Privacy Policy

Applies to all applications published under the glbxai.com domain. Operator: matthew.bunce@globant.com. Last updated 2026-05-05.

Scope

This policy covers the personal data processed by every application served under the glbxai.com domain (the "applications"). The current list of applications is published at https://legal.glbxai.com/. The applications are internal or restricted-access tools served behind Google Cloud Identity-Aware Proxy (IAP); they are not consumer services.

Who we are

The applications are operated by the holder of the glbxai.com domain on behalf of the relevant business owner of each application. The same operator and the same data-handling practices described in this policy apply to every application. Where an individual application processes specific categories of data not covered by this umbrella policy, that application surfaces an additional notice at the point of use.

Data we process

• Authenticated identity. When you sign in via Google IAP we receive your authenticated email address and Google account identifier. We use these only to authorise your access to the applications; we do not enrich them with third-party data.
• Access logs. Cloud Logging records each request: timestamp, your IAP-authenticated email, source IP, requested path, and HTTP response code. Access logs are stored in a Cloud Logging bucket in Google Cloud region me-central2 (Dammam, Saudi Arabia) and are retained for 400 days, after which they are deleted automatically.
• Application content you submit. Where an application allows you to upload, submit, or otherwise provide content (forms, configuration files, documents), that content is stored in Google Cloud Storage in me-central2 under retention rules specific to the application. Per-application retention is documented at https://legal.glbxai.com/. Unless an application explicitly states otherwise, you should not submit personal data, payment-card data, government-issued identifiers, health data, or other regulated personal information.
• Machine-learning analysis (where applicable). Some applications use Google Vertex AI (currently the Gemini 2.5 Pro and Gemini 2.5 Flash models) to analyse content you submit. Where ML processing is used, the request may be routed via Google's global Vertex AI endpoint, which does not guarantee a single processing region. Google does not retain prompt or response content beyond the request lifecycle for the on-demand Gemini 2.5 traffic these applications use; abuse-monitoring logs and any cached data Google retains for service operation are stored in the same at-rest region as the underlying Google Cloud project (me-central2).

What we do not collect

• No analytics, tracking pixels, or third-party advertising scripts.
• No cookies other than the IAP session cookie issued by Google.
• No payment data, no biometrics, no national identifiers, no health data — unless an individual application's specific notice states otherwise.

Sharing

We do not sell or rent personal data. We share data with two categories of recipients:

• Google Cloud, as the underlying cloud provider running the applications. Google's processing is governed by the Google Cloud Platform Terms of Service and the Cloud Data Processing Addendum, which we have accepted.
• The business owner of the application you are using, and that owner's authorised personnel. Each application's business owner is identified at https://legal.glbxai.com/.

We do not transfer personal data outside this scope without a separate written agreement.

Data residency

The data plane of every application — storage, secrets, container registry, application logs — is pinned to Google Cloud region me-central2 in Saudi Arabia. The applications run on Google's global load balancer and global IAP control plane. Where machine-learning analysis is used, the Vertex AI request is routed via Google's global endpoint, as described above.

Your rights

If you have signed in to one of the applications and want a copy of the personal data we hold about your access, or you want it deleted, contact us at the address below. We will respond within 30 days.

Security

All traffic is encrypted in transit with TLS 1.2+. All data at rest is encrypted with AES-256 (Google-managed keys). Access requires a Google identity that has been explicitly granted IAP access by an administrator. Administrative actions on the underlying Google Cloud resources are recorded by Google Cloud Audit Logs.

Contact

Questions, access requests, or concerns: matthew.bunce@globant.com.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated to authorised users of the affected applications.