This policy covers two very different relationships, and it is honest about the difference:
- Jot as controller. When you visit our website, sign up, or use the dashboard, we decide why and how your data is processed.
- Jot as processor. When a Jot customer embeds the widget in their app, the data the widget captures about their end users is processed on that customer's instructions. The customer is the controller; we are their processor under the Data Processing Addendum.
Who we are
Where Jot is the controller (1 above), that is Jot Co. Privacy questions and requests: privacy@usejot.co.
If you encountered Jot inside someone else's product — the feedback tab on a site you were reviewing — direct any privacy request to the operator of that site. They control the data; we act on their instructions. If you contact us directly we will forward your request to them where we can identify them.
What we collect, and why
As controller (our site and dashboard)
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | name, email, password hash, company | providing the service, authentication | contract (Art. 6(1)(b)) |
| Billing data | plan, invoices — card details go to Creem, our merchant of record, never to us | charging for the service | contract |
| Usage data | pages visited in the dashboard, feature usage | improving the product | legitimate interest (Art. 6(1)(f)) |
| Support data | emails you send us | answering you | legitimate interest |
| Security logs | IP address, user agent, sign-in events | abuse and fraud prevention | legitimate interest |
As processor (the embedded widget)
On our customers' instructions, the widget may capture: screen content subject to masking (all inputs masked by default; passwords always), DOM selectors, page URLs, IP address, user agent, and interaction events (clicks, scrolls) when session recording is on. Purposes, notices, and legal bases for this data are the customer's responsibility; Using Jot lawfully explains what we require of them.
International transfers
Our infrastructure providers are listed on the sub-processors page. Where personal data leaves the EEA or UK, transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK Addendum.
Retention
| Data | Kept for |
|---|---|
| Session recordings | 30 days by default (configurable per project) |
| Account and workspace data | life of the account |
| Deleted organisation | 7-day grace period, then purge begins |
| Hard purge after deletion | complete within 30 days |
| Backups / point-in-time recovery | beyond use immediately, purged within 35 days |
Your rights
Where GDPR or similar law applies, you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to privacy@usejot.co and we will respond within one month. Where we act as processor, we will pass the request to the controller (our customer) instead of answering it ourselves.
You also have the right to complain to your supervisory authority. We would prefer you talk to us first, but that is your call, not a condition.
Cookies and local storage
Jot sets only cookies that are strictly necessary to keep you signed in and to protect sign-in from forgery, and stores a few interface preferences in your browser. No advertising or analytics cookies. The full list, with purposes and durations, is on our cookie policy.