Privacy Policy

1. Introduction

Ajooni AI, LLC (“Ajooni AI,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and services (the “Service”), available on the web and on mobile browsers, including as an installable web app (PWA), with native mobile and desktop apps coming soon.

Please read this Privacy Policy carefully and ensure that you understand it. Your first use of the Service is deemed acceptance of Ajooni AI's Privacy Policy. If you do not accept and agree with this Privacy Policy, you must stop using the Service immediately.

We may change this Privacy Policy from time to time. Any changes will be immediately posted on Ajooni AI's website. We recommend that you check this page regularly to keep up to date. Do not continue to access or use the Service if you do not agree to the updated Privacy Policy.

This Privacy Policy should be read alongside our Terms of Service.

2. Scope

This Privacy Policy applies only to your use of Ajooni AI's website and Service. The Service may contain links to other websites. Please note that we have no control over how your personal data is collected, stored, or used by other websites, and we advise you to check the privacy policies of any such websites before providing any personal data to them.

3. Personal Data

Personal data means any and all data that relates to an identifiable person who can be directly or indirectly identified from that data, or, under certain privacy regulations, a natural person's household.

4. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• The right to be informed about Ajooni AI’s collection and use of your personal data.
• The right of access to the personal data that Ajooni AI holds about you (please contact us using the details in Section 22).
• The right to correct any personal data we hold about you if it is inaccurate or incomplete (please contact us using the details in Section 22).
• The right to be forgotten (i.e., the right to ask Ajooni AI to delete your personal data).
• The right to restrict (i.e., prevent) the processing of your personal data.
• The right to data portability (obtaining a copy of your personal data to reuse with another service or organization).
• The right to object to Ajooni AI’s use of your personal data for particular purposes. In certain circumstances, we may not be able to stop using your personal data; if that is the case, we will let you know why.
• If your data is provided to a third party for any reason, you may, in certain jurisdictions, have a legal right to know what data was shared, with whom, and for what purpose.

If you have any cause for complaint about Ajooni AI's use of your personal data, please contact us using the details provided in Section 22, and we will do our best to resolve the issue for you.

5. Personal Data Collected by Ajooni AI

Depending upon your use of Ajooni AI's Service, we may collect some or all of the following personal data (please also see Section 11 on Ajooni AI's use of cookies):

• Name
• User account name and password
• Email address
• Business or company name
• IP address
• Billing information that you may provide
• Organization name (if you create or join an organization)

Depending upon the Service that you have requested, you may provide other identification data.

5.1 Information You Provide to Us

The information we collect on or through our website may include:

• Information that you provide by filling in forms or inputting data on our website.
• Records and copies of your correspondence, if you contact us.
• Details of transactions you carry out with Ajooni AI and fulfillment of your orders.
• Your search queries on Ajooni AI’s website.

5.2 Account Information

When you create an account, we collect your name, email address, password, and organization name. We also collect your IP address for security purposes (rate limiting, fraud prevention). Billing information is collected and processed exclusively by Stripe.

5.3 Google Account Information

If you sign in or link your account with Google OAuth 2.0, we receive your Google profile information (name and email address) as authorized by your Google account permissions.

5.4 Payment Information

Payment card details are collected and processed exclusively by Stripe, our PCI-DSS-compliant payment processor. We do not store your credit card numbers, expiration dates, or CVV codes on our servers. We receive only anonymized payment confirmation and subscription status information from Stripe.

5.5 Usage Data

We collect aggregated usage data to improve our services, including:

• Number of documents processed
• Feature usage statistics
• Storage quota usage

We also use Google Analytics, a third-party analytics service, to understand how visitors use our website and application in aggregate — for example, which pages are viewed, which features are used, and general device type and approximate location (derived from IP address). Google Analytics measures behavior only; it does not have access to your documents or the data contained within them. See Section 12 for more information.

5.6 Contact Requests

When you submit our contact form, we store the details you provide — your name and email, your message, and any optional business name, phone number, industry, or team size — so we can respond to and follow up on your inquiry. This information is separate from your documents (see Section 6) and is retained only as long as needed to handle your request.

5.7 Information We Do Not Collect

We use Google Analytics to measure aggregate usage of our website and application (see Sections 5.5 and 12); it never has access to your documents or their contents. Apart from this, we do not perform device fingerprinting, we do not use advertising or cross-site tracking services, we do not sell your personal information, and we do not collect personal information beyond what is described in this Privacy Policy.

6. Document Processing and Storage

6.1 Privacy-First Approach

Ajooni AI is built on a privacy-first philosophy. We do not store your documents on our servers. Documents you scan or upload are processed temporarily in memory for AI extraction and analysis, then immediately transferred to your selected storage location and permanently deleted from our systems (your data is not captured and stored).

6.2 Local Device Storage

When you choose local storage, documents are saved directly to your device's file system. We have no access to or control over documents stored on your local device. You are solely responsible for managing, backing up, and securing locally stored documents.

6.3 Cloud Storage (Google Drive & Dropbox)

When you choose Google Drive or Dropbox as your storage location, documents are transferred directly to your account with that provider. We do not copy, store, or retain those documents on our servers.

The two providers grant access differently, and we want to be exact about it. Google Drive: we request only the drive.file scope and use the Google Picker, so we can reach a file only after you create it with, or explicitly pick it in, Ajooni AI. Dropbox: we request full-account file access, because Dropbox has no equivalent per-file picker and this is what lets you browse your existing Dropbox and import files in one step. In practice we read only the files you select for import and the folder we create for you; we do not browse, index, or process the rest of your Dropbox. You can disconnect Dropbox at any time in Settings, which revokes that access.

Your use of Google Drive is subject to Google's Privacy Policy. Your use of Dropbox is subject to Dropbox's Privacy Policy.

6.4 Metadata

We may store limited metadata references such as file IDs, file names, and thumbnail previews to provide features like recent documents and storage management. This metadata does not include the actual content of your documents.

6.5 Google API Services User Data Policy (Limited Use)

Ajooni AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We request only the drive.file scope, which grants access exclusively to files you create with, or explicitly open in, Ajooni AI. We do not request access to your full Google Drive, and we do not use Google user data for advertising, sell it, or transfer it to third parties except as necessary to provide or improve the features you request, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice. Human access to this data is permitted only where you give explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized.

7. How We Use Your Information

All personal data is processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with our obligations and safeguard your rights.

Our use of your personal data will always have a lawful basis, either because it is necessary for our performance of a contract with you, because you have consented to our use of your personal data (e.g., by subscribing to emails), because it is in our legitimate interests, or for the establishment, exercise, or defense of legal claims. Specifically, we may use your data for the following purposes:

• Providing and managing your access to Ajooni AI’s Service.
• Personalizing and tailoring your experience on the Service.
• Supplying our products and services to you (please note that we require your personal data in order to enter into a contract with you).
• Replying to emails from you.
• Supplying you with emails that you have opted into (you may unsubscribe or opt out at any time by clicking the unsubscribe link at the bottom of any of the emails).
• Fulfilling any other purpose for which you provide it.
• Carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us, including for billing and collection.
• Notifying you about changes to any products or services we offer or provide.
• In any other way we may describe when you provide the information.
• Analyzing your use of the Service and gathering feedback to enable us to continually improve the Service and your user experience.
• Authenticating your identity, managing your account, and delivering core functionality.
• Processing payments and managing subscriptions and billing through Stripe.
• Detecting, preventing, and addressing fraud, abuse, and technical issues.

8. Sharing of Personal Information

Ajooni AI does not share customer personal information with anyone within or across national boundaries without the explicit, affirmative, written consent of the person to whom it relates. You will need to opt in before any such action is undertaken.

Exceptions to this rule may exist as permitted by law or for internal administration and operations or for other reasonable and valid business purposes referred to in this Policy. Ajooni AI personnel are required to obtain advice from legal counsel before sharing or transferring such information.

The sharing of customer personal information requires precautions that are more elaborate than the sharing of non-personal information. Customer personal information must be protected with security and confidentiality measures that are more stringent and more comprehensive than those for non-personal information.

When Ajooni AI shares customer personal information with a third party, in addition to the general requirements that apply to non-personal information, Ajooni AI will:

• Specifically identify in writing to the third party that the information is the customer’s property.
• Require that the third party limit access to the personal information only to those of its personnel with a “need to know.”
• Require that the third party protect the personal information with the same confidentiality and security measures as those that it uses for “highly confidential” information or data.

We do not sell, trade, or share your personal information with third parties for marketing purposes. Information is shared with third-party services only as necessary to provide the Service as described above.

However, we may share your personal data—including each category of personal data described above—with third-party service providers to: (a) provide you with the Services that we offer through our website; (b) process payments; (c) conduct quality assurance testing; (d) facilitate creation and maintenance of accounts; (e) collect and analyze data; (f) provide technical support; or (g) provide specific business services, such as synchronization with other software applications and marketing services. These third-party service providers are required by written agreement not to retain, use, or disclose your personal data other than to provide the services requested by us.

Some services are performed by authorized independent contractors rather than employees. They are bound by the same written confidentiality, data-minimization, and deletion obligations as our personnel, and may access your content only where you have separately authorized it in writing — for example, by requesting optional White-Glove onboarding assistance. You may decline or revoke that access at any time without losing access to the Service.

9. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
• Secure authentication: OAuth 2.0 for Google sign-in, Argon2 password hashing, and support for two-factor authentication (TOTP).
• Secure token storage: HTTP-only cookies on the web; encrypted native storage on mobile (Capacitor Preferences) and desktop (Tauri Store).
• CSRF protection: Cross-site request forgery protection on all authenticated endpoints.
• Rate limiting: Protection against brute-force attacks on login and signup endpoints.
• Account lockout: Automatic account lockout after repeated failed authentication attempts.

While we use commercially reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Data Retention

10.1 Account Data

We retain your account information (email, name, organization) for as long as your account is active. If you delete your account, we will delete your personal data from our servers within a reasonable timeframe, except where we are required by law to retain it.

10.2 Documents

We do not retain your documents. Documents are processed temporarily in memory and immediately transferred to your chosen storage location. No copies are kept on our servers.

10.3 Usage Data

Aggregated, anonymized usage data may be retained for analytical purposes. This data is not personally identifiable.

10.4 Data Location

Ajooni AI's Service is hosted in the United States and is governed by United States law. If you are using the Service from outside the United States, please be aware that your personal data will be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. By using the Service and submitting personal data to us, you consent to this transfer.

11. Cookies and Local Storage

11.1 Authentication Cookies

On the web platform, we use HTTP-only cookies solely for authentication purposes (storing access and refresh tokens). These cookies are essential for the Service to function and cannot be disabled while using the Service.

11.2 Analytics Cookies

We use Google Analytics, which sets first-party cookies containing a randomly generated identifier to measure aggregate usage (such as pages viewed and session counts). These analytics cookies do not access your documents and are not used to build advertising profiles. We ask for your consent before loading Google Analytics — you can decline, in which case no analytics cookies are set — and we automatically honor Global Privacy Control signals sent by your browser. You can also opt out using the Google Analytics Opt-out Browser Add-on. We do not use cookies for advertising, and we do not use any third-party cross-site tracking cookies.

11.3 Mobile and Desktop Storage

On mobile and desktop platforms, authentication tokens are stored using platform-native encrypted storage mechanisms rather than cookies. No sensitive data is stored in browser localStorage.

12. Third-Party Services

We integrate with the following third-party services, each with their own privacy policies:

• Google (OAuth and Drive)

  Used for authentication and optional cloud document storage. Subject to Google's Privacy Policy.

• Dropbox

  Used for optional cloud document storage when selected as your storage provider. Subject to Dropbox's Privacy Policy.

• Stripe

  Used for payment processing and subscription management. Subject to Stripe's Privacy Policy.

• Backblaze B2

  Used to store profile pictures you choose to upload. Your documents are never stored there. Subject to Backblaze's Privacy Policy.

• Resend

  Used to send transactional email such as verification codes, notifications, and receipts. Resend receives the recipient address and the contents of that message only. Your documents are never sent to it. Subject to Resend's Privacy Policy.

• Google Gemini API

  Used for AI-powered document classification, data extraction, and analysis. Documents are sent to Google’s API temporarily for processing only. Subject to Google's Privacy Policy and AI Terms of Service. Google does not use data submitted through the API to train its models.

• Google Cloud Vision API

  Used for optical character recognition (OCR) to extract text from uploaded documents. Documents are sent to Google’s API temporarily for processing only. Subject to Google's Privacy Policy and Cloud Terms of Service.

• Google Analytics

  Used to measure aggregate website and application usage (pages viewed, features used, approximate location and device type). It does not access your documents or their contents. Subject to Google's Privacy Policy and How Google uses data. You can opt out via the Google Analytics Opt-out Browser Add-on.

13. Children's Privacy

Ajooni AI is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe we may have collected information from a child under 18, please contact us immediately.

14. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from your country. By using the Service, you consent to the transfer of your information to such countries. We take steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

All the information you provide may be transferred or accessed by entities around the world. If you are located in the European Economic Area, Switzerland, or the United Kingdom, please be aware that the Service is hosted and operated in the United States. By using the Service, you consent to the transfer of your data to the United States. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

15. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: You can view and access your personal information through your account settings.
• Correction: You can update your account information at any time through your user settings.
• Deletion: You can request deletion of your account and associated data through your user settings.
• Data Export: You can request an export of your personal data through your user settings.
• Revoke Sessions: You can revoke all active sessions from your account settings for security purposes.

To exercise any of these rights, visit your account settings or contact us through the channels listed in Section 22.

16. For California Residents

California Civil Code Section 1798.83 permits users who are California residents to request certain information regarding our disclosure of personal information to third parties for such third parties' direct marketing purposes. If you are a California resident and would like to make such a request, please contact us at support@ajooni.ai.

With regard to the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), please be advised that Ajooni AI will not sell your data to any third parties. California law requires that we allow you to opt out of the sale of your personal information, which can be accessed by clicking the following link: Do Not Sell My Personal Information.

If you are a California consumer, you have the following rights under the CCPA:

A. Right of Access

Consumers have the right to request access to personal information, free of charge, twice per year. Upon receiving an access request, we must provide the necessary information in a portable and easily accessible format, normally within 45 days of the request, including: the categories of personal information collected; the categories of sources of the consumer's personal information; the business or commercial purpose for collecting or selling the consumer's personal information; the categories of any third parties with whom we share the consumer's personal information; and the specific pieces of personal information collected about the consumer.

B. Right to Deletion

Consumers have a right to request the deletion of personal information that we hold. However, this right does not apply where we need to retain the personal information in order to: provide goods or services to the consumer; detect or resolve security or functionality-related issues; comply with the law; conduct research in the public interest; safeguard the right to free speech; or carry out any actions for internal purposes that the consumer might reasonably expect.

C. Right to Non-Discrimination

Consumers have the right not to be discriminated against for having exercised their rights under the CCPA. In particular, we will not: deny you goods or services; charge you different prices; provide you with a different level or quality of goods or services; or threaten you with any of the above.

D. Right to Correct Data

Consumers have the right to request that we rectify any inaccuracies in the personal data we hold about you. Please contact us as noted below and we will assist you with your request.

E. Withdraw Consent

You have the right to withdraw consent to our processing of your personal data. This will not affect the processing already carried out with your consent.

F. Not to Be Subject to Decisions Based on Automated Processing

In some circumstances, you have the right not to be subject to decisions based solely on automated processing, and to obtain human review of any such decisions that significantly affect you.

G. Complaint

You have the right to lodge a complaint with the local authorized supervisory authority. However, we would appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us in the first instance.

H. Authorized Agents

Only you or an authorized agent (“Authorized Agent”) may make a verifiable consumer request related to your personal data. Your Authorized Agent may be any natural person or business entity registered with the Secretary of State of California that you have authorized to act on your behalf. When an Authorized Agent is submitting a request on your behalf, we require your Authorized Agent to provide evidence of their entitlement, which must include information sufficient to identify you and the purpose of the request, and at least one of the following:

• Written and signed permission designating the Authorized Agent to act on your behalf, along with verification of your identity directly with us.
• Evidence that you have provided the Authorized Agent with power of attorney pursuant to the California Probate Code.
• Proof that the Authorized Agent is a person or business entity registered with the California Secretary of State and that you have authorized such person or entity to act on your behalf.

Absent such documentation, we reserve the right to refuse to comply with third-party requests for information.

You may also make a verifiable consumer request on behalf of your minor child.

Consumers may only request access or data portability twice within a 12-month period. The verifiable request must contain sufficient information to allow us to verify that you are the person about whom the request pertains, and must describe your request in sufficient detail to allow us to understand, verify, and respond to it. We will only use the personal information provided with the consumer request to verify the consumer's identity.

17. For Residents of Colorado, Connecticut, Utah, and Virginia

For users residing in Colorado, Connecticut, Utah, or Virginia, you also have rights with respect to the personal data that Ajooni AI collects about you. In addition to the rights available to residents of California, if you are a resident of one of these states, you may also have the right to:

• Opt out of the processing of your personal data for the purposes of targeted advertising and for profiling in furtherance of decisions, including, for residents of Connecticut, solely automated decisions, that produce legal or similarly significant effects.
• Appeal any decision or indecision related to the exercise of any right granted under the applicable state law.

If you would like to exercise any of your rights under applicable law (including the right to appeal), please use the same methods stated within the “Contact Us” section below.

18. For Residents of New Jersey (NJDPA Compliance)

The New Jersey Data Privacy Act (“NJDPA”), effective January 15, 2025, provides New Jersey residents with specific rights and imposes additional obligations on businesses that process their personal data. Because Ajooni AI is incorporated in the state of New Jersey and processes data that may include financial account information and login credentials, we take our home-state compliance obligations seriously. This section supplements the rights described elsewhere in this Privacy Policy with disclosures specific to the NJDPA.

18.1 Sensitive Data and Opt-In Consent

Under the NJDPA, “sensitive data” includes, among other categories, financial account information and login credentials. Because the Ajooni AI Service is designed to process documents that may contain such sensitive data, we require your explicit, affirmative opt-in consent before processing any information that qualifies as sensitive data under New Jersey law. This consent is collected separately and is not bundled with the general terms of service or any other agreement. You may withdraw your consent at any time by contacting us at support@ajooni.ai or through your account settings.

18.2 Consumer Rights Under the NJDPA

If you are a New Jersey resident, you have the following rights under the NJDPA:

• The right to confirm whether Ajooni AI is processing your personal data and to access that data.
• The right to correct inaccuracies in your personal data.
• The right to delete your personal data.
• The right to obtain a copy of your personal data in a portable and readily usable format.
• The right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at support@ajooni.ai or use the mechanisms described in Section 22.

18.3 Profiling and Automated Processing Disclosure

Ajooni AI uses artificial intelligence to analyze, recreate, and extract data from documents you upload. Under the NJDPA, this activity may constitute “profiling” as defined by the statute. Accordingly, we disclose the following:

• Nature of processing: Our AI-powered tools perform optical character recognition (OCR), document classification, data extraction, and financial analytics on the documents you submit.
• Purpose: This processing is performed solely to provide the core functionality of the Service—helping you digitize, organize, and analyze your business documents.
• Opt-out right: You have the right to opt out of profiling that produces legal or similarly significant effects. To exercise this right, contact us at support@ajooni.ai or adjust your preferences in your account settings.

18.4 Universal Opt-Out Mechanism

In accordance with the NJDPA, Ajooni AI honors universal opt-out mechanisms (such as the Global Privacy Control signal) sent by your browser or device. When we detect such a signal, we will treat it as a valid request to opt out of the sale of personal data and targeted advertising.

18.5 Data Protection Assessments

As required by the NJDPA, Ajooni AI conducts data protection assessments prior to engaging in processing activities that present a heightened risk of harm to consumers, including processing of sensitive data and activities involving profiling. These assessments evaluate the benefits and risks of the processing activity, the reasonable expectations of the consumer, and the relationship between the processing activity and the purpose for which the personal data was collected.

18.6 Cure Period and Enforcement

The NJDPA provides for a 30-day cure period during which businesses may remedy violations after receiving notice from the New Jersey Attorney General. This cure period is available during the first 18 months following the law's effective date and sunsets on July 15, 2026. After that date, the opportunity to cure violations is at the discretion of the Attorney General. Non-compliance may constitute a violation of the New Jersey Consumer Fraud Act and may result in penalties of up to $10,000 per initial violation and up to $20,000 for subsequent violations.

19. For Residents of Nevada

Nevada law gives residents the right to request that a company not sell their personal data for monetary consideration to certain other parties. This right applies even if their personal data is not currently being sold (Ajooni AI does not sell your data). If you are a resident of Nevada and wish to exercise this right, please send an email with the subject line “Nevada Resident Do Not Sell Request” to support@ajooni.ai.

20. Data Processing Addendum (Business Customers)

This section is the Ajooni AI Data Processing Addendum (the “DPA”). It forms part of our Terms of Service and applies automatically where you use the Service on behalf of an organization — there is nothing separate to sign. It is written to United States federal and state privacy law, including the NJDPA and the CCPA. It is not a GDPR Article 28 agreement and does not incorporate Standard Contractual Clauses, because the Service is offered only in the United States.

20.1 Roles

For personal information contained in the documents and records you submit (“Customer Personal Information”), your organization is the controller (or business) and Ajooni AI is the processor (or service provider). You determine the purposes and means of the processing; we process only as described below. We act as an independent controller only for the limited information we process for our own purposes — account administration, billing, security, fraud prevention, and aggregated analytics — which is governed by the rest of this Privacy Policy.

20.2 Our Commitments

We process Customer Personal Information only to provide, secure, maintain, and support the Service, and otherwise on your documented instructions. We will not:

• Sell or share Customer Personal Information, as those terms are defined under applicable privacy law.
• Retain, use, or disclose it for any purpose other than performing the Service, or outside our direct business relationship with you.
• Combine it with information from another source, except as permitted by law to perform the Service.
• Use it, or your documents, to train, fine-tune, or improve any general-purpose artificial-intelligence model.

We limit access to personnel and authorized independent contractors who need it, each bound by written confidentiality, data-minimization, and deletion obligations. Where an optional service requires a person to access your content directly — such as White-Glove onboarding — we obtain your separate written authorization first, and you may decline or revoke it without losing access to the Service.

20.3 Subprocessors

You authorize us to engage the third-party services listed in Section 12 as subprocessors. Each is bound by written data-protection terms no less protective than this section, and we remain responsible for their performance. We will give at least thirty (30) days’ notice before adding or replacing a subprocessor that processes Customer Personal Information, by updating that list or by email. If you reasonably object on data-protection grounds within that period and we cannot resolve it, you may terminate the affected portion of the Service and receive a pro-rata refund of prepaid fees for the unused term.

A Google Drive or Dropbox account that you connect is your own relationship with that provider and is not a subprocessor arrangement. We transmit documents to it at your direction.

20.4 Security Incidents

We will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Information. The notice will describe what is known about the incident, the categories and approximate volume of information involved, the likely consequences, and the measures taken. We will reasonably cooperate with your own notification obligations.

20.5 Consumer Rights, Deletion, and Audit

We will reasonably assist you in responding to verified consumer requests to access, correct, delete, or obtain a copy of personal information, including through the self-service features of the Service. If we receive such a request directly, we will direct the requester to you rather than respond on your behalf.

On termination, and on your written request, we will delete or return Customer Personal Information we hold, other than copies we must retain by law. Because documents are written to your own storage rather than retained by us, this applies mainly to account records and service metadata; residual copies in routine backups are deleted on the ordinary backup cycle. We will provide the information reasonably necessary to demonstrate compliance with this section; anything beyond that is by prior agreement on scope, timing, and cost, no more than once in any twelve-month period absent a security incident.

20.6 Location and Precedence

Customer Personal Information is processed in the United States and is not transferred outside it. Liability under this section is subject to the limitations in the Terms of Service. Where this section conflicts with the Terms, this section controls for the processing of Customer Personal Information; the Terms control in all other respects. A mandatory requirement of applicable law controls over both.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on this page with a revised “Last Updated” date and, where appropriate, through in-app notifications or email. Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

22. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@ajooni.ai.