Glystn Privacy Notice

Last Updated: September 16, 2026

Glystn, Inc. (“Glystn,” “we,” “us,” or “our”) operates a social intelligence platform that analyzes publicly available social video content to produce trend, audience, and creator insights for business customers. This Privacy Notice explains what personal information we handle, why, and what rights you have.

This notice covers our websites at glystn.com and app.glystn.com, our platform, our application programming interfaces and Model Context Protocol endpoints, and our business and marketing activities (together, the “Services”). We do not offer a mobile application. Capitalized terms not defined here have the meanings given in our Terms of Service.

1. The roles we play — read this first

Glystn handles personal information in three distinct capacities. Which one applies determines who controls the data and whom you should contact.

A. Public social content — Glystn is an independent controller. We collect and analyze publicly available content from social video platforms to build and maintain our own analytical corpus. We determine the purposes and means of that processing. We do it for our own business purposes, not on behalf of any customer, and it is governed by this notice. A customer asking a question about a creator does not make that customer the controller of our corpus.

If you are a creator whose public content is in our corpus, this notice applies to you directly, and Section 9 explains your rights, including how to object.

B. Customer account data and Customer Content — Glystn is a processor or service provider. When a business customer’s Authorized Users access the platform, we process their account and identity data (name, work email, user ID) on that customer’s behalf, for seat administration, security, and support, under our agreement with that customer. We also process the prompts, queries, files, and other material a customer submits to the platform (“Customer Content”) only as our Terms of Service permit. If you are an Authorized User of a Glystn customer, contact your organization first about that data.

C. Our own business, website, and marketing data — Glystn is the controller. For website visitors, marketing and event contacts, billing contacts, job applicants, individuals who purchase a subscription for themselves, and the usage data described in Section 5, Glystn is the controller and this notice applies directly.

Note on prior versions. Notices published before the date above described creator usernames and comments as data processed on behalf of “creator customers.” That described an earlier Glystn product, which accessed a creator’s own channel data under that creator’s delegated authorization. It no longer describes how Glystn operates, and this notice replaces it.

2. What we do not collect

We think this is as important as what we do collect. Glystn does not collect, build, license, or sell:

consumer-level identifiers of any kind — no mobile advertising IDs, device IDs, cookie IDs, hashed emails, email addresses, phone numbers, or postal addresses of social media audiences;
panel IDs or any join key into a consumer identity graph;
individual profiles of the people who view or comment on social content;
special-category or sensitive personal information as a deliberate collection target;
payment card numbers (you provide those directly to our payment processor; Glystn never receives them).

We are not an identity-data business and we do not participate in identity resolution.

Platforms. TikTok, Instagram, and YouTube.

How we obtain it. We obtain publicly viewable content through licensed third-party data suppliers and, where available, through official platform interfaces. Glystn does not itself access content that requires logging in or that a creator has made private, does not create or operate user accounts to collect content, and does not use automated or pseudonymous accounts. We obtain from suppliers only content that was publicly viewable at the time of collection. We do not retain raw media files. What we keep is derived: text, transcripts, metadata, and the analytical signal we compute from them. When our refresh process detects that a post has been deleted or made private at its source, we remove it from the corpus.

What the corpus contains, by layer.

Layer	What we hold	Is it personal information?
Creator layer	Public handle; public profile information as the platform displays it (which may include a display name, biography text, and any location the creator has chosen to make public); links to public profiles and posts; publicly displayed engagement counts; the text and transcripts of public posts; and analytical attributes we derive from that public content, such as content categories. Where the same creator operates public accounts on more than one platform, we may link those accounts.	Yes. This is publicly posted, but it identifies an account holder, and we treat it as personal information. Publicly available information is generally excluded from the definition of “personal information” under California and other U.S. state privacy laws; we nonetheless honor the requests described in Section 9 for creator-layer data.
Audience layer	Aggregate measures only — volumes, distributions, sentiment and theme patterns.	No. Commenter and viewer identity is not carried into our corpus or our outputs. We have no individual-profile data model for audiences.
Semantic layer	Our own computed classifications, embeddings, trend and cluster measures.	Derived. Not personal information on its own.

Legal basis (EEA, UK, and Switzerland). We rely on our legitimate interests in operating an analytics service over publicly available content, balanced against the interests and rights of the individuals concerned. We limit that processing to publicly posted content, exclude audience-level identity entirely, do not combine creator data with non-public or offline data sources, and honor objections as described in Section 9.

Where we obtained it (GDPR Article 14). Public posts on the platforms named above, obtained through licensed third-party suppliers of publicly viewable content and, where available, official platform interfaces.

4. Information you give us directly

Account information — name, business email, organization, and role, when an account is created for you.
Platform inputs — the prompts, queries, briefs, files, and saved work you submit to the platform. These are Customer Content, and we process them only as described in Section 8 of our Terms of Service.
Your communications — what you send us by email, support request, or contact form.
Marketing and events — contact details you give us at conferences, in demo requests, or when you subscribe to updates.
Billing — billing contact and address. Card details go directly to our payment processor; we receive confirmation and billing metadata, never the card number.
Job applications — your application materials, if you apply to a posting.

5. Information collected automatically

When you use our websites or platform we collect IP address, browser and device type, pages viewed, features used, query volumes, timestamps, and referring pages (“Usage Data”). We use cookies and similar technologies for authentication, security, preferences, and product analytics.

We do not use advertising cookies, we do not permit third-party advertising partners to set tracking technologies on our sites, and we do not run session-replay tools. If that changes, we will update this notice before doing so and provide any opt-out that applicable law requires.

Global Privacy Control. We honor the Global Privacy Control (GPC) and comparable browser opt-out signals where applicable law requires it.

6. How we use personal information

To operate, secure, and improve the Services;
To build and maintain our analytical corpus and produce trend, audience, and creator insights from public social content;
To administer accounts, provide support, and communicate about the Services;
To bill and collect payment;
To detect and prevent fraud, abuse, and security incidents;
To create aggregated and de-identified information, which we may use for any lawful business purpose. Where we de-identify, we maintain it in de-identified form, publicly commit not to re-identify it, and contractually require recipients to do the same;
To market our products to business audiences, using contact information we hold as controller under Section 1.C;
To comply with law and enforce our agreements.

Customer Content is used as described in Section 8 of our Terms of Service, including to create aggregated or de-identified information.

7. AI and model providers

Glystn uses third-party foundation-model providers to deliver parts of the Services. Customer Content and content from our corpus may be transmitted to those providers to generate a response.

We compute analytical classifications, embeddings, and indices from public content, as described in Section 3.
Our model providers process what we send them under contract and only to provide their services to us.
Our model providers may change as the technology does. A current list of our model providers and other subprocessors is available on request at privacy@glystn.com.

Service providers — hosting, storage, security, analytics, support, billing, and the model providers described above, each under contract and limited to what they need.
Data suppliers — we receive public content from them. We send them only the identifiers needed to retrieve public content, such as a public handle or post link.
Our business customers — insights, reports, and platform outputs we produce, which may include creator-level public information and citations to public posts.
Corporate transactions — in a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations.
Legal — where required by law or legal process, or to protect rights, safety, or property.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law or comparable state laws.

9. Your rights

If you are a creator whose public content is in our corpus

You may ask us to:

confirm whether your public content is in our corpus and what we hold;
correct inaccurate information;
delete your creator record;
object to or restrict our processing.

Contact: privacy@glystn.com, subject line “Creator Request.” Include the platform and handle. We will verify only enough to be confident you control the account. We respond within the period applicable law requires, and in any case without undue delay.

Where we honor an objection or deletion, we suppress that creator from our corpus and from future outputs, and maintain a suppression record so the content is not re-ingested on a later refresh.

If you are an Authorized User of a Glystn customer

Your account data is handled on your organization’s behalf. Contact your organization; we will support their instructions. You may also contact us directly and we will route your request.

US state privacy rights

Depending on where you live, you may have the right to know, access, correct, delete, or obtain a portable copy of your personal information; to opt out of sale, sharing, targeted advertising, and certain profiling; and to limit use of sensitive personal information. We do not sell or share personal information or use it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We will not discriminate against you for exercising any right.

Appeals. If we decline a request, you may appeal by replying to our decision or writing to privacy@glystn.com with “Appeal” in the subject. We will respond in writing within the period your state’s law requires. If we deny the appeal, you may contact your state Attorney General.

Authorized agents may submit requests with proof of authority.

California. In the preceding 12 months we have collected the following categories of personal information: identifiers (creator handles and links; business contact and account data); internet or other network activity (product usage); commercial information (billing records); professional information (role and organization of business contacts); and the text and transcripts of publicly posted content. Sources, purposes, and the categories of third parties to whom we disclose each category are described in Sections 3 through 8. We retain each category as described in Section 11. We do not sell or share personal information and have not done so in the preceding 12 months. We do not knowingly collect or sell the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes other than those permitted by California regulations.

EEA, UK, and Switzerland

You have the rights of access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent where consent is the basis. Withdrawal does not affect prior processing.

Legal bases: performance of a contract (account and platform provision); legitimate interests (corpus building and analysis as described in Section 3, security, direct marketing to business contacts, product development); consent where required; and compliance with legal obligations.

We do not make decisions producing legal or similarly significant effects about individuals by automated means.

You may lodge a complaint with your supervisory authority: the EEA data protection authorities, the Swiss FDPIC, or the UK ICO.

10. International transfers

We are based in the United States and process personal information there. Where we transfer personal information from the EEA, UK, or Switzerland to a country without an adequacy finding, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures as appropriate. Contact us for details.

11. Retention

Category	Retention
Creator corpus records	Retained while the creator remains in scope for our analysis and refreshed on a rolling basis. A creator record that has not been refreshed for 12 months is deleted. Content detected as deleted or made private at its source is removed on refresh. Suppression records from objections are kept indefinitely so the suppression holds.
Aggregate and de-identified analytics	Retained indefinitely; not personal information.
Customer account data	For the term of your subscription or Customer Agreement, then deleted within 90 days, or returned to the customer on request before deletion.
Customer Content (prompts, queries, files, saved work)	For the term of your subscription or Customer Agreement. Available for export for 30 days after termination on request, then deleted.
Usage Data	Retained in identifiable form for up to 24 months; aggregated metrics retained in de-identified form.
Backups	Deleted data may persist in encrypted backups for up to 30 days before being overwritten.
Marketing contacts	Until you unsubscribe or ask us to delete your information, plus 30 days to process the request.
Billing records	As required by tax and accounting law.
Job applications	24 months from receipt, unless you ask us to delete them sooner.

12. Security

We maintain administrative, technical, and physical safeguards appropriate to the risk, including encryption in transit and at rest, role-based access controls and least-privilege provisioning, logging and monitoring, and security review of vendors. No system is perfectly secure. If we learn of a security incident affecting your personal information, we will notify you and any relevant authority as applicable law requires.

13. Children

The Services are for business use and are not directed to children. We do not knowingly collect personal information from children under 13, or under 16 where local law sets that threshold. Our corpus is built from public posts on platforms that themselves require users to meet minimum age requirements; we do not target collection at content by or about children. If you believe we hold a child’s personal information, contact privacy@glystn.com and we will delete it.

14. Platform-specific disclosures

Where the Services use a platform’s official interfaces, our use of information obtained through them is subject to that platform’s developer terms. In particular, to the extent the Services use YouTube API Services, Glystn’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and users of those features are also subject to the YouTube Terms of Service and the Google Privacy Policy.

15. Third-party sites

Our Services may link to sites we do not control, including the public posts our outputs cite. We are not responsible for their practices. Please read their notices.

16. Changes

We may update this notice. We will post the updated version with a new “Last Updated” date, and for material changes we will provide additional notice, such as by email to account holders or a notice within the Services.

17. Contact

Glystn, Inc. 2211 Bryant Street, San Francisco, CA 94110 privacy@glystn.com

Glystn, Inc. is the controller of the personal information described in Sections 1.A and 1.C.