# Privacy Policy

> This policy explains what information hellojade collects, why, who it goes to, how long it is kept and what you can do about it. hellojade is operated by **Uplevel Digital Services, LLC** ("Uplevel", "we", "us") in Illinois, United States. It covers the website at **hellojade.ai** and the hellojade app at **hellojade.ai/app**. It is written to match what the software actually does; if you find something here that does not match what you see, tell us and we will fix one of the two.

## The short version {#summary}

- hellojade is a service for businesses. We collect what we need to run it for your company, and what your company puts into it.
- We **do not sell** personal information, we do not use it for advertising, and we do not use it to train artificial-intelligence models.
- The app keeps a record of how it is used, to run and improve it. You can turn that recording off in **Account → Activity**; security events are always kept.
- Some AI features run on our own servers and some use Anthropic's Claude service. The [AI section](#ai) says which, and what they see.
- Your company's data is kept while its account is open and for **one year after it closes**, then deleted.
- You can ask us for a copy of your information, to correct it, or to delete it, at [go@hellojade.ai](mailto:go@hellojade.ai).

## When you use the website {#website}

**When you just read the site.** Your browser sends an internet address, a user agent and the page you asked for. Our web server uses those to serve the page and keep the site working and secure. Nothing about you is required to read any page.

**Our request log.** Our servers keep a log of every request made to the website and to the app: the time, the address and page requested, the response, your **full internet address**, your browser's user agent, the referring page, and the other headers your browser sent. Sign-in cookies, authorization headers and anything in an address that looks like a key or a code are removed before a request is logged. We use this log to keep the Service working and secure — to find errors, slow pages and abuse, and to tell real visitors from automated ones — and for nothing else. It is kept on our own servers and is not shared. It has no set expiry today; when we set one, this section will say what it is.

**When you submit a form.** The forms on this site are the contact form, the demo booking, the webinar registration, the manufacturer inquiry, the website audit, and the interactive demos (the website, email-and-text and ads-planner demos). Each sends us only what you type or choose: typically your name, email address, phone number, business name, website address, trade, your role, a preferred day and time, the options you pick in a demo (for example the channels and budget in the ads planner), and anything you write in a notes field. With each submission we also store the time, the internet address it came from, your browser's user agent, the page you sent it from, and how you first arrived at the site (a campaign tag from a link you clicked, or the site that referred you — the `hj_attr` cookie below). That records how you got here, not who you are.

The website loads no analytics, tag manager, advertising pixel or other third-party script, with one exception: the subscription checkout pages load Stripe's own payment script, so that card details go straight to Stripe. A page that embeds a YouTube video shows a thumbnail image served by YouTube's image server; the video itself, and anything else from YouTube, loads only when you press play.

## When you create an account or join one {#account}

The hellojade app is for businesses. To sign in we take your **email address** and send you a one-time link; there is no password. You may add a **passkey**: we store its public half, its ID, a counter, the kind of authenticator it is and the name you give it — never the private key, which stays on your device. We store your **name**, your **role** in each company you belong to, the **departments** you choose, a **profile photo** if you add one, and a **phone number** and **recovery email address** if you choose to verify them. For your company we store its **name, website, offices and addresses** and the **people** in its account.

We keep a list of your **sessions** — the kind of device and browser, when each started and was last used, and a shortened form of the internet address it came from — so you can see where you are signed in and sign a session out. We keep a short log of **account changes** (sign-ins, and changes to your email address, phone, passkeys and roles) so you and your company can see them and so we can spot misuse.

## The record of what you accepted {#acceptance}

When you accept the Terms of Service and this Privacy Policy — at sign-up, when you join a company, when you accept an updated version, or when your company turns on a feature with its own terms — we keep a record of it: who you are, which company, which documents and the exact version and fingerprint (a sha256 hash) of the text you were shown, the time, **your full internet address**, your browser's user agent and kind of device, and the exact words of the checkbox you checked. Here we keep your full internet address because it is evidence of the agreement (it is also in the request log and form submissions described [above](#website)). We keep these records for as long as the agreement they prove can matter — for the life of the account and for seven years after it closes — and use them for nothing else. Your company's owner and admins can see who in the company accepted which version and when; they cannot see the internet address or device.

## Google user data — Google Business Profile {#google}

An office in the hellojade app can connect its **Google Business Profile**. This section describes that connection and nothing else. Connecting is optional; you can use hellojade without it.

**What we ask Google for.** When you choose to connect, we send you to Google's own consent screen and request these permissions ("scopes"): `openid`, `email` and `profile` — the Google account's email address, name and account ID, so we can show which Google account made the connection — and `https://www.googleapis.com/auth/business.manage`, which lets the app read and manage the Business Profile locations that account can manage. We ask for nothing else, and nothing is requested until you choose to connect.

**What we access.** To let you choose, we read the list of Business Profile accounts and locations the Google account can manage, and each account's list of managers and pending manager invitations (their names, email addresses and roles). You then pick exactly **one location** for each office. For that location, we read its **listing details** (name, address, phone, hours, categories, description, links, attributes, services, menus and booking or ordering links), its **photos and media**, its **reviews** and any replies, its **questions and answers**, its **performance metrics** (the daily counts Google reports — views, searches, calls, direction requests, website clicks), its **posts**, its **verification status** and its **notification settings**. If you ask the app to, it also writes on your behalf: a review reply someone at your company approved, or a post someone wrote. It never replies or posts on its own — every write is a button a person pressed.

**Why.** To show the office's listing inside the app next to its messages and leads, to let your team reply to reviews and publish posts from one place, to keep your office's name, address, phone and hours consistent with the listing, and to chart how the listing performs. That is the whole use. We do not use Google data to build profiles of anyone, to train models, to find leads for other businesses, or for advertising.

**Where it is stored and how it is protected.** On our servers in the United States, in a store kept separate from the rest of the app, and in transit over encrypted connections. The Google access and refresh tokens that let the app act for you are additionally sealed with a key that lives only on the server and is never stored beside them, so a copy of the database alone reveals nothing. While an office is connected, its Google data is a working copy refreshed from Google about once a day.

**Who sees it.** The people in **your own company's** account whom your owner or admins give access to that office. hellojade staff do not read your Google data except to give support you asked for, to investigate abuse or a security problem, or where the law requires. We **never sell** Google user data, never use it for advertising, and never share it except with the service providers that host our servers, who process it only on our instructions.

**How to stop, and deletion.** You can disconnect at any time with **Disconnect** on the office's Google page. That revokes our access at Google and stops syncing straight away: nothing more is read from or written to Google for that office. Google ties the permission to the Google account, not to one location, so if the same Google account is connected to other offices, disconnecting one office ends the connection for those offices too; connect them again to keep them. You can also remove hellojade from your Google account at [myaccount.google.com/permissions](https://myaccount.google.com/permissions), which has the same effect. The Google data we already hold for a disconnected office, and its sealed tokens, stay in our separate store until they are deleted: email [go@hellojade.ai](mailto:go@hellojade.ai) and we will delete them within 7 days. When your company's account closes, its Google data is deleted as the [retention section](#retention) describes.

> hellojade's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your use of Google Business Profile through hellojade is also subject to Google's own terms, and replies and posts you publish must follow Google's content policies.

## Messaging, calls and contacts {#messaging}

The app is where your team talks to each other and to the people who contact your business. It stores **messages** your team writes (chat, notes and email), **contacts and leads** — the name, phone number, email address and history of each person who reaches your business through a form, a text, a call or an email — and the **threads** that tie them together.

**Text messages and calls** to and from your business numbers are carried by our telecommunications provider, **Sinch**, which receives the phone numbers and message content in order to deliver them. The app stores the message text, the numbers, times and delivery status, and — for calls — the call log. **Email** to and from your company's hellojade mailboxes is stored the same way, with its headers and attachments, on our own mail server.

Every text message from a business number honors **STOP**: a person who replies STOP is not texted again unless they reply START. Your business is responsible for the consent it collects to text or call someone.

**Recording.** Recording a meeting is off unless the person who started the meeting turns it on. When they do, a notice saying who started recording is posted in the meeting's conversation, and another when it stops. Your business is responsible for any consent the law requires from the people being recorded. We do not make transcripts of calls or meetings today; if we start, this policy will say so first.

## Files, voice notes and notifications {#files}

**Files** you upload to your company's storage or attach to a message — documents, photos, voice notes — are stored on our own servers in the United States, with a copy kept off-site for recovery, and are visible only to the people they are shared with.

**Push notifications** are off until you turn them on in your browser. If you do, the app stores a push subscription for that browser — a delivery address issued by your browser's maker (Google, Apple or Mozilla) and its encryption keys — so it can tell you about new messages when the app is closed. Notification contents are encrypted to your browser. Turning notifications off, or removing the device in your account, deletes the subscription.

## Payments {#payments}

Subscriptions are paid through **Stripe**. When your company adds a card or bank account, you type it into a form served by Stripe directly on the Subscriptions page; the card or account number goes to Stripe and never reaches our servers. We keep what Stripe tells us about your company's subscriptions, invoices and payments (for example the last four digits and expiry of a card, and the amounts and dates of invoices), and the name and billing address you give. Stripe's own privacy policy governs what it does with the information you give it.

## AI features {#ai}

Some features use artificial intelligence. Here is where each one runs and what it sees.

- **Always on our own servers, with a model we host ourselves:** suggested replies to Google reviews, and any agent that has been given access to your company's leads or customer records. An agent with that access is never run on an outside AI service.
- **Anthropic's Claude service, or our own model:** every other agent your company sets up — for example agents that work in Messages, send email, manage a calendar or publish website changes. These use Anthropic's Claude service by default, and our own model once your company's monthly allowance for Claude is used up; each run records which one it used. What such an agent is given to work with is sent to Anthropic to produce a response: for an agent in Messages, that is the thread it is working in, which can include what a customer wrote to your business.
- **Anthropic's Claude service:** website changes your company asks for, and the first draft of a new website built from your existing one (which can read your website's content).

Anthropic acts as our service provider. We do not allow it — or anyone else — to use your information to train AI models, and we do not use it that way ourselves. Agents are off unless your company turns them on, and an agent acts only within the permissions your company gives it. AI output can be wrong; your company reviews it before relying on it.

## Cookies {#cookies}

We use a small number of first-party cookies, and no advertising or analytics cookies:

- `__Host-hj` — your sign-in session for the app. Secure and not readable by scripts; it lasts up to 30 days and is removed when you sign out.
- `__Host-hjg` — only for a guest who joins a meeting from an invitation link. Secure and not readable by scripts; it lasts 35 minutes and is renewed while the guest is in the meeting.
- `hj_attr` — 90 days. Records how you first arrived at the website (a campaign tag or referring site) so a form you submit later is credited correctly. Set only when there is something to record.
- `hjkit` — 30 days, only on `/brand-kit`. Holds the access code for that one directory.

## Your activity in the app {#activity}

The hellojade app keeps a record of how it is used, so we can find what is slow or broken, fix it, and improve the app. It is kept in nine groups:

- **Sessions** — when you sign in and out, and when a session in a browser starts and ends.
- **Pages** — which pages you open, for how long, and what you search for inside the app.
- **Actions** — the records you create, change or delete, and the files you upload, open or download.
- **Security** — sign-ins, failed sign-ins, changes to who can access your company's account, and requests the app refused.
- **Experience** — the buttons and menus you use, the errors you run into, and how quickly pages load.
- **Attention** — whether the app is on screen or in the background, when you go idle, and how far down a page you scroll.
- **Work** — the records you open and how long you spend on them, and forms or drafts you leave unfinished.
- **Account** — the first time you use a feature, and how far you get through setting up.
- **Technical** — your kind of device and browser, your connection's type and speed, and when you go offline and come back.

**What we never record.** We do not record the text of your messages, emails, notes or documents, and we do not record passwords, codes or keys.

**Turning it off.** Recording is on when you start using the app, and accepting these terms at sign-up covers it. You can turn it off, and back on, at any time in **Account → Activity**. When it is off, nothing new is recorded about how you use the app, except the security events described below; what was already recorded stays until it is deleted.

**Session replay.** We do not make a replay of your screen today. If we add session replay — a masked reconstruction of the pages you saw, with everything you type replaced before it leaves your browser and message content never included — this policy will say so before it starts, and the app will show a visible indicator whenever a session is being recorded.

**Approximate location.** In this record we keep only a shortened form of your internet address: the first three of its four numbers, or the first three of the eight groups of a newer (IPv6) address. We never store your full internet address in this record, and we never use your device's own location. From that shortened address we work out an approximate place — a town or city at most, and only a region or a country when the block it belongs to covers more than one city; we never guess a city — and the name of the network provider, using the free IP to City Lite and ASN Lite databases: [IP Geolocation by DB-IP](https://db-ip.com), licensed under Creative Commons Attribution 4.0. It is only approximate: about half of such places are within 10 km of where you really are, and a mobile or shared network can show a different city altogether. Your company's owner and administrators see it on the Sessions page.

**How long it is kept.** Every group above is kept for as long as your company's hellojade account exists, and then as the [retention section](#retention) describes. There is no automatic expiry before then, for any group: it is deleted when you delete it yourself or ask us to. If that changes, this section will list each group's limit before the change takes effect.

**Who can see it.** You can ask us for your own record at any time. Your company's owner and administrators can see the sessions of the people in their account — the pages opened and the actions taken in each. hellojade staff can see it to give support; whenever a member of hellojade staff opens your company's records, that is itself recorded, and your company's owner can ask us for that log.

**Getting a copy, or having it deleted.** You can delete your own record yourself: in the app, open **Account → Activity** and choose **Delete my activity record**. It deletes what has been recorded about you in the company you are signed in to, straight away, once you type a word to confirm; if you belong to more than one company, do it in each. Recording carries on afterwards unless you have turned it off. For a copy of your record — or to have it deleted in a company you can no longer sign in to — email [go@hellojade.ai](mailto:go@hellojade.ai) from the address on your account and we will do it within 30 days. Two things are kept when your record is deleted: the record of your recording setting, and hellojade staff's own access log, because that belongs to your company rather than to us. A deletion leaves a note that it happened — when, for whom, and how many entries it removed — and nothing about what those entries said.

**Backups.** The record is not included in any backup of the server that stores it. Before each upgrade of the service that stores it, a copy is kept on that same server so a failed upgrade can be undone; each copy is deleted 14 days after it is made, and a deletion you ask for also deletes every copy made before it, within a day. Two small parts of the record also sit in the app's own database — your recording setting and, for a moment, activity on its way to the server that stores the rest. That database is backed up every day, encrypted, and each backup is kept for no more than 14 days. So 14 days after a deletion, no backup holds what was deleted.

**Security events.** Sign-ins, failed sign-ins, sign-outs, sessions that were ended, times you confirmed it was you, changes to who can access your company's account, and requests that were refused are recorded for every account, whether or not recording is turned on, because they protect it.

## Who your information goes to {#sharing}

- **Your company.** Anything you do inside a company's account is visible to the people in that account according to the roles its owner and admins set.
- **Us.** Uplevel's staff see what they need to run, support and secure the Service, and nothing more.
- **Our service providers**, each of which processes information only to provide its service to us:
  - **Vultr** — hosts our servers and stores our backups, in the United States;
  - **Stripe** — processes payments;
  - **Sinch** — carries text messages and calls;
  - **Google** — Business Profile, when you connect it, and push notifications to Chrome and Android browsers;
  - **Apple** and **Mozilla** — push notifications to Safari and Firefox browsers;
  - **Anthropic** — the Claude AI service used by the features the [AI section](#ai) names.
- **Nobody else.** We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We disclose it only when the law requires, to protect someone's safety or our rights, or if our business is sold or reorganized — in which case this policy continues to apply to it.

## How long we keep it {#retention}

- **While your company's account is open**, we keep its data for as long as the account exists. Messages, contacts, leads and files are business records; there is no automatic expiry for them, so they are removed when your company deletes them or asks us to.
- **After your company's account is canceled or closed**, we keep its data for **one year**, so it can be restored or exported if your company asks, and then we delete it. Copies in our backups are deleted as those backups age out.
- **Some records are kept longer** because the law or the agreement needs them: billing and tax records, and the record of who accepted our terms (see [the acceptance record](#acceptance)).
- **Google data** for an office you disconnect is deleted when you ask, as [its own section](#google) describes.
- Sign-in links expire after 15 minutes, and invitation links after 7 days; sessions after 30 days at most; push subscriptions when you remove them.

## How we protect it {#security}

Connections to the app are encrypted. Sign-in links work once, for 15 minutes, in the browser that asked for them; invitation links work once, for 7 days. Links are stored only as a one-way fingerprint, and so are session tokens. Every change the app makes on your behalf requires a signed-in session and a per-session security check, and sensitive changes ask you to confirm it is you. Our servers talk to each other over encrypted, mutually authenticated connections on a private network. Our application database is backed up daily, encrypted. Access is limited by role, and staff access to your company's records is itself recorded. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

## Your rights and choices {#rights}

Wherever you live in the United States, you can ask us what we hold about you, for a copy of it, for it to be corrected, or for it to be deleted. Email [go@hellojade.ai](mailto:go@hellojade.ai) from the address on your account and we will respond within 30 days, or sooner if the law where you live requires. We will not treat you differently for asking. You can also:

- turn activity recording off, and delete your own activity record, in **Account → Activity**;
- sign out sessions and remove passkeys in **Account**;
- disconnect a Google Business Profile on the office's Google page;
- turn push notifications off in your browser.

**State privacy rights.** Residents of some states — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — have rights under their state's privacy law, which can include the right to know, access, correct and delete personal information, to receive a portable copy, and to opt out of its sale, of sharing for targeted advertising, and of certain profiling. We do not sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. You may use an authorized agent; we may need to verify your identity, and the agent's authority, before acting. If we deny a request, you may appeal by replying to our answer, and we will respond to an appeal within the time your state's law allows. California residents: in the last 12 months we collected the categories of information described in this policy — identifiers, commercial information, internet or other electronic network activity, approximate location, audio (only where someone turned recording on) and professional information — for the business purposes described here, and disclosed them only to the service providers listed above.

**Information in your company's account.** Where your information is in a company's hellojade account — for example, as a lead or a contact — that company decides what its account holds, and we may pass your request to it.

## Children {#children}

hellojade is a service for businesses, used by people 18 or older. Neither the website nor the app is directed to children, and we do not knowingly collect information from anyone under 18. If you believe we have, tell us and we will delete it.

## Where your information is {#location}

hellojade is offered only in the United States, and we store and process information on servers in the United States.

## Changes to this policy {#changes}

Each version of this policy has a number and an effective date, and every version stays available at its own address. When we change it, the app will show each person a summary of what changed and ask them to accept the new version before they continue using the app.

## Contact {#contact}

Uplevel Digital Services, LLC, Naperville, Illinois, United States. Privacy requests: [go@hellojade.ai](mailto:go@hellojade.ai). General: [hello@hellojade.ai](mailto:hello@hellojade.ai). Phone: [(888) 667-5418](tel:+18886675418). See also the [Terms of Service](/terms).