Privacy Policy

We use the information we collect to:

• Create and manage your account and provide the Service.
• Process payments and send receipts.
• Send transactional emails (e.g., OTP codes, password resets, deployment confirmations).
• Respond to support requests and troubleshoot issues.
• Improve and personalise the Service, including training and evaluating AI features on aggregated, de-identified data.
• Monitor for security incidents, fraud, and abuse.
• Comply with legal obligations and enforce our Terms of Service.
• Send product updates and marketing communications where you have given consent or where permitted by applicable law. You may unsubscribe at any time.

AI processing. When you use AI-powered features (e.g., chat-based site editing, funnel analysis), your input and the relevant project context are sent to large-language-model providers (currently OpenAI and/or Anthropic) to generate a response. These providers process data under their own privacy policies and data-processing agreements we maintain with them. We do not sell your content to these providers, and we opt out of data-training programs where that option is available.

If you are located in the European Economic Area or the United Kingdom, our legal bases for processing your personal data are:

• Contract — processing necessary to deliver the Service you have subscribed to.
• Legitimate interests — security, fraud prevention, product improvement, and direct marketing to existing customers.
• Consent — marketing to new contacts and non-essential cookies.
• Legal obligation — compliance with applicable law.

We do not sell your personal information. We share it only in the following circumstances:

• Service providers — third-party vendors who help us operate the Service (e.g., cloud hosting, email delivery, payment processing, analytics, LLM APIs). They process data on our behalf and are contractually bound to protect it.
• Business transfers — if Jossie is acquired, merges with, or transfers assets to another entity, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service.
• Legal requirements — when required by law, court order, or to protect the rights, property, or safety of Jossie, our users, or the public.
• With your consent — in any other case where you have given explicit permission.

We use cookies and similar technologies to authenticate sessions, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings; disabling them may affect Service functionality.

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal, regulatory, or fraud-prevention purposes (typically up to 7 years for financial records).

Our servers and service providers may be located outside your country, including in the United States. When we transfer personal data from the EEA, UK, or Switzerland to a country that does not provide an equivalent level of protection, we rely on Standard Contractual Clauses approved by the European Commission or other appropriate safeguards.

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at privacy@jossie.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal information, please contact us and we will delete it promptly.

We implement industry-standard technical and organisational measures to protect your personal data, including TLS encryption in transit, bcrypt password hashing, and role-based access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 7 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us: