Privacy Policy

Who we are and how to contact us

Glim is a private, invite-only online community and network at joinglim.com where founders create a profile and project cards and send direct messages to find co-founders and collaborators. Membership is by invite code only. It is a fully online service and is based in London, England.

The data controller for the personal data described in this policy is JPA Prime of 20 Wenlock Road, London N1 7GU, England ("Glim", "we", "us", "our").

If you have any questions about this policy or about how we handle your personal data, or if you wish to exercise any of your rights, you can contact us at odil@joinglim.com.

This policy is governed by the law of England and Wales. We handle personal data in line with the UK GDPR and the Data Protection Act 2018. The supervisory authority for data protection in the UK is the Information Commissioner's Office (ICO).

This policy takes effect on 7 October 2026.

The personal data we collect

We collect the following categories of personal data when you use Glim.

Account data

When you create an account we collect your email address and a password. Passwords are hashed and are handled by our authentication provider. If you choose to sign in with LinkedIn instead, we collect the details LinkedIn provides through OpenID Connect: your name, email address, profile photo, and LinkedIn member identifier.

Profile data

Your profile may include a display name, a short headline, a photo, your skills, written answers to profile prompts, a stage or tier, and a description of what you are looking for.

Project data

When you create project cards we collect the title, descriptions, images or other media, tags, and the stage of the project.

Direct messages

We process the content of the messages you send to other members. These messages are visible to the members taking part in the conversation.

Waitlist data

If you request an invite, we collect your email address and the reason you give for wanting to join.

Invite codes

We record the invite codes you redeem or that are issued to you.

Payment data

If you take a paid membership, payment is handled by a third-party payment provider. We do not receive or store your full payment card details. We may receive limited information such as confirmation that a payment succeeded and basic billing details.

Safety and trust data

To detect scams and spam and to keep the community safe, we process your IP address (stored in hashed form), a sign-up and device fingerprint, behavioural signals derived from first-contact messages and sign-up metadata, and any reports made by members. Decisions to remove or ban a member are always made by a person, never automatically.

Technical and usage data

Through analytics we collect information about how you use the service, including the pages and cards you view, the actions you take in the app, your approximate location, and your device and browser information.

How and why we use your personal data

We rely on the following legal bases under the UK GDPR when we use your personal data.

Performance of our contract with you

We use your account, profile, project, direct message and invite code data to create and run your account and to provide the network, so that you can build a profile, publish project cards, and contact other members. Where you take a paid membership, we use your data to provide and manage it.

Our legitimate interests

We rely on our legitimate interests to keep the community safe and to prevent scams and spam (including through the safety and trust data described above), to understand and improve the product, and to market our own service. When we rely on legitimate interests, we balance those interests against your rights and freedoms.

Your consent

We rely on your consent for session-replay and advertising cookies and similar technologies (Microsoft Clarity and the Reddit pixel), and for signing in with LinkedIn where you choose that option. You can withdraw your consent at any time.

Legal obligations

Where the law requires it, we process personal data to meet our legal obligations.

A note on how we keep the community safe: showing interest in another member requires sending a written message. First-contact messages are screened for scam patterns, but ongoing private conversations between members are not monitored.

Who we share your personal data with

We use a small number of trusted service providers (sub-processors) to run the service. They process personal data on our behalf and only on our instructions. They are:

• Supabase: database, authentication and file storage (data hosting).
• Vercel: application hosting and content delivery.
• PostHog: product analytics.
• Microsoft Clarity: session replay and heatmaps.
• Reddit: an advertising conversion pixel, used on our public marketing pages only. If you consent to advertising cookies and request an invite, we share a hashed (SHA-256) version of your email address with Reddit for conversion measurement; Reddit never receives the address itself.
• LinkedIn: sign-in through OpenID Connect, only if you choose to sign in with LinkedIn.
• Stripe: processing payments for paid memberships, where offered.

Email to members is sent through our authentication provider.

We do not sell your personal data.

International data transfers

Some of our providers may process personal data outside the UK and the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards to protect your data, such as the UK International Data Transfer Addendum, Standard Contractual Clauses, or an adequacy decision.

Cookies and similar technologies

We use a small number of cookies and similar browser storage. In short: some are strictly necessary to run the service, one preference is stored in your browser, product analytics help us run and improve the service, and session-replay and advertising cookies are used only with your consent.

• Strictly necessary: authentication and session cookies that keep you signed in (set by our authentication provider), a temporary PKCE verifier cookie used during sign-in, and a short-lived invite cookie named glim_invite used only during LinkedIn sign-up.
• Preferences: your chosen light or dark theme, stored in your browser's local storage rather than in a cookie.
• Product analytics: PostHog, which we use to run and improve Glim and which we rely on under our legitimate interests.
• Session replay and advertising, used only with your consent: Microsoft Clarity and the Reddit advertising pixel.

For full details of the cookies and similar technologies we use, please see our separate Cookie Policy.

How long we keep your personal data

We keep your account and profile data for as long as your account is active and for a reasonable period afterwards. Waitlist entries are kept until your request has been handled or you withdraw it. Safety data is kept only for as long as it is needed for the purpose for which we collected it. If you delete your account, we delete or anonymise your personal data within 30 days, unless we are required to keep some of it to meet a legal obligation.

You can delete your account at any time. Deleting your account removes your profile and the content associated with it.

Your rights

Under the UK GDPR you have the following rights over your personal data:

• the right to access the personal data we hold about you;
• the right to have inaccurate data corrected (rectification);
• the right to have your data erased;
• the right to restrict how we use your data;
• the right to data portability;
• the right to object to our use of your data; and
• the right to withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, please contact us at odil@joinglim.com.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your personal data. You can find more information on the ICO's website at ico.org.uk. We would, however, welcome the chance to address your concerns before you approach the ICO.

How we keep your personal data secure

We take appropriate technical and organisational measures to protect your personal data. For example, passwords are stored in hashed form by our authentication provider, and IP addresses are stored in hashed form. We host the service with established infrastructure providers (Supabase and Vercel). No online service can be completely secure, but we work to protect your data against unauthorised access, loss, or misuse.

We do not make decisions that produce a legal or similarly significant effect on you by automated means alone. Decisions to remove or ban a member are made by a person.

Children

Glim is a network for professional adults. The service is not intended for anyone under the age of 18, and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this policy from time to time. When we make a significant change, we will update the effective date shown above and, where appropriate, let members know. Please check this page from time to time to stay informed about how we handle your personal data.