Skip to main content

Privacy policy

Last updated: 19 August 2026

Preamble

We do everything we can to protect the privacy of Gladys Plus users.

The purpose of this privacy policy is to inform users about the data collected when they use the gladysassistant.com website and the Gladys Plus service.

The open-source Gladys Assistant software itself is installed and runs at the user's home: their smart home data (devices, scenes, history) stays on their own hardware and is never sent to us. Only the usage statistics described below reach our servers.

Data controller

The controller of the processing described below is Gladys Assistant SAS, 66 avenue des Champs-Élysées, 75008 Paris, France. Any question about it can be sent to hello@gladysassistant.com.

Data collected, purposes and legal bases

  • Gladys Plus account: email address and username, provided when signing up, to create and manage the account and provide the service. Legal basis: performance of the contract.
  • Payment and invoicing: payment data is processed directly by Stripe, acting as a controller for that operation; we never have access to the card number. We keep the invoicing data. Legal bases: performance of the contract and accounting legal obligation.
  • Backups: the backups of the user's Gladys instance are end-to-end encrypted before being sent; we cannot read their content. Legal basis: performance of the contract.
  • Security of the service: the IP address may be kept temporarily in memory to limit the number of calls to a resource (rate-limiting) and protect the service against denial of service attacks. Legal basis: legitimate interest in keeping the service secure.
  • AI features: when the user uses the AI assistant, their requests are sent to the Open-Weight models hosted at Scaleway, in France, to produce an answer. Legal basis: performance of the contract.
  • Voice assistants: if the user enables the Google Home or Alexa integration, voice commands go through Google's or Amazon's services, subject to their own privacy policies. Legal basis: performance of the contract, at the user's initiative.
  • Usage statistics of the open-source software: a Gladys Assistant instance periodically asks our servers whether a new version is available. On that occasion, we record the country, region and timezone derived from the IP address of the request, the operating system, the Node.js version, whether it runs in Docker, the number of connected devices and the list of integrations in use. The IP address itself is not kept, and this data is linked neither to a name nor to a Gladys Plus account. Legal basis: legitimate interest in knowing how the project is used and in feeding its public statistics.
  • Contact form: email address and content of the message, to answer the request. Legal basis: legitimate interest in answering the requests sent to us.
  • Newsletter: email address, to send news about the project. Legal basis: consent, which can be withdrawn at any time through the unsubscribe link.
  • Analytics: website visit statistics, collected through OpenPanel, an open-source solution that we host ourselves, without any cookie or identifier stored in the browser. Legal basis: legitimate interest in measuring the audience of the website.

Recipients of the data

The data is never sold, rented, or shared for advertising purposes. It is accessible to Gladys Assistant SAS and to the following technical providers, acting on our instructions:

  • Cloudflare, for the hosting of the website and the server functions (contact form, newsletter signup, payment)
  • Stripe, for payment processing
  • Scaleway, for hosting the AI models in France
  • DigitalOcean, in a data center located in Germany, for hosting the Gladys Plus infrastructure (API, backups, relays)
  • Amazon Web Services (Amazon SES), in the Ireland region, for sending the newsletter and service emails

Some of these providers are established outside the European Union, or may process data there. Such transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision.

Retention periods

  • Gladys Plus account data: for the whole duration of the commercial relationship, then deleted
  • Backups: backups older than six months are deleted and, beyond the current month, a single backup per month is kept; the user can delete them at any time from their account
  • Invoicing data: 10 years, in accordance with accounting obligations
  • IP address used for rate-limiting: a few minutes, in memory only, never written to disk
  • Messages sent through the contact form: as long as needed to handle the request
  • Email address signed up to the newsletter: until consent is withdrawn
  • Analytics: the data collected is anonymous — no IP address is kept, and the visit identifier can no longer be tied to anyone beyond 24 hours — so no retention period applies to it

Browser storage

The Gladys Plus service uses the LocalStorage of the user's browser to store:

  • The private key used to communicate with the user's Gladys Assistant instance.
  • A Gladys Plus access token which authenticates the user.

The gladysassistant.com website stores there the currency detected to display prices and, where applicable, the campaign parameters present in the landing URL (utm_source, utm_medium, utm_campaign...), passed along with the order to know where subscriptions come from.

Analytics, on the other hand, stores neither a cookie nor an identifier in the browser: OpenPanel computes a visit identifier server-side, by hashing the IP address and the browser with a salt renewed every day. The IP address is not kept, and the identifier can no longer be tied to an earlier visit beyond 24 hours. No advertising identifier is collected and no advertising cookie is set.

User rights

In accordance with the General Data Protection Regulation, users have a right to access, rectify, erase, restrict, object to and port their data, as well as the right to withdraw their consent at any time where the processing is based on it, and the right to give instructions about what happens to their data after their death.

These requests are made by email at hello@gladysassistant.com. We undertake to answer them within thirty (30) calendar days from their reception.

A user who considers, after contacting us, that their rights are not respected may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07: www.cnil.fr

Gladys Plus is operated from France, under French and European law. Should this English text and the French version differ, the French version prevails: Politique de confidentialité