Privacy Policy

For our website visitors and account holders, Joopler is the controller of your personal information. For data that a customer connects to the Service (for example, configuration read from their cloud, identity, or HR systems, and their personnel records), the customer is the controller and Joopler acts as a processor on their behalf, handling that data only to provide the Service under our agreement with them.

Account and identity. When you create an account we (through our authentication provider) collect your name, email address, organization, and authentication details. We do not store your password.

Billing. When you subscribe, our payment processor collects your billing contact and payment details. We do not store full card numbers; we retain a customer reference, plan, and billing status.

Configuration and compliance metadata. To measure and evidence a customer's controls, the Service reads configuration and status from the systems a customer connects (for example: whether multi-factor authentication is enforced, whether logging is enabled, whether a bucket is encrypted). Connectors are read-only and least-privilege. We read configuration and posture, not the substantive contents of your files, emails, or messages.

Personnel records. Compliance controls (onboarding/offboarding, access reviews, security-training completion) require a roster. A customer may provide, or connect an HR system that provides, employee names, work emails, roles, and employment dates.

Evidence and audit records. The Service records the results of automated checks and the evidence behind them in a tamper-evident, cryptographically signed ledger, so a control's pass/fail can be independently verified.

AI-governance metadata. Where a customer routes AI usage through Joopler's gateway or proxy, we record metadata about each request (provider, model, user reference, timestamp, policy outcome, and a redacted hash). Prompt and response content is redacted before hashing and is not stored.

Usage and device data. We collect standard log data (IP address, browser type, pages viewed, timestamps) to operate, secure, and improve the Service.

Cookies. We use strictly necessary cookies for authentication and session management, and limited analytics to understand site usage. You can control non-essential cookies through your browser.

We use information to: provide, operate, and secure the Service; authenticate users; process subscriptions and billing; run the automated control checks and generate the evidence a customer relies on; detect and prevent fraud, abuse, and security incidents; provide support; comply with legal obligations; and improve the Service. We do not sell personal information, and we do not use customer data to train third-party AI models.

Where the GDPR or UK GDPR applies, we process personal information on the following bases: performance of a contract (to provide the Service you or your organization signed up for); legitimate interests (to secure, operate, and improve the Service, and to communicate with you), balanced against your rights; consent (where required, for example certain cookies); and compliance with a legal obligation.

Subprocessors. We share information with vetted service providers who process it on our behalf to run the Service (for example hosting, authentication, payments, and email delivery). Our current subprocessors are listed at joopler.com/subprocessors, and they are bound by contractual data-protection terms.

People you authorize. A customer can grant scoped, read-only access to auditors or reviewers, and can publish selected posture on a public Trust Center. This sharing is controlled by the customer.

Legal and safety. We may disclose information where required by law, to enforce our agreements, or to protect the rights, property, or safety of Joopler, our customers, or others.

Business transfers. If Joopler is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this policy.

The Service is operated using infrastructure in the United States. Where we transfer personal information out of the EEA, UK, or other regions with transfer restrictions, we rely on appropriate safeguards such as the Standard Contractual Clauses. Data-processing and transfer terms are available to customers on request.

We retain account and billing information for as long as your account is active and as needed to comply with legal obligations, resolve disputes, and enforce agreements. Customer data processed on a customer's behalf is retained per our agreement with that customer and their configuration; evidence is retained for the audit-retention period a customer sets. On deprovisioning, we delete or return customer data as described in our customer agreement.

Security is the product, and we hold ourselves to the same bar. Data is encrypted in transit (TLS) and at rest. Evidence is signed with per-tenant keys and independently timestamped (RFC-3161), stored in immutable (write-once) storage, and hash-chained so tampering is detectable. Tenants are isolated at the database layer, secrets are held in a managed secret store (never in plaintext in our database), and access is role-based and least-privilege. No method of transmission or storage is perfectly secure, but we work continuously to protect your information.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. Residents of California and similar jurisdictions have the right to know what personal information we collect and to request deletion; we do not sell personal information. To exercise these rights, contact us at the address below. If your personal information was provided to us by a customer (your employer or a vendor), please direct your request to them as the controller; we will assist them as required.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

Questions about this policy or your data? Email privacy@joopler.com.