Privacy policy

Jori is provided by Vedin Labs AB, organization number 556512-5449, Braxenvägen 12, 181 30 Lidingö, Sweden. Contact support@usejori.com about privacy or your personal data. This policy covers the Jori service we host; a self-hosted Jori is run by whoever hosts it.

We are responsible for personal data we use to run our website, manage accounts and billing, provide support and protect Jori. When a customer directs how we process personal data in their workspace, we process it on their behalf under our Data Processing Agreement. If your employer provides your workspace, contact them about their use of your data. We will help them respond.

We also process the chats, files, instructions and connected-service content you give Jori access to. This can include other people's names, contact details, messages and documents. Jori uses that information to carry out your work, produce responses and maintain workspace history. It comes from you, people in your workspace, services you connect and public sources used for your tasks.

Required account and payment information is needed to provide the relevant service. Connecting other services and providing task content is your choice, but some features need that access to work.

We use turbopuffer to make workspace content searchable by name and meaning. It receives search queries and stores an index of resource titles, extracted text and metadata identifying resources and who can access them. It also creates and stores numerical representations of text, called embeddings, to find related content. Jori checks your current access before returning results.

Search indexes are stored in your workspace's EU or US region. Embedding inference is configured for the same EU or US geography. turbopuffer's embedding providers do not train on these inputs or retain them beyond the request; the stored search index remains subject to our workspace retention and deletion rules. See the provider list for details.

You choose which services to connect and approve their access permissions. Depending on those permissions, Jori can read messages, documents, code, tickets and calendar events, and create or update content when you instruct it. For Gmail this includes reading email, preparing drafts and sending messages. For Google Calendar it includes reading calendars and managing events.

Relevant task content is sent to the AI and infrastructure providers needed to complete your request. A web query, a page URL or a sandbox task may itself contain personal information. Disconnecting a service stops future access; it does not automatically erase information already copied into Jori.

We do not use your workspace content to train general-purpose AI models. Our model routing requests providers that prohibit training and offer zero data retention. Other processing, including image safety checks and service logs, can have separate retention rules.

Google API data is used only for the connected features you request. We do not sell it, use it for advertising or use it to train general-purpose AI models. Our use and sharing of Google API data follow Google's API Services User Data Policy, including its Limited Use requirements. Human access to that data is limited to the circumstances those requirements permit, such as your explicit permission to investigate a support issue or a security investigation.

We use providers for hosting, storage, AI processing, code execution, search, page fetching, email, analytics and payments. The provider list identifies them and their purposes. Providers receive the information needed for their work. Some, including payment providers, also use information for their own legal obligations under their privacy notices.

Workspace members and people you share with receive the content your sharing settings allow. Connected services and recipients receive information when Jori carries out your instructions. Their own privacy terms apply to their copies.

We may disclose information where legally required, to protect rights and security, or during a business transfer subject to applicable protections. Google data remains subject to the additional restrictions above.

Your selected EU or US region determines Jori's workspace storage and regional tool configuration. Page fetching and billing use global services. Hosting edge services, provider administration, support and operational processing can also involve locations outside your selected region.

Where personal data is transferred outside the EEA, the relevant transfer must have a lawful basis, such as an adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact us for information about the safeguards that apply to your data and how to obtain a copy.

We keep workspace content while your subscription is active. After cancellation takes effect, we retain the workspace for 90 days and give notice before deletion. You can request earlier deletion or a copy of your content through support. Deleting a workspace does not delete your account or content in other workspaces.

We keep account details while needed to provide your account. We keep support and access inquiries while handling them and for as long as reasonably needed to resolve follow-up issues or disputes. Security records are kept as needed to investigate incidents and protect the service. We restrict any information retained for a specific legal obligation or claim to that purpose.

Accounting records are kept for seven years after the end of the calendar year in which the relevant financial year ended. This does not require keeping your chats or files. Deleted information may remain in provider backups until their normal deletion cycle completes; it must remain protected and cannot be used to restore ordinary access. Contact us for the retention details relevant to a particular provider or data category.

Essential browser storage keeps sign-in and basic settings working. Optional PostHog analytics starts only if you accept it. It records which pages you open and which features you use, under pseudonymous identifiers. It never records names, chats, files, instructions or anything else you write. Your choice is remembered for each data region for 180 days, on usejori.com and that region's site alike. Use Privacy choices in the website footer, sign-in page or account menu to change it. Declining does not limit Jori.

Contact support@usejori.com to request access, correction, deletion, restriction or a portable copy of your personal data. You can object to processing based on legitimate interests and withdraw consent at any time without affecting earlier lawful processing. The rights that apply depend on the circumstances. We may need enough information to verify your identity and locate your data.

You can complain to the Swedish Authority for Privacy Protection, IMY, or your local data protection authority. You do not need to contact us first.

Jori assists with work. We do not use it to make solely automated decisions about you that have legal or similarly significant effects.

Jori is intended for people aged 18 or older. Contact us if you believe a child has provided personal data so we can investigate and remove it where appropriate.

We will date updates to this policy and notify you of material changes where required. A change to this policy does not replace consent where consent is needed.