Privacy policies
Last updated: October 8, 2026
Gladys is an online (SaaS) project and portfolio management software, built and hosted in France. This policy explains which personal data we process, why, for how long, and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and French data protection law.
1. Who is responsible for your data?
Gladys SAS, 6 rue René Viviani, 44200 Nantes, France (see the legal notice), acts as:
- data controller for data relating to website visitors and prospects, and for account, billing and support management;
- data processor, within the meaning of Article 28 GDPR, for the data our customers store in Gladys (projects, tasks, documents, comments, time entries…). The controller of that data is the customer organisation, which decides how it is used; we process it only on its instructions, under the contract between us.
For any question: info@hellogladys.com.
2. Which data do we process, why, and on what basis?
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, password (never stored in plain text), language, organisation, role | Create and manage your account, give you access to the service | Performance of the contract |
| Identifier and email address provided by Google or LinkedIn, if you sign in with them | Simplified sign-in | Performance of the contract |
| Content entered in the service | Provide the service to your organisation | Customer's instructions (Gladys as processor) |
| Billing details, subscription and invoice history | Billing, accounting, tax obligations | Performance of the contract, legal obligation |
| Email address, message and, where applicable, first and last name (contact form, demo request, support) | Answer your request, provide support | Legitimate interest, pre-contractual steps |
| Technical logs: IP address, date and time, browser, security events | Service security, fraud prevention, incident diagnosis | Legitimate interest, legal obligation |
| Notification preferences, service emails | Inform you of activity in your projects and of important service changes | Performance of the contract |
| Email address for the newsletter | Send you our news | Consent, which you can withdraw at any time via the unsubscribe link |
We do not sell your data and do not use it to train artificial intelligence models.
3. Connected AI assistant
Gladys lets you connect an artificial intelligence assistant (Claude, ChatGPT, Le Chat, Gemini…) through its connector. This connection is made at your initiative: the assistant only accesses data you can view yourself, within the authorisations you give it, and every action is logged. Data sent to the assistant is processed by its provider, under its own privacy policy. You can disconnect the assistant at any time from your profile.
4. How long do we keep your data?
- Account and content: for as long as you use the service; after termination, data is deleted within a reasonable period, once the organisation has been able to export it;
- Accounting records and invoices: 10 years, as required by the French Commercial Code;
- Contact requests and prospects: 3 years from the last exchange;
- Technical logs: 12 months at most;
- Cookies subject to consent: 13 months at most.
5. Who can access your data?
Your data can only be accessed by authorised Gladys staff, within the limits of their duties, and by our technical processors, who are contractually bound to confidentiality and security:
- our hosting provider, in France: OVH;
- our payment provider, for card payments (Gladys does not store card numbers);
- our transactional email provider (notifications, password resets).
Within your organisation, a project's data is visible to its members, according to the roles and permissions set by your administrators. Where a provider is located outside the European Union, the transfer is covered by appropriate safeguards, in particular the European Commission's standard contractual clauses. We may also disclose data to authorities where required by law.
6. Hosting and security
The service and its data are hosted in France. Traffic is encrypted (HTTPS), passwords are never stored in plain text, access is partitioned by organisation and by project, and data is backed up regularly. A record of processing activities is kept up to date.
7. Cookies and audience measurement
- Website (gladys.com): no audience measurement cookies or advertising trackers. Article and guide page views are counted without cookies and without storing IP addresses.
- Application and sign-in pages: strictly necessary cookies (session, security, language preferences) are used to let you sign in; they do not require your consent. Audience measurement cookies are only set with your agreement, collected through the "Cookie settings" banner, which you can change at any time.
You can also configure your browser to block or delete cookies.
8. Your rights
You have the right to access, rectify, erase, restrict and port your data, the right to object, the right to withdraw your consent at any time, and the right to set guidelines for what happens to your data after your death. You can delete your account from your profile, or write to us at info@hellogladys.com; we reply within one month. For data stored in your organisation's workspace, please contact its administrator first.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
9. Changes
This policy may change. In the event of a significant change, we will inform you by email or in the application before it takes effect.