# Jooles Privacy Policy Effective date: 14 July 2026 This policy explains how Baguette Studios Ltd handles personal information when you use Jooles, including the Jooles web app, browser extension, mobile apps and related services. ## Who we are Baguette Studios Ltd is the controller of your personal information. - Company number: 15856772 - Registered in: England and Wales - Registered office: 13 Vale Road, Ash Vale, Aldershot, England, GU12 5HH - Privacy enquiries and rights requests: privacy@jooles.dev - Security reports: security@jooles.dev - General support: support@jooles.dev ## What Jooles does Jooles helps you organise job opportunities and applications, keep career information and supporting documents, create draft application materials, receive application-related email, and assist you with job application forms. Jooles does not apply for jobs or submit forms on your behalf. ## Information we collect We collect information in the following categories. ### Account and profile information This includes your email address, display name, authentication records, locale, timezone, preferences, onboarding state and account-security information. ### Career and application information This includes employers, roles, job descriptions, application URLs, application status and history, tasks, notes, recruiter details, interview information and other records you add to your application pipeline. ### Documents and other content you provide This may include CVs, cover letters, job descriptions, certificates, transcripts, project descriptions, screenshots, images, pasted text, email content and email attachments. These materials may contain information about employment, education, qualifications and other matters that you choose to include. Please avoid providing special-category information unless it is genuinely needed for your use of Jooles. ### Information produced from your content To provide search, organisation and drafting features, we may create document previews, rendered page images, text sections, embeddings, evidence references, structured profile facts, suggested application updates, draft answers and generated materials. We also keep processing status and limited technical metadata about these operations. ### Browser extension information When you activate the extension on a page, it may process the page address and host, page title, visible job or application-form content, form labels and questions, and answers you choose to save. It also stores short-lived application-flow state in extension storage. The extension suppresses protected and sensitive fields under its capture rules and does not click final submission controls. The extension requires access across websites because employers use many different recruitment and applicant-tracking domains. It does not use that access to build browsing histories, advertise to you or sell browsing information. Page information is processed only when needed for the extension's user-facing job-application features. ### Inbound email If you use a Jooles inbound address, we process the sender and recipient, subject, selected headers, message text, timestamps and attachments. We use this information to associate the message with your account and application records. ### Security and service information We process limited information needed to operate and protect Jooles, such as app and extension version, request timestamps, safe error codes, processing state, usage counts, authentication events, replay-protection values and audit records. We aim to keep operational logs free of document contents, form answers, email bodies and credentials. ## Where information comes from Most information comes directly from you. We may also receive information: - from pages on which you intentionally activate the browser extension; - from people or organisations that email an address you have chosen to use with Jooles; - from documents, job advertisements and other sources you upload or link; and - from service providers that help us authenticate users, host the service, process files, operate AI features, deliver email or distribute the app and extension. If you provide information about another person, you are responsible for making sure you are entitled to provide it. ## Why we use information and our lawful bases | Purpose | Lawful basis | | --- | --- | | Create and secure your account; provide the application tracker, document library, extension, email ingestion, search and drafting features you request | Necessary to perform our contract with you or take steps at your request before entering that contract | | Process documents and application information with AI when you request AI-assisted features | Necessary to perform our contract with you | | Protect accounts, prevent abuse, diagnose failures, enforce limits and maintain reliable services | Our legitimate interests in securing and operating Jooles, balanced against your rights | | Maintain essential accounting, corporate, dispute and compliance records | Compliance with legal obligations and, where applicable, our legitimate interests in establishing and defending legal claims | | Send service, security, privacy-request and account messages | Necessary to perform our contract, comply with legal obligations, or protect our legitimate security interests depending on the message | We do not rely on consent to provide core Jooles functionality. If we later introduce optional marketing, non-essential analytics or another activity that requires consent, we will ask separately and make withdrawal as easy as giving consent. ## AI-assisted features Jooles uses automated tools to organise sources, extract possible profile or application updates, create embeddings for search, suggest form answers and draft application materials. AI output can be incomplete or incorrect. You should review it before relying on it or sending it to an employer. Jooles does not make hiring decisions, assess your suitability on behalf of an employer, or make decisions that produce legal or similarly significant effects about you. We do not permit our AI providers to use your Jooles content to train general-purpose models where provider controls and contractual terms allow us to prevent that use. ## Who we share information with We share information only as needed to operate Jooles, comply with law, protect the service, or complete a transaction involving the business. Current provider categories include: - Convex, for authentication, backend functions and database services; - Cloudflare, for web delivery, Workers, inbound email routing and R2 object storage; - OpenAI and approved model infrastructure, for AI and embedding features you use; - Expo Application Services, Apple and Google, for app builds, updates, testing and distribution where applicable; and - professional advisers, authorities or counterparties where reasonably necessary for legal compliance, security, a corporate transaction, or the establishment or defence of legal claims. We do not sell personal information. We do not share it with advertising networks or data brokers. We do not use it for personalised advertising. Human access to private content is restricted. Authorised personnel may access specific content only when you ask for support and consent to that access, when needed to investigate a security or abuse issue, when required by law, or after information has been aggregated and anonymised for internal operations. ## Chrome Web Store Limited Use disclosure Jooles's use and transfer of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use such information only to provide or improve Jooles's disclosed user-facing features and related security and reliability functions. ## International transfers We choose UK or European hosting and storage options where they are available and suitable. Some providers or their support personnel may process information outside the UK. Where UK data protection law treats this as a restricted transfer, we use an applicable adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer assessment. You can ask privacy@jooles.dev for more information about the safeguard relevant to a particular provider. ## How long we keep information We keep account and product information while your account is active and as needed to provide Jooles. More specific defaults are: - deleted sources and their directly derived content are removed through our deletion workflow; - privacy export files expire after 7 days; - account deletion has a 7-day cancellation period before destructive processing begins; - after account deletion, we retain a non-content deletion record for up to 12 months to evidence completion and handle disputes; - security and audit metadata is normally retained for no longer than 12 months; and - provider backups and security logs may persist for limited provider retention periods before being overwritten or deleted. We may retain limited information for longer where the law requires it or where reasonably necessary to establish, exercise or defend legal claims. We periodically review retention and aim to delete or anonymise information that is no longer needed. ## Your rights Depending on the circumstances, UK data protection law gives you rights to: - receive information about how we use your information; - obtain a copy of your information; - correct inaccurate or incomplete information; - ask us to delete information; - restrict how we use information; - receive information you provided in a portable format; - object to processing based on legitimate interests; and - complain to a data protection regulator. You can use Jooles's account controls or email privacy@jooles.dev. We may need to verify your identity. Rights are not absolute, and if an exemption applies we will explain our decision. You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern first, but you do not have to contact us before the ICO. ## Security We use technical and organisational safeguards designed to protect personal information, including encrypted network connections, access controls, environment separation, scoped service credentials, signed service requests and deletion workflows. No internet service can guarantee absolute security. Please contact security@jooles.dev promptly if you believe your account or information is at risk. ## Cookies and local storage Jooles uses browser or device storage where necessary for authentication, security, preferences and short-lived extension workflow state. We do not currently use advertising cookies or third-party behavioural advertising. We will introduce a consent control before using non-essential cookies or similar technologies where consent is required. ## Children Jooles is intended for people aged 18 or over and is not directed to children. If you believe a child has provided information to Jooles, contact privacy@jooles.dev. ## Changes to this policy We may update this policy when Jooles or the law changes. We will post the updated policy with a new effective date and give additional notice when a change materially affects how we use personal information. ## Contact Privacy questions and rights requests should be sent to privacy@jooles.dev or by post to Baguette Studios Ltd, 13 Vale Road, Ash Vale, Aldershot, England, GU12 5HH.