Privacy Policy

Last updated: 19 October 2026

This privacy policy explains how Glovelly handles personal information when you use:

  • the public landing site at https://glovelly.net
  • the production service at https://menu.glovelly.net
  • the public user guide at https://docs.glovelly.net and technical/operator handbook at https://handbook.glovelly.net

Glovelly is a small business administration tool, currently focused on self-employed music work. It is used to manage clients, gigs, expenses, receipts, invoices, seller profile details, invoice delivery, Google Drive invoice publishing, Google Calendar gig sync, access administration, and related operational records.

Glovelly is intended for business administration. It is not intended for children or consumer social use.

Who Is Responsible For Your Information

The data controller is:

Glovelly
c/o Glovelly Privacy Team
privacy@glovelly.net

Please use the privacy contact email above for any questions about this policy or about how Glovelly handles personal information.

Information Glovelly Collects

Glovelly may collect and store the following categories of information.

Account and Access Information

  • Name, email address, and Google account subject identifier used for sign-in.
  • User role, approval status, account status, and access administration records.
  • Access request details, including request timestamps and administrator handling notes where applicable.
  • Authentication session information needed to keep users signed in securely.

Business Records

  • Client names, contact details, billing details, notes, and related business metadata.
  • Gig details such as dates, venues, fees, mileage, passenger counts, and status.
  • Expense details such as descriptions, categories, amounts, tax treatment, reimbursement status, and receipt attachments.
  • Receipt files or images uploaded by users. These may contain personal information visible on the receipt, such as names, partial payment card details, locations, timestamps, or purchase details.
  • When you request receipt analysis or submit a file or pasted text through Add to Glovelly, supported receipt content and minimal extraction context are sent to Google Cloud Vertex AI where analysis is enabled. Analysis of an existing receipt presents reviewable suggestions. Unified upload can automatically save a receipt to the nearest nearby gig according to your Automatic receipt application preference, including independently high-confidence merchant/category and a high-confidence total only when GBP currency is also confidently detected. Foreign or unknown-currency totals remain evidence for explicit GBP entry. You can choose Manual only and can review, correct, reassign, or delete saved receipts.
  • Add to Glovelly retains one private unapplied file, URL, or text source and its analysis outcome per user for recovery. Successful application retains the original source as the ordinary receipt/resource relationship and removes the private intake and transient file. Receipt analysis is promoted to the existing attachment-linked analysis records so field confidence, warnings and provenance remain reviewable. A source fingerprint is stored to detect conflicting upload retries without storing another copy of the content. Submitted URLs are analysed from metadata/type only; unified upload does not fetch linked Google Docs or Sheets contents.
  • When you request set-list interpretation from a linked Google Sheet, the selected bounded worksheet grid, including displayed cell values and positions, is sent to Google Cloud Vertex AI. Glovelly validates the result and presents an editable draft; it does not alter the linked sheet or automatically select forScore charts.
  • Invoice details such as invoice numbers, line items, payment status, issue/reissue history, delivery details, PDF files, and Google Drive publication references.
  • Seller profile details used to generate invoices, such as trading name, address, payment details, invoice defaults, and tax or business identifiers where provided.

Communications and Delivery Data

  • Email addresses used for access workflows and invoice delivery.
  • Email delivery metadata returned by the email provider, such as message identifiers and delivery status where available.
  • Records showing when invoices or access-related emails were generated, sent, retried, delivered, failed, or otherwise processed.

Google Drive Integration Data

If you connect Google Drive, Glovelly requests permission to create and manage files that it creates in your Google Drive. Glovelly uses this permission to publish generated invoice files to Drive when you request it.

When Google Drive integration is enabled, Glovelly may store:

  • Google OAuth connection information, including protected access and refresh tokens.
  • Token expiry and reconnection status.
  • Google Drive file identifiers and file links for uploaded invoice files.
  • Configured Google Drive folder identifiers or related publishing settings.
  • Metadata showing when an invoice was published to Drive and by which user.

Google Drive access can be revoked through your Google Account permissions. If access is revoked, expires, or otherwise stops working, Google Drive publishing will stop until the connection is restored.

Google Calendar Integration Data

If you connect Google Calendar, Glovelly requests permission to create and manage calendars and events that it creates. Glovelly uses this permission to create and maintain a dedicated Glovelly Gigs calendar for confirmed and completed gigs.

When Google Calendar integration is enabled, Glovelly may store:

  • Google OAuth connection information, including protected access and refresh tokens.
  • Token expiry and reconnection status.
  • Google Calendar identifiers for the dedicated Glovelly calendar.
  • Google Calendar event identifiers linked to Glovelly gigs.
  • Calendar sync status, retry, queue, and diagnostic metadata.

Google Calendar access can be revoked through your Google Account permissions. If access is revoked, expires, or otherwise stops working, Calendar sync will stop until the connection is restored.

Optional Location Map Previews

Where Maps Static previews are configured, Glovelly automatically displays a map search preview of a selected client's saved billing address or a gig's saved venue when the pane has enough visible space. There is no per-record approval setting or public/private address classification. Unsaved editor text is not used for previews. Images are unverified location searches, not confirmation of an exact venue match.

Glovelly generates a signed image URL containing only the location query and necessary rendering/authentication parameters; it does not append separate client names, contact details or internal record identifiers. Location text itself can still contain personal information. Your browser loads the image directly from Google, which receives the query and browser network/request information, such as your IP address and the application's origin. Requests may interact with Google's browser state according to browser settings and Google's practices; they are not described as anonymous or cookie-free. See the Google Privacy Policy.

Changing the selected saved location or hiding the preview removes obsolete imagery from Glovelly's display. It cannot recall requests already sent to Google or delete data Google has already received. Deployment-level disabling of map imagery does not change your saved business addresses or venues.

Glovelly does not durably store, rehost, shared-cache or save map images, signed URLs or derived geocoding data for offline use. It holds the active signed URL in component memory; Google's image delivery and browser caching follow Google's response headers and browser behavior. This feature adds no Glovelly analytics loader. Invoice thumbnails are rendered locally from existing PDFs, not sent to a third-party renderer.

The separate Open in Google Maps link is available without enabling imagery. Merely showing the link does not contact Google; choosing it opens Google's site with the location query and is subject to Google's own terms and privacy practices.

Technical and Security Data

Glovelly and its service providers may process technical and diagnostic information needed to operate, secure, debug, and maintain the service. This may include:

  • browser, device, network, request, and diagnostic information
  • IP address or approximate network metadata
  • timestamps
  • authentication, authorisation, and audit-style events
  • application logs and error information

Glovelly aims to avoid logging sensitive business content unnecessarily, but diagnostic records may sometimes contain limited personal information needed to investigate issues or maintain security.

Public-Site Analytics Data

If you accept analytics cookies, Glovelly uses Google Analytics on glovelly.net, docs.glovelly.net, and handbook.glovelly.net to understand aggregate public-site visits and page use. Google Analytics may process technical information such as cookie identifiers, device and browser information, IP-derived location, referral information, and pages viewed.

Glovelly does not use Google Analytics in the authenticated Menu application and does not send account information, business records, form values, or other user-entered content to Google Analytics. Google Signals and advertising personalisation are disabled. Google Analytics event data is retained for 14 months.

The public documentation sites are static. GitHub or Firebase Hosting may process limited technical information, such as IP address and request metadata, when serving them. Glovelly does not intentionally collect account-level personal information from public-site visitors unless a visitor contacts the controller separately.

How Glovelly Uses Personal Information

Glovelly uses personal information to:

  • provide authenticated access to the service
  • manage users, roles, permissions, and access requests
  • manage clients, gigs, expenses, receipts, invoices, and seller profile settings
  • generate, issue, reissue, publish, and deliver invoices
  • publish invoice files to Google Drive where that integration is configured
  • sync confirmed and completed gigs to Google Calendar where that integration is configured
  • send transactional emails, such as access request and invoice delivery messages
  • maintain invoice, accounting, tax, and business administration records
  • secure the service and detect misuse
  • maintain, debug, test, and improve the service
  • provide source-submission and user-requested receipt analysis, reviewable suggestions, and receipt application according to user preferences
  • comply with legal, accounting, tax, and record-keeping obligations
  • respond to requests, questions, and rights exercises

Glovelly does not sell personal information.

Lawful Bases For Processing

Depending on the context, Glovelly relies on the following lawful bases under UK GDPR.

Purpose Likely lawful basis
Providing access to Glovelly and operating core account features Contract or legitimate interests
Managing clients, gigs, expenses, receipts, invoices, and business records Contract, legitimate interests, or legal obligation
Creating and retaining invoices and accounting records Legal obligation and legitimate interests
Sending transactional emails and invoice delivery messages Contract or legitimate interests
Publishing invoices to Google Drive at the user's request Contract or legitimate interests
Syncing gigs to Google Calendar at the user's request Contract or legitimate interests
Administering access requests and user permissions Legitimate interests
Security, abuse prevention, diagnostics, and service maintenance Legitimate interests
Public-site analytics Consent
Responding to legal requests or regulatory obligations Legal obligation

Where Glovelly relies on legitimate interests, those interests are the operation, administration, security, and improvement of a small business administration service, balanced against the rights and expectations of the people whose information is processed.

Where a user connects an external service such as Google Drive or Google Calendar, Glovelly processes the related connection information in order to provide the requested integration.

Special Category Data

Glovelly is not designed to collect special category data, such as information about health, religion, ethnicity, political opinions, trade union membership, genetic or biometric data, or sexual orientation.

Users should avoid entering special category data into free-text fields, notes, receipt attachments, invoice descriptions, or client records unless there is a clear business need and an appropriate lawful basis has been confirmed.

Who Personal Information Is Shared With

Glovelly may share or make personal information available to service providers that help run the service, including:

  • hosting and infrastructure providers
  • database, storage, backup, logging, and monitoring providers
  • authentication providers, including Google sign-in
  • Google Drive, where Drive publishing is configured
  • Google Calendar, where Calendar sync is configured
  • email delivery providers
  • GitHub, for source control, GitHub Actions, and GitHub Pages documentation hosting
  • professional advisers, accountants, tax authorities, regulators, or legal bodies where required

Service providers are expected to process personal information only as needed to provide their services, support Glovelly's operation, or meet their own legal obligations.

Current expected subprocessors include:

  • Google Cloud Platform, for hosting, infrastructure, managed secrets, and related cloud services
  • Google Cloud Vertex AI, for receipt/intake analysis initiated by source submission or explicit analysis requests, and requested set-list interpretation
  • Google, for sign-in, Google Drive integration, Google Calendar integration, and automatic location map previews where configured
  • Google Analytics, where a visitor accepts public-site analytics cookies
  • Neon, for database hosting
  • Resend or another configured email delivery provider, for transactional email
  • GitHub, for source control, GitHub Actions, and documentation hosting

This list may change as Glovelly evolves.

International Transfers

Some service providers may process personal information outside the United Kingdom.

Where this happens, Glovelly relies on appropriate safeguards, which may include UK adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or equivalent provider commitments.

How Long Information Is Kept

Glovelly keeps personal information only for as long as needed for the purposes described in this policy.

Typical retention expectations are:

  • account and access records: for the life of the account, then for a reasonable audit and security period after closure
  • Google OAuth tokens and connection data for Drive or Calendar: until the integration is disconnected, expires, is revoked, or the account is deleted, unless limited records are needed for audit or security purposes
  • Google Calendar sync state and queue metadata: for as long as needed to operate, retry, diagnose, or rebuild the Calendar integration, unless earlier cleanup is appropriate
  • client, gig, expense, receipt, and invoice records: for as long as needed for business, tax, accounting, and dispute purposes
  • invoice, expense, receipt, and accounting records: normally at least 6 years after the relevant tax year or accounting period, where required for UK tax or accounting records
  • access request records: normally up to 12 months after handling, unless needed for security, audit, or dispute purposes
  • email delivery records: for as long as needed to confirm delivery, investigate delivery issues, or maintain business records
  • logs and diagnostic records: normally for a limited operational period, such as up to 90 days, unless needed for security investigation, debugging, legal, accounting, or dispute purposes
  • receipt-analysis attempt metadata and validated suggestions: for as long as the associated receipt is retained for business, tax, accounting, or dispute purposes; provider responses and receipt content are not included in application logs
  • private unapplied intake source and analysis attempts: until replaced, explicitly discarded, or successfully applied; an unfinished intake has no automatic expiry. Receipt application promotes validated attempts to attachment analysis records, then removes the private intake attempts
  • documentation site technical records: according to the retention practices of GitHub or other hosting providers used to serve the site
  • Google Analytics event data: 14 months
  • map-preview signed URLs: active display memory only, not durable Glovelly storage; Google/browser handling is subject to provider headers and browser behavior

Some information may be retained for longer where required by law, tax rules, accounting obligations, security needs, dispute resolution, or backup retention.

Security

Glovelly uses technical and organisational measures intended to protect personal information, including authenticated access, role-based controls, secure cookies, owner visibility checks for user-owned data, managed secrets, provider-backed storage, and encryption or token protection where configured.

Google OAuth tokens used for Drive and Calendar integrations are protected before storage where token persistence is enabled.

No online service can guarantee absolute security. Users should keep their Google account secure, use appropriate access controls, and only upload business records that are appropriate for Glovelly to process.

Your Rights

Depending on the circumstances, individuals may have rights to:

  • be informed about how their personal information is used
  • access their personal information
  • correct inaccurate or incomplete information
  • request deletion of information
  • request restriction of processing
  • object to processing based on legitimate interests
  • receive certain information in a portable format
  • withdraw consent, where consent is the lawful basis

Some rights may be limited where Glovelly needs to keep information for legal, accounting, tax, security, audit, or dispute-resolution reasons.

To exercise rights, contact:

privacy@glovelly.net

Complaints

Please contact the controller first if you have questions or concerns about how Glovelly handles personal information.

You can also complain to the UK Information Commissioner's Office:

Information Commissioner's Office
https://ico.org.uk/make-a-complaint/

Cookies And Local Storage

Glovelly uses cookies or similar browser storage where needed for authentication, session management, security, and user preferences.

The authenticated application also stores a single unfinished-upload identifier in tab-scoped session storage to recover an interrupted attachment save. It does not store receipt content or extracted facts there and clears this recovery identifier when the saved journey is finished or the authenticated session ends.

Glovelly does not currently use advertising cookies.

On the public landing site, user guide, and handbook, Glovelly asks before setting analytics cookies or loading Google Analytics. Your choice is stored in a secure, same-site glovelly_analytics_consent cookie for up to 12 months and applies across those public subdomains. You can accept, reject, or withdraw analytics consent at any time using the Cookie settings control on those sites. Withdrawing consent stops future analytics loading and removes accessible Google Analytics cookies.

Google Analytics uses its own analytics cookies, including _ga and a measurement-specific _ga_* cookie, after you accept. More information about Google's processing is available in the Google Privacy Policy.

Changes To This Policy

This policy may be updated as Glovelly changes. The latest version will be published through Glovelly or its online documentation site.

Material changes may be highlighted in the service or documentation where appropriate.