Privacy Policy

Jennox ("we", "our", "us") is operated by Insightful Technologies LLC. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website at jennox.com and our SaaS platform services (collectively, the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our Service.

We are the data controller for personal data collected through our marketing website. For data processed through our platform on behalf of our customers (businesses), our customers act as the data controller and we act as the data processor.

Account & Registration Data — When you create an account, we collect your name, email address, company name, password (hashed), and billing information. For team members, we collect names and email addresses upon invitation.

Usage Data — We automatically collect information about how you interact with our platform: pages visited, features used, chatbot conversations initiated, session duration, IP address, browser type, device type, and referring URLs.

Customer Conversation Data — When your end-users interact with your deployed chatbot, we process the conversation content, visitor IP, browser metadata, and any lead information they provide (name, email, phone). This data is processed on your behalf as data controller.

Payment & Billing Data — Payments are processed by Stripe. We store only the last 4 digits of your card, billing address, and subscription status. We never store full card numbers.

Communications — If you contact us via email, support tickets, or our contact form, we retain those communications to resolve your inquiry and improve our service.

We use your information to:

• Provide, operate, and maintain the Service
• Process transactions and send billing-related communications
• Send product updates, security alerts, and support messages
• Improve and personalize your experience through analytics and A/B testing
• Train and improve our AI models using anonymized, aggregated conversation data (never individually identifiable)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Send marketing communications — only with your explicit consent, and you may opt out at any time

We do not sell your personal data to third parties. We do not use your data for advertising targeting on other platforms.

We share your data only in the following circumstances:

Service Providers — We use carefully vetted third-party vendors to operate our Service: Stripe (payments), Amazon Web Services (cloud infrastructure), MongoDB Atlas (database), Resend (transactional email), and Sentry (error monitoring). Each vendor is bound by data processing agreements.

Business Transfers — In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

Legal Requirements — We may disclose your information if required by law, court order, or to protect our rights, property, or the safety of our users.

With Your Consent — We may share your data for any other purpose with your explicit prior consent.

We use cookies and similar tracking technologies to track activity on our Service and retain certain information.

Essential Cookies — Required for the Service to function (authentication session, security tokens). Cannot be disabled.

Analytics Cookies — Help us understand how users interact with our platform. We use privacy-respecting analytics (no Google Analytics on authenticated pages).

Preference Cookies — Remember your settings (theme, language, notification preferences).

You can control cookies through your browser settings. Disabling non-essential cookies will not affect your ability to use the core Service.

We implement industry-standard security measures to protect your data:

• All data transmitted using TLS 1.2+ encryption (HTTPS everywhere)
• Passwords hashed using bcrypt with salt rounds
• API secrets stored using SHA-256 one-way hashing — never stored in plaintext
• Database encrypted at rest using AES-256
• Access controls with role-based permissions and audit logging
• Regular security audits and penetration testing
• SOC 2 Type II compliance process underway

Despite our best efforts, no method of electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication when available.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under GDPR:

• Right to Access — Request a copy of the personal data we hold about you
• Right to Rectification — Request correction of inaccurate personal data
• Right to Erasure — Request deletion of your personal data ("right to be forgotten")
• Right to Restriction — Request restriction of processing in certain circumstances
• Right to Portability — Receive your data in a structured, machine-readable format
• Right to Object — Object to processing based on legitimate interests or for direct marketing

To exercise any of these rights, contact us at contact@jennox.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: retained while account is active + 90 days after deletion request
• Conversation data: retained per your subscription plan settings (default 12 months, configurable)
• Billing records: retained for 7 years as required by financial regulations
• Audit logs: retained for 24 months
• Anonymized, aggregated analytics: retained indefinitely

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information without parental consent, please contact us immediately and we will take steps to remove such information.

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. For material changes, we will send an email notification to registered users with reasonable notice before the change takes effect.

Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy team: