Privacy Policy Jotsight

1. Information We Collect

We collect information to provide, operate, secure, and improve the Service.

Information You Provide

When you create an account, join an organisation, or use the Service, we may collect:

• Name
• Email address
• Organisation name
• Account login credentials
• Information entered into forms, workflows, or the platform
• Communications with our support team
• Billing and payment-related information (processed by our payment provider, Stripe; we receive limited billing details only)

Organisation and Team Data

If you are part of an organisation using the Service, we may store:

• Team member information
• Roles and permissions
• Workflow activity
• Operational or task-related data entered by users

Automatically Collected Information

When you use the Service, we may automatically collect:

• Device information
• Browser type and version
• IP address
• Log data
• Usage activity within the platform

This information helps us maintain performance, security, and reliability.

2. How We Use Your Information

We use personal data for the following purposes and on the following legal bases:

• To provide, operate, and maintain the Service (performance of a contract)
• To manage user accounts and organisations (performance of a contract)
• To enable collaboration within teams (performance of a contract / legitimate interests)
• To improve product features, reliability, and user experience (legitimate interests)
• To provide onboarding and customer support (performance of a contract / legitimate interests)
• To communicate important service updates and security notices (legitimate interests / legal obligation)
• To maintain security, prevent misuse, fraud, and illegal activity (legitimate interests / legal obligation)
• To comply with applicable laws and enforce our agreements (legal obligation)

Where we rely on legitimate interests, we balance those interests against your rights and freedoms.

We do not sell your personal data.

We may use aggregated or anonymised data (that cannot reasonably identify any individual or organisation) to improve the Service. We do not use identifiable customer content for product improvement except as necessary to provide the Service to that customer or where we have an appropriate legal basis.

3. Data Storage, Security and International Transfers

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, or alteration.

Your data may be stored on secure cloud infrastructure used to operate the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Users (and organisation administrators) are responsible for keeping login credentials secure and for managing access within their organisation.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. Where required by applicable law, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms to protect personal data during such transfers.

4. How We Share Information

We share personal data only in the limited circumstances described below.

Service Providers

We engage trusted third-party service providers that help us operate the platform, including:

• Hosting infrastructure
• Authentication services
• Payment processing (Stripe)
• Analytics tools

These providers only access data necessary to perform their services and are bound by written agreements that require them to protect personal data and process it only on our instructions. A current list of material sub-processors is available on request.

Legal Requirements

We may disclose information if we believe in good faith that disclosure is necessary to:

• Comply with a valid legal obligation or enforceable governmental request
• Enforce our Terms of Service
• Protect the security, integrity, or availability of the Service
• Prevent fraud, abuse, or illegal activity
• Protect the rights, property, or safety of Jotsight, our users, or the public

Business Transfers

In connection with a merger, acquisition, corporate reorganisation, or sale of assets, personal data may be transferred to the successor entity, subject to the commitments in this Privacy Policy.

5. Data Ownership

Organisations and users retain ownership of the data they submit to the platform.

We process this data only to:

• Provide the Service
• Maintain platform functionality
• Improve the product (using aggregated or anonymised data as described above)

Where we act as a processor for an organisation customer, we process data solely on that customer’s documented instructions.

6. Data Retention

We retain personal data only for as long as necessary to:

• Provide the Service
• Comply with legal obligations
• Resolve disputes
• Enforce agreements

After an account is deleted, we will delete or anonymise associated personal data within a reasonable period, unless longer retention is required by law or for legitimate business purposes (such as security and audit logs).

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep users logged in and maintain session security (essential)
• Improve performance and reliability
• Understand how the Service is used (analytics – used only with consent where required)

You can manage non-essential cookies through our cookie banner (where displayed) or your browser settings. Essential cookies cannot be disabled as they are required for the Service to function.

8. Third-Party Services

The Service may integrate with or rely on third-party services. These services have their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policies of any third-party services you choose to use in connection with the Service.

9. Your Rights

Depending on applicable law, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Restrict or object to certain processing of your personal data
• Request data portability
• Withdraw consent where processing is based on consent
• Lodge a complaint with a relevant supervisory authority

We will respond to verified requests within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request.

To exercise any of these rights, contact us using the details in Section 12.

10. Eligibility and Authorised Use

The Service is designed for use by organisations and their authorised personnel in a workplace context.

Individual users must be at least 16 years of age (or the applicable age of digital consent or majority in their jurisdiction) to create an account or access the Service. Organisation customers are responsible for ensuring that only eligible and authorised individuals are invited to or granted access to the Service.

We do not knowingly collect personal data from individuals under the applicable age. If we become aware that we have collected such data, we will take reasonable steps to delete it. If you believe this has occurred, please contact us using the details in Section 12.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make material changes, we will provide notice through the Service or by email. Where required by law, we will obtain fresh consent or provide an opportunity to object before the changes take effect.

The "Last Updated" date at the top of this policy indicates when it was most recently revised. Continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy, except where applicable law requires otherwise.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: support@jotsight.com

We will respond as promptly as practicable and within the timeframes required by applicable law.