Privacy Policy

1. Introduction

This Privacy Policy explains how Bitsapiens ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Jarvas platform (the "Service"). We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR/RGPD) and other applicable data protection laws.

2. Data Controller

The data controller responsible for processing your personal data is Bitsapiens. For any questions or concerns about your data, you can contact us at [email protected].

3. Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, and authentication credentials when you create an account.
• Usage data: Server logs, analytics data, and information about how you interact with the Service.
• Feedback data: Screenshots, text annotations, and other content uploaded by users through the feedback collection features.
• Meeting notes: Text content and AI-generated summaries from meeting notes created within the platform.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the RGPD:

• Contract performance: Processing necessary to provide the Service to you as agreed when you create an account.
• Legitimate interest: Processing necessary for the operation, security, and improvement of our Service, including analytics and fraud prevention.
• Consent: Where we rely on your consent, you may withdraw it at any time by contacting us or adjusting your account settings.

5. Data Storage and Security

Your data is stored using encrypted, secure infrastructure compatible with EU data protection requirements. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption at rest and in transit, access controls, and regular security assessments.

6. Data Retention

We retain your personal data for as long as your account is active and as needed to provide you the Service. You may request deletion of your data at any time. Upon account deletion or request, we will erase your personal data within 30 days, except where retention is required by law or for the establishment, exercise, or defense of legal claims.

7. Your Rights Under RGPD

Under the General Data Protection Regulation, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to data portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to restriction: Request restriction of processing under certain circumstances.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw previously given consent at any time.
• Right to lodge a complaint: File a complaint with your local data protection supervisory authority.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. Cookies

Jarvas uses session cookies strictly for authentication and maintaining your login session. We do not use third-party tracking cookies or advertising cookies. These session cookies are essential for the operation of the Service and are deleted when you close your browser or log out.

9. Third-Party Services

Jarvas integrates with third-party AI providers for code generation features. When you use AI-powered features, relevant data (such as feedback descriptions and meeting note summaries) may be sent to AI providers for processing. These providers operate under Data Processing Agreements (DPAs) that ensure compliance with RGPD requirements. We do not sell your personal data to any third party.

10. International Transfers

If your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms under the RGPD.

11. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on the Service and updating the "Last updated" date. We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Jarvas Chrome Extension

The Jarvas Chrome Extension is a companion to the Jarvas web platform. This section explains specifically what the extension does with your data, in addition to the general practices described above. It exists in compliance with the Chrome Web Store Developer Program Policies and Limited Use disclosure requirements.

Single purpose: The extension allows authenticated users to annotate elements on websites that have been pre-configured as project sites in their Jarvas workspace, capture screenshots and console errors, and submit that information as feedback to their Jarvas project. It is not a general-purpose data collector.

Data the extension handles

The extension only transmits data to the Jarvas backend (https://jarvas.bitsapiens.io). It does not send data to any third party, advertiser, or analytics service. Data the extension reads or transmits:

• Authentication token: After you sign in to Jarvas, a session token is stored locally in chrome.storage.local so the extension can call the Jarvas API on your behalf. The token never leaves your device except when authenticating Jarvas API calls.
• Page content (only when you act): When you explicitly invoke the inspector (toolbar icon, right-click menu, or side-panel button), the extension reads the outer HTML, tag, id, classList, and bounding rectangle of the element you click, plus a cropped screenshot of that element. None of this is read passively.
• Console errors (only when you submit feedback): If you have invoked the inspector on a page, the extension may attach the recent window.onerror and unhandledrejection events from that page to your feedback submission so the consultant can debug the bug.
• Attachments you choose: Files you explicitly drag, paste, or pick into the feedback form.
• Draft state: The extension persists your in-progress form (title, description, type, priority) in chrome.storage.local so it survives panel close. It is cleared when the feedback is submitted.
• Notification state: A short list of notification IDs you have already been alerted about, so we don't spam you with the same toast twice across service-worker restarts.

Data categories handled by the extension

Mapped to the Chrome Web Store "Privacy practices" categories the developer dashboard asks us to declare:

• Personally identifiable information: Your name and email — only as part of your authenticated Jarvas account, fetched on demand to display in the side panel.
• Authentication information: A Jarvas session token, stored only in chrome.storage.local on your device.
• User activity: Which element you clicked while inspecting, the URL of the page you were on at that moment, and the feedback you typed. Captured only when you explicitly invoke a feedback action.
• Website content: The HTML / classList / bounding rectangle of the element you click and a cropped screenshot of that element. Captured only when you explicitly invoke the inspector.

Categories we do NOT collect: health information, financial information, payment information, authentication on third-party sites, personal communications, location, browsing history, or web search history.

Chrome Web Store "Limited Use" disclosure

Jarvas's use and transfer of information received from the Chrome Web Store / through this extension to any other app will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: (a) we use the data only to provide and improve the user-facing Jarvas feedback feature; (b) we do not transfer the data to third parties except as necessary to provide that feature, for security purposes, or to comply with applicable law; (c) we do not use the data for advertising, including personalised, retargeted, or interest-based advertising; (d) we do not use the data to determine credit-worthiness or for lending purposes; (e) we do not allow humans to read the data, unless we have your affirmative consent to view specific items, the data is needed for security investigations, the data is aggregated and anonymized, or the data is necessary to comply with applicable law.

Permissions and why

The extension requests broad host access (<all_urls>) because the consulting client decides which websites are project sites at runtime — we cannot know in advance. The content script and inspector run only on the tab you are currently looking at, only at the moments you invoke them. We do not run analytics, fingerprint your browser, or read pages you have not explicitly inspected.

Removing the extension

You can uninstall the extension at any time from chrome://extensions. Uninstalling deletes all locally-stored data (auth token, drafts, notification cache). Data already submitted as feedback to Jarvas remains in your workspace and is governed by the rest of this Privacy Policy.

14. Contact / Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at [email protected].