Jeeym global privacy notice

This Privacy Notice applies to all global individuals who interact with Jeeym digital touchpoints, including our public websites, community forums, developer portals, customer support channels, webinars, and commercial applications.

To provide complete legal clarity, our role under international data protection laws (such as the EU/UK General Data Protection Regulation and the Saudi Personal Data Protection Law) depends directly on the context of data collection:

1. Jeeym as Data Controller: When you visit our public marketing websites, create an administrative evaluation account, contact sales, subscribe to our newsletters, or provide payment details for a commercial subscription, Jeeym acts as an independent Data Controller (or 'Business' under the CCPA/CPRA). In this capacity, we determine the legitimate business purposes and technical means of processing.

2. Jeeym as Data Processor: When you access Jeeym through a corporate, educational, or governmental workspace domain (for instance, [email protected]), your employer or licensing organisation acts as the Data Controller. In this capacity, your organisation governs user accounts, retention settings, and permission boundaries. Jeeym acts strictly as a Data Processor (or 'Service Provider') processing Customer Content exclusively under the instructions established in our Customer Terms of Service and Data Processing Agreement (DPA).

We collect personal information across three transparent streams: information you voluntarily provide, information generated automatically during service utilization, and limited information received from authenticated third-party integrations.

• Account registration & profile data: Full name, professional email address, telephone number, business postal address, job title, department, organization name, profile image, hashed password credentials, and multi-factor authentication (MFA) verification tokens.
• Commercial & billing records: Corporate billing entity name, VAT/tax identification numbers, corporate credit card or ACH banking tokens (securely processed via PCI-DSS Level 1 payment processors), transaction history, and contract identifiers.
• Customer content: Workspace emails, email attachments, real-time messaging logs, audio and video call streams, automated meeting transcription summaries, calendar events, drive file repositories, spreadsheets, documents, presentations, task lists, and enterprise directory metadata.
• Technical & device telemetry: Internet Protocol (IP) address, unique device identifiers (UUID), browser user-agent string, hardware specifications, screen resolution, operating system version, mobile network carrier, language preferences, and time zone offsets.
• Performance & diagnostic logs: API endpoint latency, crash stack traces, page rendering durations, feature engagement metrics, network connection stability indicators, and security authentication challenge outcomes.
• Customer support correspondence: Technical issue descriptions, diagnostic console logs, ticket attachments, and recorded customer service communications submitted to our support engineering team.
• Identity federation (SSO) ingestion: User identity claims transmitted via SAML 2.0 or OpenID Connect (OIDC) through identity providers including Okta, Microsoft Entra ID (Azure AD), Google Workspace, and Ping Identity.

Under the GDPR (Article 6), UK Data Protection Act, Saudi PDPL, and comparable international data privacy frameworks, every processing operation conducted by Jeeym as a Data Controller is justified by an established lawful basis:

• Performance of a contract (GDPR Art. 6(1)(b)): Processing necessary to deliver the workspace services you or your employer contracted to receive, authenticate sessions, process recurring billing, and provide customer support.
• Legitimate business interests (GDPR Art. 6(1)(f)): Processing required to protect the integrity and resilience of our cloud infrastructure, detect and mitigate zero-day cyber threats, prevent fraudulent registrations, and debug platform latency, provided our interests do not override your fundamental rights.
• Compliance with legal obligations (GDPR Art. 6(1)(c)): Processing mandated by applicable statutory provisions, including maintaining commercial accounting ledgers, fulfilling corporate tax filing requirements, and complying with valid judicial court orders.
• Consent (GDPR Art. 6(1)(a)): Where statutory frameworks mandate explicit affirmative consent, such as the activation of non-essential analytical cookies, elective marketing subscriptions, or participation in voluntary product advisory councils. You maintain the absolute right to revoke consent at any time.

We utilize personal information strictly for legitimate, declared commercial purposes. Under no circumstances do we repurpose personal data for unrelated commercial ventures.

Primary operational purposes include:

• Provisioning & operations: Authenticating legitimate users, provisioning multi-tenant workspace environments, routing high-throughput email exchanges, and delivering collaborative workspace applications.
• Infrastructure reliability & scaling: Monitoring microservice availability, managing database sharding, balancing global edge traffic, and optimizing CDN caching across regional server nodes.
• Platform security & threat neutralization: Identifying automated credential stuffing attacks, preventing distributed denial-of-service (DDoS) attempts, quarantining phishing emails, and blocking ransomware vectors.
• Administrative & security notifications: Delivering mandatory security advisories, system maintenance schedules, password reset tokens, MFA verifications, and contractual billing invoices.
• Customer support & dispute resolution: Investigating reported application defects, diagnosing telemetry traces, and verifying Service Level Agreement (SLA) uptime compliance.

Jeeym integrates state-of-the-art generative language and multimodal models directly into our core product applications to power automated email drafting, meeting transcript summarisation, formula synthesis, document generation, and intelligent semantic enterprise search.

We govern our AI architecture around uncompromised enterprise privacy and tenant isolation:

1. Zero Multi-Tenant Model Training: Jeeym NEVER utilizes Customer Content—including emails, chats, documents, spreadsheets, meeting transcripts, code, or prompts—to train, retrain, fine-tune, or align public or foundation models made accessible to other customers or external parties.

2. Ephemeral Context Execution: Prompts and retrieved workspace context snippets are processed in stateless, ephemeral inference clusters. Once the inference cycle completes and the output response is delivered to the user, prompt tokens are permanently purged from model inference memory.

3. Permission-Aware Context Retrieval: Jeeym AI enforces exact user-level Access Control Lists (ACLs). If an individual user does not possess native read permissions for a specific confidential document or private team chat, Jeeym AI will strictly refuse to access, synthesize, or reference that asset in its responses.

4. Administrative Sovereignty: Workspace administrators retain granular control to enable, restrict, or disable Jeeym AI functionality globally across the entire tenant or selectively for specific security groups or departments.

We do not sell personal information or customer content. We do not engage in cross-context behavioural advertising. We share personal information exclusively within the controlled frameworks described below:

1. Authorised Subprocessors & Infrastructure Vendors: We engage vetted enterprise infrastructure providers who perform specialized operations on our behalf (such as AWS for compute and KMS encryption, Cloudflare for global CDN and DDoS mitigation, Stripe for PCI-DSS payment settlement, and SendGrid for administrative emails). All subprocessors are subject to strict Data Processing Agreements requiring them to process data solely according to our written instructions.

2. Workspace Administrators: In corporate accounts, your designated workspace administrators can access audit trails, export mailbox archives, inspect login locations, and manage directory configurations.

3. Corporate Restructuring: In the event of a merger, acquisition, corporate reorganization, or sale of substantial platform assets, personal data may be transferred to the acquiring entity subject to the continuing obligations of this Privacy Notice.

4. Compelled Legal Disclosures: We will only disclose personal data in response to a valid court order, subpoena, search warrant, or binding statutory mandate issued by a court of competent jurisdiction. We examine every legal request for procedural validity, challenge overbroad subpoenas, and notify the affected customer prior to disclosure unless strictly prohibited by criminal statute or judicial gag order.

Jeeym operates global cloud infrastructure engineered to respect regional data sovereignty. During onboarding, enterprise organisations select the primary geographical region where their Customer Content, database instances, and encryption keys are housed.

Available deployment regions include: North America (US East & US West), the European Union (Frankfurt & Dublin), the United Kingdom (London), and the Middle East (dedicated sovereign nodes in Riyadh, Kingdom of Saudi Arabia, and Dubai, UAE).

Where personal data is transferred across international borders, Jeeym ensures appropriate safeguards pursuant to Chapter V of the GDPR and equivalent international statutes:

• European Commission Standard Contractual Clauses (SCCs) governing transfers between EU/EEA and non-adequate jurisdictions.
• The UK International Data Transfer Addendum (IDTA) approved by the Information Commissioner's Office (ICO).
• Adequacy decisions rendered by the European Commission, UK Secretary of State, and regional sovereign data authorities.
• In-country data residency guarantees for enterprise customers opting for isolated Sovereign Cloud deployments.

Jeeym maintains comprehensive administrative, technical, and physical security measures engineered to protect personal information against accidental loss, unauthorized access, destruction, or alteration:

1. Encryption in Transit: All data entering and traversing the Jeeym network is encrypted using Transport Layer Security (TLS 1.3 / TLS 1.2) utilizing robust cipher suites with forward secrecy.

2. Encryption at Rest: Customer Content and database volumes are encrypted using Advanced Encryption Standard with 256-bit keys (AES-256). Enterprise customers may also supply Customer-Managed Encryption Keys (CMEK / BYOK) hosted in their own Cloud HSMs.

3. Identity & Access Controls: Principle of Least Privilege (PoLP), mandatory Multi-Factor Authentication (MFA), Single Sign-On (SSO/SAML), and time-limited, audited Just-In-Time (JIT) access for engineering maintenance.

4. Independent Third-Party Audits: Jeeym undergoes annual SOC 2 Type II examinations and maintains third-party ISO/IEC 27001 (Information Security Management) and ISO/IEC 27701 (Privacy Information Management) certifications.

5. Coordinated Vulnerability Disclosure: We partner with independent global security researchers through an active vulnerability disclosure and bug bounty program to discover and remediate threats proactively.

We retain personal data only for the duration necessary to fulfill the purposes for which it was collected, satisfy customer contractual requirements, or comply with statutory accounting and legal obligations.

Our standard retention policies operate as follows:

• Active Customer Accounts: Workspace content is retained for the active lifecycle of the enterprise subscription, subject to custom retention schedules configured by workspace administrators.
• Deprovisioned User Accounts: When an administrator suspends or removes an individual employee account, that user's content remains preserved within the tenant according to the organization's archiving policies until tenant-level deletion is requested.
• Terminated Workspaces: Upon expiration or termination of an enterprise agreement, the customer has a thirty (30) day transition grace period to export all workspace data. At the conclusion of the grace period, all Customer Content is permanently deleted and overwritten across production databases within ninety (90) days.
• System Diagnostic Logs: Application access logs, network telemetry, and IP audit trails are rotated and permanently purged after thirty (30) to ninety (90) days.
• Financial & Invoicing Records: Invoices, payment confirmations, and tax filings are retained for seven (7) years to satisfy statutory commercial compliance mandates.

Regardless of your geographic location, Jeeym provides robust mechanisms allowing you to control and exercise your fundamental privacy rights:

• Right of Access: You have the right to request confirmation of whether we process your personal data and to receive a structured copy of that data.
• Right to Rectification: You may request the correction of inaccurate, obsolete, or incomplete personal data recorded in your profile.
• Right to Erasure ('Right to be Forgotten'): You may request the permanent deletion of personal data when it is no longer required for the purpose for which it was collected.
• Right to Data Portability: You have the right to receive Customer Content and profile information in a structured, commonly used, machine-readable format (JSON/CSV/standard Mbox).
• Right to Restrict or Object to Processing: You have the right to object to processing grounded in legitimate interests or direct commercial communications.
• Right to Withdraw Consent: Where processing relies upon voluntary consent, you may withdraw that consent at any time without adverse repercussions.

1. California Notice (CCPA / CPRA): In the preceding twelve (12) months, Jeeym has not sold personal information, nor has it shared personal information for cross-context behavioral advertising. California residents have the right to know, delete, correct, and be free from discriminatory treatment for exercising privacy rights. Requests can be submitted via [email protected].

2. European Union & United Kingdom Notice: European individuals have the right to lodge a formal complaint with their national Supervisory Authority (such as the CNIL, BfDI, DPC, or the UK Information Commissioner's Office) if they believe their data protection rights have been infringed.

3. Middle East Notice (Saudi Arabia PDPL & UAE DPL): Pursuant to the Saudi Personal Data Protection Law (Royal Decree M/19) and UAE Federal Decree-Law No. 45/2021, data subjects possess statutory rights to be informed, access, request destruction, and withdraw consent. Jeeym maintains dedicated sovereign hosting infrastructure in compliance with regional cybersecurity and data localization frameworks.

When you interact with our websites, we use cookies and HTML5 local storage tokens to preserve session integrity, authenticate logins, and measure page performance.

We do not use tracking pixels, ad networks, or third-party behavioral trackers within authenticated workplace applications. For complete details on managing cookie categories and configuring your browser preferences, please review our standalone Cookie Policy at /legal/cookies.

Jeeym is an enterprise productivity and business collaboration platform. Our websites and cloud services are not directed toward children under sixteen (16) years of age (or eighteen (18) years in jurisdictions with higher ages of majority).

We do not knowingly collect, solicit, or maintain personal information from children. If we become aware that a child under the relevant age has provided personal information without verified parental or institutional consent, we will promptly delete that data from our production systems.

We review and update this Global Privacy Notice periodically to reflect modifications in our service features, emerging technologies, or evolving legal requirements. When material changes occur, we will provide conspicuous advance notice through our website, in-app administrative notifications, or via email to registered administrators prior to the effective date.

For any inquiries, feedback, or formal legal requests concerning this notice or our privacy practices, please contact our Data Protection Officer:

Email: [email protected] | DPO Direct: [email protected]

Postal Address: Jeeym Inc., Attn: Data Protection Office & Legal Affairs, 500 Howard Street, Suite 400, San Francisco, CA 94105, United States of America.

Regional Office (EMEA & Middle East): Jeeym Global Technologies Ltd., Attn: Privacy Compliance, 1 Canada Square, Canary Wharf, London E14 5AA, United Kingdom.