Privacy Policy

1. What data we collect

Account data

• Full name and email address.
• Password (stored encrypted using bcrypt hashing; never in plain text).
• Usage profile (Personal, Professional, Business or Student) and subscribed plan.

Data from your connected email accounts

When you connect your Gmail, Outlook or other provider accounts via OAuth, JAAR accesses:

• The content of your emails (subject, sender, body) in order to classify and summarize them with artificial intelligence.
• Your calendar and cloud files (Drive/OneDrive), if you authorize those permissions, to display events and documents.
• OAuth access tokens, which are stored encrypted (AES-256-GCM) in our database.
• If you connect an iCloud or business email account (IMAP/SMTP), we store the server and username, and the password encrypted, only to read, organize and send your email from JAAR.

Payment data

Payments are processed through Stripe. JAAR does not store your card details; these are handled directly by Stripe in accordance with its own security standards (PCI-DSS).

2. Limited Use of Google data (Google API Services)

JAAR's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, regarding your Google account data (including Gmail data):

• We only use this data to provide and improve user-facing features of the service (classification, summarization and organization of your email).
• We do not transfer this data to third parties except as necessary to provide the service, for security purposes, or to comply with applicable law.
• We do not use this data for advertising purposes.
• No human reads your Google data unless you expressly authorize it, it is necessary for security reasons (e.g. investigating abuse), it is required by law, or the data is aggregated and anonymized.
• We do not use this data to train generalized or third-party artificial intelligence models.

3. Legal basis for processing

• Performance of the contract: processing your emails and account data is necessary to provide the service you have contracted.
• Consent: connecting your email, calendar and file accounts is done through your explicit consent via OAuth, which you can withdraw at any time.
• Legitimate interest: to improve the service, ensure its security and prevent abuse.

4. How we use your data

• Classifying, prioritizing and summarizing your emails using artificial intelligence agents.
• Showing you your calendar, deadlines, drafts and files in an organized way.
• Managing your account, subscription and billing.
• Communicating with you about the service.
• If you turn on the Meeting Secretary: joining your video calls (Google Meet, Zoom or Microsoft Teams) to record and transcribe them and produce a summary with decisions and tasks.

AI processing is performed through the Anthropic API (Claude) and TypeSafe AI models via OpenRouter. Content is sent for analysis and is not used to train models.

The Secretary assistant joins the call under an identifiable name, so the other participants know the meeting is being recorded. You are responsible for informing participants and, where the law requires it, obtaining their consent.

5. Who we share your data with

JAAR does not sell your data. We share information only with the providers strictly necessary to deliver the service:

• Anthropic (AI processing of email content).
• Stripe (payment processing).
• Google / Microsoft (through their OAuth APIs, to access the data you authorize).
• TypeSafe AI, via OpenRouter (AI email classification).
• Recall.ai (recording of video calls, only if you turn on the Secretary).
• AssemblyAI (transcription of recorded meetings).
• Resend (sending service emails, such as verifications and notices).
• Cloudflare (content delivery network and traffic protection).
• Apple and other email providers (access to the iCloud or IMAP accounts you connect).

Some of these providers may process data outside the European Economic Area. When they do, they rely on the safeguards provided by the GDPR, such as the European Commission's Standard Contractual Clauses.

6. Data retention

We keep your data for as long as you maintain an active account. If you cancel your account, we will delete your personal data and the tokens of your connected accounts within a reasonable period, unless we are legally required to retain them (for example, billing data). Additionally, the full body of processed emails is retained for a maximum of 90 days from receipt, after which it is automatically and permanently deleted. Minimal metadata necessary for the service to function (category, date, generated summary) may be retained in aggregate form.

Meeting transcripts and summaries are kept while your account is active and are deleted when you delete it.

7. Your rights

Under the GDPR, you have the right to:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: receive your data in a structured format.
• Objection and restriction: object to or restrict certain processing.
• Withdraw consent: disconnect your accounts at any time from the settings.

To exercise any of these rights, write to us at [email protected]. You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD).

8. Deleting your account and data

You can ask us to delete your JAAR account and all associated data at any time:

• Email us at [email protected] from the address you signed up with, with the subject “Delete my account”.
• We will confirm the request and delete the account within 30 days at most.

We delete your account data, processed emails and summaries, categories, detected events, meeting transcripts and summaries, and the credentials of your connected accounts. We only keep the billing records the law requires us to retain, for the legal period.

If you only want to stop sharing a specific account, disconnect it from Settings in JAAR or revoke access from the security settings of your Google, Microsoft or Apple account.

9. Security

We apply technical and organizational measures to protect your data: encryption of OAuth tokens (AES-256-GCM), passwords with bcrypt hashing, secure connections, HTTP security headers and access restrictions. However, no system is 100% infallible and we cannot guarantee absolute security.

10. Cookies

JAAR uses local storage and strictly necessary cookies to keep you signed in and remember your preferences. We do not use advertising or third-party tracking cookies.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes through the service or by email.