1. Introduction and Scope
This Privacy Policy describes how GlowBox, a platform operated by Contollo Consulting, LLC(“GlowBox,” “we,” “us,” or “our”), collects, uses, processes, and protects information in connection with the use of the GlowBox platform (the “Platform” or the “Service”).
This Privacy Policy applies to:
- Users who access, register for, or use the Platform; and
- Information collected through the Platform, related services, and communications.
GlowBox is a technology infrastructure provider that enables email delivery and routing through standard email protocols. Except as expressly stated in this Privacy Policy, GlowBox does not determine the content, recipients, or purposes of email communications sent through the Platform.
This Privacy Policy should be read together with the Terms and Conditions, which govern the contractual relationship between the User and GlowBox. Capitalized terms not defined herein shall have the meanings assigned to them in the Terms and Conditions.
This Privacy Policy is intended to comply with applicable privacy and data protection laws of the United States, including, where applicable, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
2. Identity of the Data Controller and Role of GlowBox
GlowBox is operated by Contollo Consulting, LLC, a limited liability company organized and existing under the laws of the State of Texas, United States of America (“Company”).
For purposes of applicable U.S. privacy laws, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Contollo Consulting, LLC acts as the business or service provider with respect to personal information collected directly from Users in connection with account registration, billing, platform access, and operational communications.
- With respect to personal data contained in email messages, recipient lists, or other content transmitted by Users through the Platform, GlowBox acts solely as a service provider / data processor, processing such information on behalf of and under the instructions of the User.
GlowBox does not determine the purposes or means of processing personal data contained in messages sent through the Platform and does not act as the data controller of such information. The User is the entity responsible for determining the purposes and legal bases of processing personal data of message recipients.
GlowBox processes personal information only to the extent reasonably necessary to provide, operate, secure, and maintain the Platform, and to comply with applicable legal obligations.
3. Information We Collect
GlowBox collects and processes different categories of information depending on how the Platform is used. The types of information we collect include the following:
3.1. Account and Registration Information
When a User registers for or uses the Platform, we may collect information such as:
- Name, company name, and business contact details
- Email address and login credentials
- Billing and payment-related information
- Account configuration and subscription details
- Communications with GlowBox, including support requests
This information is collected directly from the User and is used to create and manage the User’s account, provide access to the Platform, and administer the Service.
3.2. Technical and Usage Information
We may automatically collect technical and usage information when the Platform is accessed or used, including:
- IP addresses and device identifiers
- Log files, timestamps, and system activity data
- Platform usage metrics and operational logs
- Configuration data related to sending pools, limits, and system behavior
- Diagnostic and performance information
This information is used for security, monitoring, troubleshooting, analytics, fraud prevention, and to improve the reliability and performance of the Platform.
3.3. Message and Content-Related Information
In order to provide the Service, GlowBox may process information contained in email messages, headers, metadata, and recipient addresses transmitted by the User through the Platform.
GlowBox does not access, use, or analyze message content for its own purposes and processes such information solely in a technical and transient manner as necessary to route, deliver, and manage messages in accordance with the User’s instructions.
The User remains solely responsible for the content of messages and for compliance with applicable laws relating to personal data contained therein.
3.4. Cookies and Similar Technologies
GlowBox may use cookies or similar technologies on the Platform for authentication, session management, security, and functionality purposes.
Users may control or disable cookies through their browser settings; however, doing so may affect certain features of the Platform.
4. How We Use the Information
GlowBox uses the information it collects and processes solely for legitimate, limited, and necessary purposes related to the operation of the Platform. Specifically, we use information for the following purposes:
4.1. Providing and Operating the Platform
We use information to:
- Create, maintain, and manage User accounts
- Provide access to and functionality of the Platform
- Process and route email messages in accordance with User configurations
- Administer subscriptions, billing, and payments
4.2. Security, Monitoring, and Compliance
We use information to:
- Protect the security and integrity of the Platform
- Detect, prevent, and respond to fraud, abuse, or unauthorized activity
- Enforce our Terms and Conditions and applicable policies
- Comply with legal obligations and lawful requests from authorities
4.3. Support, Communications, and Improvements
We use information to:
- Respond to inquiries, support requests, and technical issues
- Communicate with Users regarding service updates, changes, or operational notices
- Analyze performance and usage trends to improve Platform reliability and functionality
4.4. No Sale or Independent Use of Message Content
GlowBox does not sell personal information and does not use message content, recipient data, or metadata for advertising, profiling, or marketing purposes.
Any processing of message-related information is performed solely to provide the Serviceand in accordance with the User’s instructions.
5. User-Provided Content and Third-Party Data
GlowBox allows Users to transmit, route, and process email messages and related information through the Platform. Any content, data, or information provided, uploaded, or transmitted by the User (“User Content”) remains under the sole ownership and responsibility of the User.
User Content may include, without limitation:
- Email messages and message bodies
- Email headers and metadata
- Recipient email addresses and contact information
- Attachments or other data included in communications
GlowBox does not independently collect, control, or determine the purposes for which such User Content is processed. All User Content is processed solely on behalf of and under the instructions of the User, and only to the extent technically necessary to provide the Service.
GlowBox does not verify the accuracy, legality, or legitimacy of User Content and does not assume responsibility for compliance with laws applicable to the collection, use, or disclosure of personal data contained in such content.
Where User Content includes personal information relating to third parties (such as email recipients), the User represents and warrants that the User has obtained all necessary rights, notices, and consents required under applicable law. The User is solely responsible for responding to requests or claims from data subjects relating to such information.
6. Legal Basis for Processing (Where Applicable)
GlowBox processes personal information in accordance with applicable laws of the United States and solely to the extent necessary to provide and operate the Platform.
The legal bases for processing personal information may include one or more of the following, as applicable:
- Performance of a contract, where processing is necessary to provide the Service requested by the User pursuant to the Terms and Conditions.
- Legitimate business purposes, including maintaining the security, functionality, and reliability of the Platform, preventing fraud or abuse, and improving the Service.
- Compliance with legal obligations, including responding to lawful requests from courts, regulators, or government authorities.
- User consent, where such consent is expressly provided and required under applicable law.
With respect to personal data contained in email messages or communications sent by the User through the Platform, the User is responsible for determining and ensuring the appropriate legal basis for processing such data. GlowBox processes such informationsolely on behalf of the User and does not independently determine the legal basis for such processing.
Nothing in this Privacy Policy shall be construed as creating additional obligations for GlowBox beyond those required under applicable U.S. law.
7. Data Sharing and Disclosure
GlowBox does not sell personal information and does not share personal information for cross-context behavioral advertising purposes.
GlowBox may share or disclose information only in the following limited circumstances:
7.1. Service Providers and Vendors
GlowBox may share information with trusted third-party service providers that perform services on our behalf, such as:
- Cloud hosting and infrastructure providers
- Security, monitoring, and logging services
- Payment processing and billing providers
- Customer support and communication tools
Such service providers are authorized to process information only as necessary to perform services for GlowBox and are contractually required to protect the confidentiality and security of the information and to use it solely for the purposes specified by GlowBox.
7.2. Legal and Regulatory Requirements
GlowBox may disclose information where required to do so by law or in response to valid legal processes, including subpoenas, court orders, or requests from government authorities.
We may also disclose information where we believe in good faith that such disclosure is necessary to:
- Comply with legal obligations
- Protect the rights, property, or safety of GlowBox, Users, or others
- Investigate or prevent fraud, abuse, or security incidents
7.3. Business Transfers
In the event of a merger, acquisition, reorganization, sale of assets, or similar corporate transaction, information may be transferred as part of such transaction, subject to applicable confidentiality and data protection requirements.
8. Data Retention
GlowBox retains personal information only for as long as reasonably necessary to fulfill the purposes for which the information was collected and processed, as described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.
The criteria used to determine retention periods include:
- The duration of the User’s account and use of the Platform
- The need to provide the Service and support User requests
- Legal, regulatory, accounting, or reporting obligations
- Security, fraud prevention, and dispute resolution requirements
8.1. Message and Content Data
Personal information contained in email messages, headers, or metadata processed through the Platform is retained only to the extent technically necessary to route, deliver, monitor, and manage messages in accordance with the User’s instructions.
GlowBox does not retain message content for longer than required for operational purposes and does not use such content for independent analysis, marketing, or profiling.
8.2. Account and Operational Data
Account-related, billing, and operational data may be retained for the duration of the User’s relationship with GlowBox and for a reasonable period thereafter, as required for legal compliance, audit purposes, or enforcement of contractual rights.
Upon termination of the Service, GlowBox may delete or anonymize personal information in accordance with applicable law and internal data retention policies.
9. Security Measures
GlowBox implements reasonable administrative, technical, and organizational measuresdesigned to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.
These measures may include, without limitation:
- Access controls and authentication mechanisms
- Encryption of data in transit and, where appropriate, at rest
- Network security monitoring and logging
- Segmentation of systems and least-privilege access principles
- Regular review of system performance and security practices
GlowBox’s security measures are designed to align with industry standards applicable to technology infrastructure providers; however, no system can be guaranteed to be completely secure. The User acknowledges and agrees that the transmission of information over the internet involves inherent risks.
Users are responsible for maintaining the confidentiality of their account credentials and for implementing appropriate security measures within their own systems when using the Platform.
10. User Rights (CCPA / CPRA)
This section applies to Users who are residents of the State of California, as required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
Subject to applicable law and certain exceptions, California residents have the following rights with respect to their personal information:
10.1. Right to Know
The right to request disclosure of:
- The categories of personal information collected
- The categories of sources from which personal information is collected
- The business or commercial purposes for collecting or using personal information
- The categories of third parties with whom personal information is shared
10.2. Right to Access
The right to request access to the specific pieces of personal information that GlowBox has collected about the User.
10.3. Right to Delete
The right to request deletion of personal information collected by GlowBox, subject to exceptions permitted by law, including where retention is necessary to:
- Provide the Service
- Comply with legal obligations
- Detect security incidents or prevent fraud
- Exercise or defend legal claims
10.4. Right to Correct
The right to request correction of inaccurate personal information maintained by GlowBox.
10.5. Right to Opt-Out of Sale or Sharing
GlowBox does not sell personal information and does not share personal information for cross-context behavioral advertising purposes. Accordingly, no opt-out mechanism is required for such activities.
10.6. Right to Non-Discrimination
Users shall not receive discriminatory treatment for exercising any rights granted under the CCPA or CPRA.
10.7. Exercising Your Rights
Requests to exercise CCPA/CPRA rights may be submitted through the contact methods identified in the Contact Information section of this Privacy Policy. GlowBox may take reasonable steps to verify the identity of the requester before responding to a request.
11. International Data Transfers
GlowBox is operated from the United States, and the Platform and its supporting infrastructure are primarily hosted and managed within the United States.
As a result, personal information processed by GlowBox may be stored or processed in the United States, even if the User accesses the Platform from outside the United States.
At this time, GlowBox’s services are intended primarily for Users located in the United States. Should GlowBox expand its operations internationally in the future, it will take appropriate measures to ensure that any cross-border transfers of personal information comply with applicable data protection laws.
By using the Platform, Users acknowledge and consent to the processing of personal information in the United States, subject to the safeguards described in this Privacy Policy.
12. Children’s Privacy
GlowBox is not intended for use by children under the age of 13, and GlowBox does not knowingly collect personal information from children under 13 years of age.
If GlowBox becomes aware that personal information from a child under 13 has been collected without verified parental consent, GlowBox will take reasonable steps todelete such information promptly.
If a parent or legal guardian believes that a child has provided personal information to GlowBox in violation of this Privacy Policy, they may contact GlowBox using the contact information provided below.
13. Changes to This Privacy Policy
GlowBox reserves the right to modify or update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or the operation of the Platform.
Any changes to this Privacy Policy will become effective upon their publication on the Platform, unless a different effective date is expressly stated. Where required by applicable law, GlowBox will provide notice of material changes through reasonable means.
The continued use of the Platform after the effective date of any changes constitutes the User’s acceptance of the updated Privacy Policy.
14. Contact Information
If you have any questions, requests, or concerns regarding this Privacy Policy or the processing of personal information by GlowBox, you may contact us through the official channels made available on the Platform or by email at:
Legal / Privacy Contact:
[legal contact email]