Privacy Policy

Who is responsible

GlianaAI is operated by PT Glianalabs Algoritma Desentralisasi, an Indonesian company. For personal data we decide the purpose of, we are the Pengendali Data Pribadi (data controller) under Indonesia's UU No. 27 Tahun 2022 on Personal Data Protection (UU PDP). Reach us at [email protected].

Two different surfaces

What we hold depends entirely on how you use GlianaAI, so it's worth separating:

• The API (api.glianalabs.com) has no signup. You pay per call from your own wallet or card through an HTTP 402 payment handshake. We do not know who you are, and there is no account to create, no username and no password.
• The dashboard (dashboard.glianalabs.com) is optional. It exists for one reason: paying in Indonesian rupiah from a prepaid balance, which needs somewhere to keep that balance and a way to prove it's yours. Signing in there is the only part of GlianaAI that identifies you.

If you never open the dashboard, everything in the "Dashboard account" section below simply does not apply to you.

Using the API (no account)

• Your inputs — prompts and any files you send — are forwarded to the model provider that fulfils your call, because that is the service you asked for. We do not use them to train models and we do not sell them.
• Files you upload, and the media a model generates, are stored in our object storage at an unguessable URL so you can fetch the result. See How long we keep things below.
• Usage records — model id, timing, units, amount charged, and a payer reference from the payment receipt. These support billing reconciliation, tax records and abuse prevention. Prompt contents are not stored in them.
• Payment settles from your own wallet or card; we are non-custodial and never hold your funds. On-chain payments are inherently public on the blockchain you chose — that is a property of the network, not something we publish.
• Abuse protection — request metadata such as IP address is processed at our network edge to rate-limit and block automated abuse. Turnstile may run on the agent for the same purpose.

Legal basis: performing the service you requested, and our legitimate interest in keeping it running and unabused.

Dashboard account (optional)

If you sign in to hold a rupiah balance, we store:

• Your email address and Google's subject id — the stable identifier Google issues for your account. We ask Google for nothing else: no contacts, no profile, no Drive. We never receive your Google password.
• Your balance and when the account was created and last used.
• API keys — only a cryptographic hash of each key, plus a short display stub and your own label. The key itself is shown once and is not recoverable by us, which is also why we cannot read it back to you if you lose it.
• Top-up records — amount in rupiah, the credit and exchange rate quoted, status, timestamps, and the payment reference from our payment processor.
• A session cookie for .glianalabs.com, signed, HttpOnly, Secure. It keeps you signed in and does nothing else. It is not used for advertising or cross-site tracking.

Legal basis: performing our contract with you (holding and spending a balance you paid for), and legal obligation for the payment and tax records.

Sensitive and biometric data

Some endpoints can process biometric data — the face comparison and face embedding tools, for example. UU PDP treats biometric data as data pribadi yang bersifat spesifik, and it deserves saying plainly:

• Those tools are stateless. They read the image you point them at, return the measurement, and keep no copy and no face database.
• If you uploaded the image to our storage first in order to get a URL, that uploaded file is subject to the retention below like any other upload. You can also pass an image inline instead of uploading it.
• Only send other people's biometric or identity data if you have a lawful basis to do so — normally their explicit consent. When you send us someone else's personal data, you are the controller for it and we process it on your behalf.

How long we keep things

• Files you upload, and the media a model generates — both expire automatically 7 days after they are stored. Treat results as temporary and download anything you want to keep. Email us to have a specific file removed sooner.
• Usage and payment records — kept while needed for reconciliation and for as long as Indonesian tax and accounting law requires us to keep records of money received.
• Account data — until you delete the account.

Deleting your account

The dashboard has a delete option, and it is a real deletion, not a flag. Your account row and every API key are erased, and your identifier is stripped from usage records.

Two honest limits. Payment records survive with the link to you removed — they are records of real money and both a payment processor and a tax authority expect them to exist. And we refuse to delete an account that still holds a balance, because balance cannot be withdrawn, so deleting a funded account would mean us keeping the difference. Spend it down first, or email us.

Who else sees data

We use processors rather than sharing data for their own purposes, and we do not sell personal data:

• Cloudflare — hosting, edge network, storage, database.
• AI model providers — receive the input for the specific call you made, in order to produce your result.
• Google — only if you choose to sign in to the dashboard, and only to verify that sign-in.
• Xendit — our Indonesian payment processor for rupiah top-ups. It receives your email in order to issue the payment. Card details go to the processor and never reach us.
• Payment networks — public blockchains, for wallet payments.

Transfers outside Indonesia

GlianaAI runs on a global edge network and most AI model providers are outside Indonesia, so serving your request generally involves processing data abroad. Where UU PDP applies we rely on the safeguards in our agreements with those providers, and on your request to us to make the call in the first place. If you would rather a particular input never left Indonesia, do not send it.

Your rights under UU PDP

If you are in Indonesia, UU No. 27 Tahun 2022 gives you the right to be informed about processing, to access your data and get a copy, to correct it, to erase it, to withdraw consent, to object to decisions made solely by automated means, to restrict processing, and to seek compensation for misuse.

For dashboard accounts, access and deletion are built in. For anything else, email [email protected] and we will respond within the period the law allows. Because API calls carry no identity, we often genuinely cannot connect a request to a person — if that happens we will tell you so rather than guess.

Security and incidents

Traffic is encrypted in transit, API keys are stored only as hashes, and the session cookie is signed and HttpOnly. If a personal data breach happens, UU PDP requires us to notify affected people and the supervisory authority in writing within 3×24 hours, and we will.

Children

GlianaAI is a developer tool and is not directed at children. We do not knowingly collect children's data; tell us if you believe we have and we will delete it.

Mobile app (Gliana Agent)

The Gliana Agent app on the Solana dApp Store needs no account and no signup.

• On-device data — your conversations are stored locally on your device. The agent also keeps a server-side copy keyed to a conversation id; deleting a conversation removes it.
• Wallet — payments use the Solana Mobile Wallet Adapter. The app never sees, stores or transmits your seed phrase or private keys; your wallet signs each payment and we only receive the public transaction. Your wallet address is public on-chain.
• Permissions — photo and media access is requested only when you attach a file to a generation or save a result. Nothing is uploaded without your action.
• No tracking — no advertising or cross-app tracking SDKs.

Analytics

We may use privacy-friendly, cookieless analytics to understand aggregate traffic. No cross-site tracking, and no profile of you.

Changes

If we change what we collect, we change this page and the date at the top. Material changes to how we use data you already gave us will be announced, not slipped in.

Contact

PT Glianalabs Algoritma Desentralisasi · [email protected]