Privacy Statement

1. About this Statement

This Statement describes how the operator of Jotzu (“Jotzu Developer,” “Jotzu,” “we,” “us,” or “our”) collects, uses, and shares personal information through our website, hosted interactive-document Service, and related communications. It applies to free and paid users.

Website: https://jotzu.app
Application: https://app.jotzu.app
Privacy contact: [email protected]

We are responsible as controller for processing whose purposes and means we determine, including account administration and our own operational activities. Where we process workspace content on behalf of a customer acting as controller, we do so under that customer's instructions and the applicable processing agreement. For organization-controlled content, the organization's policies and access decisions also apply.

This Statement does not cover the independent practices of external services or tools you choose to use. Our Terms of Service govern use of Jotzu.

2. Information we collect

The information we handle depends on how you use the Service. We receive information from you, your sign-in provider, workspace participants, connected tools you authorize, and service providers. Some information is generated automatically through use.

Payment-card credentials are handled by a third-party payment provider. Jotzu does not collect full card numbers or card security codes through its checkout flow. The provider handles payment details under its own notice; we receive information needed to administer the purchase, access, and refunds. Do not send card credentials in documents, comments, or support messages.

Product analytics. We use analytics to understand navigation, feature use, performance, and service activity. Analytics may use coded or technical identifiers rather than names or email addresses and may relate activity to an account, workspace, or document. We also use aggregated statistics. We do not intentionally send the contents of private documents or comment text as product-analytics event data. Operational processing needed to store, deliver, troubleshoot, or secure content is separate from measuring product usage.

You can choose not to provide information, but we may then be unable to create your account, provide a requested feature, process a purchase, or answer your request. Avoid submitting personal information that is unnecessary for your use of the Service.

3. How and why we use information

We use information to provide and administer Jotzu; authenticate users; store and deliver documents; enable sharing and collaboration; process purchases; provide support and service notices; understand usage and improve the product; detect abuse and maintain security; enforce agreements; and comply with legal obligations or handle claims.

Where a law requires a legal basis for our processing, we rely on the following bases as applicable:

When we process content on a customer's behalf, that customer determines its purposes and legal basis. We do not treat its instructions as permission for unrelated use of private documents.

We may send account, collaboration, billing, security, and support messages needed for the Service. We may also send Jotzu news or offers where permitted by law, obtaining consent where required. You may unsubscribe from promotional emails using their unsubscribe link or by contacting us. Non-promotional service messages may continue.

4. AI and external tools

Jotzu does not use Customer Content to train or fine-tune AI models, and does not instruct its service providers to use it for model training. We do store and process content to provide the Service; no-training does not mean no storage.

Jotzu does not currently operate its own AI models or provide hosted model inference on your behalf. You may use independently operated assistants or other tools with the Service. If you authorize a tool to retrieve or change content, the tool and its provider may process that information under their own terms and settings. Our no-training policy does not control a provider you independently select.

Removing a connection or deleting content in Jotzu does not automatically delete copies already received by an external tool, service, or collaborator.

5. When we share information

Collaborators and administrators. Your sharing choices and workspace permissions determine who can access documents, comments, profile information, and activity records. Administrators may manage workspace content and membership. Invitations and notifications may include the sender's name, document or workspace details, a link, and relevant message content. Email copies are also handled by email providers and can remain in recipients' mailboxes after deletion in Jotzu.

Service providers. We use providers for application hosting, storage, delivery and backups; authentication; email and support; payment processing; and diagnostics and analytics. They receive information needed for those functions, subject to contractual protections appropriate to their role. A provider may act independently for certain purposes, such as payment compliance, under its own privacy notice.

Tools you authorize. We share information with independently selected tools and services when you direct or authorize that sharing. Their separate practices apply to the information they receive.

Legal and business purposes. We may disclose relevant information where lawfully necessary to meet legal obligations, respond to valid legal process, enforce our agreements, investigate misuse, protect rights or safety, or establish or defend a claim. Information may also be disclosed to professional advisers and a successor in connection with incorporation, financing, reorganization, or transfer of the Service, subject to applicable protections and notice requirements.

We do not sell personal information or share it for cross-context behavioral advertising. The service-related disclosures described above do not change that policy. Contact [email protected] for recipient information available under applicable law or an agreement.

6. Cookies, browser storage, and third-party content

We and our providers use cookies, local storage, and similar technologies for sign-in, security, preferences, and usage measurement. These technologies may retain session or technical identifiers and information about use of the Service. Their purpose and duration depend on the technology: session information may expire when the session ends, while stored preferences and identifiers may persist until they expire or are cleared.

You can manage cookies and site storage through your browser and any relevant controls offered in the Service. Blocking storage may affect sign-in or other functionality. Where applicable law requires consent or a right to object to non-essential technologies, that requirement applies; accepting our Terms does not replace a legally required choice. Contact us for help with privacy choices.

Interactive documents may contain external images, fonts, scripts, or links. When an external resource loads, its host may receive information such as your IP address and the resource requested. The independent provider's practices also apply when you follow an external link, use an external tool, or enter a third-party payment flow.

7. International processing

Jotzu uses US-based infrastructure for its core application data and document storage. Our operator is based in Israel, and providers may access or process information in other countries, including European countries, depending on the service they provide. The Service does not include an exclusive-country residency guarantee unless separately agreed in writing.

Processing outside your country may be subject to different privacy laws. International transfers are subject to safeguards required by applicable law. Depending on the recipient and transfer, these may include an applicable adequacy decision or approved contractual protections. Contact [email protected] for information about the safeguards relevant to your information and how to obtain a copy or description.

8. Retention and deletion

We retain personal information for as long as reasonably necessary for the purposes in this Statement. Relevant factors include whether your account or workspace remains active, the features requested, the nature of the information, operational and security needs, and applicable accounting, legal-claims, or other retention requirements.

You may request account closure or deletion through available controls or by contacting us. We may verify your identity and authority. Deletion is subject to applicable exceptions and required retention; it does not necessarily remove organization-controlled contributions or copies held independently by others. Cancelling a paid subscription is separate from deleting an account.

Information pending deletion may remain in backups until it is removed through the backup lifecycle. Any retained copies remain subject to applicable protections and are not kept as a guarantee of recoverability. Records needed for legal obligations, fraud prevention, disputes, or enforcing agreements may be retained for those purposes. Data that is genuinely anonymous may be retained for statistical purposes.

Section 10 of the Terms provides a limited period to request content still available after closure. It does not require us to preserve deleted content or keep backups available for retrieval. Personal-information requests are handled within the deadlines and exceptions prescribed by applicable law.

9. Security

We use reasonable technical and organizational measures designed to protect personal information and restrict operational access to authorized purposes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your sign-in credentials and connected devices, review sharing permissions, and maintain independent copies of important content.

10. Your rights and choices

Depending on where you live and the law that applies, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; and complain to a competent privacy authority. Where we rely on legitimate interests, you may object on grounds relating to your situation. You may object to direct marketing at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

Submit requests to [email protected]. We may verify identity and authority and apply the conditions or exceptions allowed by law. An authorized agent may act where permitted with appropriate evidence of authority. Where applicable law provides an appeal right, reply to our response or contact the same address to appeal. We respond within applicable legal deadlines and do not unlawfully discriminate against users for exercising their rights.

For information controlled by your organization, contact that organization; we assist with requests where required. You may also complain to your relevant data protection or privacy authority, including the authority where you live or work in the EEA, the UK Information Commissioner's Office, or Israel's Privacy Protection Authority, as applicable.

11. Age limits and updates

Jotzu is intended for users aged 18 and over. We do not knowingly offer accounts to children. Contact us about an underage account so we can address it, including removing information as required. Information about other people included in user documents remains subject to the submitter's responsibilities and applicable law.

We may update this Statement as the Service or our practices change. We will publish the updated version and give additional notice or obtain consent where required by law. This Statement describes data practices; it does not expand any contractual warranty or service-level commitment in the Terms.

Privacy questions: [email protected]