaint with the CNIL
If, after contacting us, you consider that your rights are not being respected, you can lodge a complaint with the French data protection authority:
CNIL 3 place de Fontenoy TSA 80715 75334 Paris Cedex 07 www.cnil.fr
7. Cookies and Trackers
7.1 What is a cookie?
A cookie is a small text file placed on your device when you visit a website or use an application. It makes it possible to recognise your device, remember your preferences or analyse your behaviour.
7.2 Categories of cookies used
| Category | Purpose | Legal basis | Duration |
|---|---|---|---|
| Strictly necessary cookies | Authentication, session, security, load balancing | Legitimate interest / Performance of the contract | Session or 13 months maximum |
| Audience measurement cookies | Anonymised analysis of usage (Vercel Analytics, equivalents) | Consent (except CNIL exemption for strictly internal anonymised analysis) | 13 months maximum |
| Functional cookies | Storage of your preferences (language, settings) | Consent | 13 months maximum |
| Marketing / advertising cookies | Glint does not use third-party advertising cookies at this stage | N/A | N/A |
7.3 Managing cookies
On your first visit to the Platform, a cookie banner allows you to accept, refuse or customise the placement of non-essential cookies. You can change your preferences at any time via the cookie management module accessible from the footer of the site.
You can also configure your browser to block or delete cookies. This configuration may impair the operation of the Platform.
The exhaustive list of cookies actually placed (name, provider, purpose, duration) is kept up to date in the cookie banner accessible on the site. In accordance with the CNIL's recommendations, the "Refuse" button is as visible as the "Accept" button.
8. Recipients and Processors
Your data may be disclosed to the following categories of recipients, strictly to the extent necessary to achieve the purposes described:
8.1 Internally
To authorised employees and staff of GLINT, within the limits of their responsibilities (technical team, ops team, customer success team, finance/accounting team).
8.2 To Clients (datasets)
Validated and enriched Submitted Content is transmitted to Clients in the form of datasets, accompanied by technical and contextual metadata. The Contributor's direct identity is never transmitted to the Client: a pseudonymised identifier (UUID) is used. A mapping table between the UUID and the real identity is kept separately, on a strictly restricted access basis.
The Contributor's identity and verification data (identity document, KYC data and, where applicable, biometric data processed by our verification provider) never leave Glint and are under no circumstances disclosed to a Client, a purchaser or a third party, including for the Client's own identity-verification purposes. Glint alone carries out the Contributor's identity verification.
When a Client browses the Catalogue (Free Upload), they only see watermarked previews and aggregated metadata, never the identity or contact details of the Contributor. Clients are contractually required not to attempt to re-identify a Contributor, whether from the Catalogue or from the delivered datasets.
8.3 To processors
Glint relies on processors to provide all or part of the Services. Each processor is governed by a processing agreement compliant with Article 28 of the GDPR.
| Processor | Service category | Server location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Ireland (European Union) | Supabase DPA, encryption at rest and in transit, no transfer outside the EU |
| Vercel | Frontend hosting and deployment | Multi-region (EU and United States) | Vercel DPA, Standard Contractual Clauses for transfers outside the EU |
| Google (Gemini API via Google Cloud) | AI enrichment of Submitted Content (description, tags, object detection) | Multi-region (including United States) | Google Cloud Data Processing Addendum (DPA) applicable by operation of law; use on the Paid Tier with an active Cloud billing account; Submitted Content is not used by Google to train its own models in accordance with the terms of Google's paid services; Standard Contractual Clauses for transfers outside the EU |
| Stripe (Stripe Connect, Stripe Identity) | Processing of Client payments, payouts to Contributors and identity verification (KYC) integrated into Stripe Connect | Ireland (EU) and United States | Stripe DPA, Standard Contractual Clauses, AML/CFT compliance |
| PayPal | Payouts to Contributors (optional) | Luxembourg (EU) and United States | PayPal DPA, Standard Contractual Clauses |
| WhatsApp / Meta | Transactional communication with Contributors (start-up phase) | Multi-region | Meta DPA, Standard Contractual Clauses; use limited to mission notifications and support |
| Google Drive / WeTransfer | Secure file transfer in the start-up phase (before migration to native infrastructure) | United States | Google Workspace / WeTransfer DPA, Standard Contractual Clauses; limited use, intended to be replaced by Glint's infrastructure |
| Resend | Sending of service emails (invoices, notifications, status updates) | United States (with European servers) | Resend DPA, Standard Contractual Clauses for transfers outside the EU, TLS encryption |
| Notion (Notion Labs, Inc.) | Storage and management of registrations submitted via the site's waitlist form (name, email, profile information you provide, and first-party attribution data: referring site, landing page, UTM parameters, pages viewed on our site before registration) | United States | Notion DPA, Standard Contractual Clauses for transfers outside the EU, TLS encryption |
| Cloudflare (Turnstile) | Anti-bot / "CAPTCHA" protection of the site's forms; processes your IP address and technical signals to distinguish humans from automated bots | United States (global edge network) | Cloudflare DPA, Standard Contractual Clauses for transfers outside the EU; Turnstile is privacy-oriented and does not use cookies for advertising tracking purposes |
This list is subject to change. Any material change will be reflected in this Policy. The processors used at any given time may be disclosed to you on request at privacy@glintdata.io.
8.4 Authorities, advisers and legitimate third parties
Your data may be disclosed:
- to administrative or judicial authorities where required by law (subpoena, court decision);
- to our advisers (lawyers, chartered accountants, statutory auditors) bound by confidentiality obligations;
- in the context of a sale, merger or reorganisation, to potential acquirers, bound by confidentiality obligations;
- to third parties where necessary to assert our rights or defend ourselves in legal proceedings.
8.5 No sale of data to third parties for commercial purposes
Glint does not sell or rent your directly identifying personal data (name, email, IBAN, etc.) to third parties for commercial purposes. The datasets delivered to Clients contain only the Submitted Content and pseudonymised Contributor identifiers, in accordance with the licence granted.
9. Transfers Outside the European Union
Some of our processors may process your data outside the European Economic Area, in particular in the United States. In such cases, Glint ensures that appropriate safeguards are in place, in accordance with Articles 44 to 49 of the GDPR:
- Adequacy decision of the European Commission (for example, the Data Privacy Framework for transfers to the United States for certified entities);
- Standard Contractual Clauses approved by the European Commission;
- Additional technical measures (encryption, pseudonymisation, strict access control);
- Transfer impact assessments where applicable.
You can request a copy of the applicable safeguards by contacting privacy@glintdata.io.
10. Security
Glint implements appropriate technical and organisational measures to protect your data against any unauthorised access, modification, disclosure or destruction:
- encryption of data in transit (TLS 1.2+) and at rest (AES-256);
- hashing and salting of passwords (bcrypt or Argon2);
- role-based access control, principle of least privilege;
- logging of access to sensitive data;
- network isolation of production environments;
- encrypted backups, regularly tested;
- periodic security testing and vulnerability monitoring;
- training of staff in security best practices;
- security incident management procedure, in accordance with Article 33 of the GDPR (notification to the CNIL within 72 hours and notification to the data subjects in the event of high risk).
As no measure can guarantee absolute security, you are invited to protect your credentials, use a strong and unique password, enable two-factor authentication when available, and immediately report to us at security@glintdata.io any suspected compromise of your account.
11. Data Concerning Minors
The Services are strictly reserved for adults (18 years and over). Glint does not knowingly collect personal data from minors. If we discover that data concerning a minor has been collected without the verified consent of the holders of parental authority, this data will be deleted as soon as possible.
If you believe that a minor has provided us with data, please contact us at privacy@glintdata.io.
Contributors expressly undertake not to include images, voices or other identifying data of minors in their Submitted Content without the prior authorisation of the holders of parental authority. Any Submitted Content containing data of a minor without proof of authorisation will be rejected and may result in the suspension or exclusion of the Contributor.
12. Automated Decisions and Artificial Intelligence (AI Act)
In accordance with Article 22 of the GDPR and Regulation (EU) 2024/1689 (AI Act), we inform you that Glint uses automated systems and artificial intelligence in several processing activities:
| Processing | System used | Underlying logic | Consequences |
|---|---|---|---|
| Technical quality pre-check of Submitted Content | Automated scripts | Verification of format, resolution, duration, metadata | Automatic notification to the Contributor in the event of failure, possibility of resubmission |
| Automatic filtering of third-party personal data in Submitted Content (identifiable faces, readable licence plates) | Visual detection models (computer vision) | Detection of identifiable human faces and readable licence plates, for as long as no anonymisation feature by blurring is offered | Automatic rejection of the content concerned, which is neither added to the Catalogue nor delivered to a Client (see Section 4.1.3); the Contributor is informed of this and may request human intervention and contest the decision at privacy@glintdata.io |
| Content safety control: rejection of illegal or toxic content | Content classification and moderation models | Detection of prohibited content: minors in a sexual context, explicit sexual content, graphic violence, hateful or extremist symbols | Automatic rejection of the content, which is neither added to the Catalogue nor delivered to a Client; manifestly illegal content may be reported to the competent authorities in accordance with the law; the Contributor may request human intervention and contest the decision at privacy@glintdata.io |
| Automatic enrichment (description, tags, object detection) | Generative and vision AI models (in particular Google Gemini) | Generation of semantic metadata from visual/audio content | No adverse decision against the Contributor; this data enriches the dataset delivered to the Client |
| Preliminary fraud detection | Algorithms (file hashing, reverse image search, metadata consistency check) | Identification of duplicates, stolen content, falsified metadata | In the event of suspicion, systematic human review before any sanction |
| Mission / Contributor matching | Profile and skills filtering algorithms | Suggestion of missions matching the Contributor's profile | No adverse decision; the Contributor remains free to accept or not |
No decision producing legal effects or significantly affecting a Contributor or a Client is taken on a solely automated basis. A human review is always interposed for decisions of suspension, exclusion, refusal of payment or level downgrade. The content rejection filters described above (third-party personal data, illegal or toxic content) operate in an automated manner on each submitted file, but do not entail a legal or significant effect within the meaning of Article 22 and remain subject to human intervention on request.
You have the right to obtain human intervention, express your point of view and contest any decision by contacting us at privacy@glintdata.io.
13. Amendments to the Policy
We reserve the right to amend this Policy at any time, in particular to reflect changes in legislation, our practices, our processors or the features of the Platform.
Any material change will be notified to you by email and/or by in-app notification at least 30 days before it takes effect. Continued use of the Services after this date constitutes acceptance of the revised version.
The date of the last update is indicated at the top of this document.
14. Contact
For any question relating to this Policy or to your personal data:
GLINT (SAS) 18 Chemin de la Futaie, 79200 Pompaire, France Email: privacy@glintdata.io (subject: GDPR)
Last updated: 3 July 2026.