1. Who is responsible for your data
Paternoster (“we”), a sole proprietorship in Seoul, South Korea (business registration no. 110-20-15924, owner Hanmiru Lee), runs Jectos. For the data described in this notice we are the “controller” (or “business”, in US terms). Contact: privacy@jectos.com.
Your clients’ data is different. When you put information about your own clients into Jectos (names, emails, quotes, agreements, signatures), you decide why and how it is used and we process it for you. For that data you are the controller and we are your processor under our Data Processing Addendum. Section 4 explains this.
Where UK or EU law requires us to have a local representative, we will name them in this section before we offer the service in that region.
2. What we collect, why, and our legal basis
| What | Why | Basis (UK/EU terms) |
|---|---|---|
| Account: email address, name, sign-in method (Google account or email code), country, language, password hash if you set a password | Create and secure your account, sign you in | Contract |
| Business profile: studio or business name, representative name, address, phone, business tax ID, tax settings, logo, payment instructions you want clients to see (stored encrypted) | Show your details on quotes and client pages; apply your tax settings | Contract |
| Records you create: quotes, price lists, projects, files, agreements, expenses, time entries, notes | Provide the features you use | Contract |
| Subscription: plan, status, dates, a customer reference from our payment processor, last four card digits where provided. Our payment processor, Polar, collects your payment details and billing address itself. | Provide paid plans, support you, keep accounting records | Contract; legal obligation |
| Notifications: your notification choices, device tokens if you turn on push notifications | Send you the alerts you asked for | Contract; consent for push |
| Support: your name, email and message; chat messages with the support chatbot (identifiers such as emails and phone numbers are masked before storage) | Answer you and improve answers | Legitimate interests |
| Security and technical data: IP address (stored only as a one-way hash), browser, device type, times of access, sign-in events | Keep Jectos secure, prevent abuse, fix faults | Legitimate interests |
| Site analytics (visitors outside the UK, EU/EEA and Switzerland only): a random visitor ID, pages viewed, referrer, device type, country, ad campaign names | Understand how people find and use the site | Legitimate interests |
| Waitlist: email address, country | Tell you once when sign-up opens in your country | Consent |
We do not use your data for advertising, and we do not sell it. We do not make decisions about you using automated profiling that has legal or similarly significant effects.
You are not required to give us personal data, but without the account and profile data we cannot provide the service.
3. Where your data comes from
Most data comes from you. Some comes from people you invite: when a client opens your link we record that they opened it, and when they approve a quote or sign an agreement we record their name, the time, and the details described in section 4. Our payment processor gives us the status of your subscription.
4. Your clients’ data and the roles we play
| Data | Our role |
|---|---|
| Your account, billing and contact details; support chats; waitlist; site analytics; security logs | Controller |
| Your clients’ and contacts’ names, contact details, quotes, briefs, agreements, signatures and audit records, requests and bookings submitted through your forms, client chat messages, and text you send to AI features | Processor, acting on your instructions (you are the controller) |
| Payment details and billing address you give at checkout | Polar, as an independent business. It is not our processor; see Polar’s privacy policy. |
For e-signatures we record, for each signed agreement, the signer’s typed name, the signature they drew, the times they opened, verified (by an email code) and signed it, a fingerprint (hash) of the document, and the signer’s IP address (stored encrypted) and browser details. Their email address is stored encrypted. This is evidence of who signed and when, and is kept with the agreement.
If a client of yours asks us to access, correct or delete their data, we forward the request to you within 5 business days and tell the client that you are responsible; you answer it, and we give you the tools to do so.
6. Where data is stored and international transfers
Your data is stored in Seoul, South Korea, in a Supabase database and storage region. Our hosting runs in Seoul where possible. Our providers are US companies, so staff or systems in the United States may access or process data in operating the service.
UK and EU/EEA. The European Commission has found that South Korea provides an adequate level of data protection (Decision (EU) 2022/254, which covers controllers and processors subject to the Korean Personal Information Protection Act, and was reviewed by the Commission in July 2026), and the UK has made equivalent adequacy regulations (SI 2022/1213). Onward transfers to our US providers rely on the standard contractual clauses and, for the UK, the ICO addendum, contained in the Supabase and Vercel data processing terms. We rely on the other providers’ data processing terms.
Elsewhere. For members in other countries, we apply the same safeguards: contracts with our providers that require equivalent protection, encryption in transit and at rest for sensitive fields, and access controls.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and records | While your account is open. After a trial or paid plan ends, files are deleted after 30 days; quotes, clients and income records after 1 year; then the account is deleted, with notices to you first. If you delete your account, we delete your data promptly, except as below. |
| Subscription and payment records | As long as the law requires us to keep accounting records |
| Deleted expenses, time entries and notes | 30 days (so you can undo a mistake), then permanently deleted |
| Agreements and signature records | Until the member deletes their account |
| Requests and bookings submitted through your forms | 1 year after the request or meeting |
| Support chatbot conversations | 1 year after the last message |
| Support and contact messages | 3 years |
| Access and security logs | 1 year; sign-in records 3 months |
| Waitlist | Unconfirmed: 7 days. Confirmed: until 30 days after we email you that sign-up has opened, and in any case no longer than 12 months. |
| Backups | Deleted data can remain in provider backups for a short period before being overwritten |
8. Your rights
Depending on where you live, you can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to how we use it; move it to another service; and withdraw consent you gave (which does not affect earlier use). You can change most of your data and export your records in Settings. For anything else, email privacy@jectos.com.
We confirm your request within 3 business days and aim to complete it within 20 business days, and within any shorter period that applies to you by law. We may need to confirm your identity first. You will not be treated differently for using your rights. If you are a client of one of our members, please read the end of section 4.
California and other US states. In the last 12 months we collected the categories of personal information described in section 2 (identifiers, commercial information, internet activity, business profile information) for the purposes described there. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information to infer characteristics about you. You can use the rights above, and you can use an authorised agent. We do not knowingly collect information from people under 18.
Complaints. You may complain to your local data protection authority, for example the Information Commissioner’s Office (UK), the Data Protection Commission (Ireland), the Office of the Privacy Commissioner (Canada or New Zealand), the Office of the Australian Information Commissioner, the Personal Data Protection Commission (Singapore), your state attorney general (US), or Korea’s Personal Information Protection Commission. We would appreciate the chance to resolve it first.
10. AI features
Where AI features are switched on for your region, text you or your clients enter into them (for example a client’s request for a quote, or a chat message) is sent to an AI provider listed on the Sub-processors page to produce a reply. Before sending, we mask things that look like phone numbers, card or ID numbers and email addresses. We do not send your whole account, and we do not use your data to train our own models. The AI provider’s own data terms apply to what they receive. AI features may be switched off in some countries.
11. Security
We use encryption in transit (TLS), encrypt sensitive fields such as phone numbers, payment instructions and client contact details at rest, store files without public addresses and show them through short-lived signed links, separate each member’s data with database access rules, restrict team roles, and keep access logs. No system is perfectly secure.
If a personal-data breach affects data you control, we tell you without undue delay and aim to do so within 72 hours of becoming aware of it, and we tell regulators and affected people where the law requires us to as controller.
12. Children
Jectos is for businesses and is not directed to anyone under 18. If we learn that an account belongs to someone under 18, we delete it. If you believe this has happened, email privacy@jectos.com.
13. Changes to this notice
If we make material changes, we email members and post a notice at least 30 days before they take effect. The effective date is at the top of this page.
14. Contact
Privacy questions and requests: privacy@jectos.com.
Paternoster, Seoul, South Korea. Data protection contact: Hanmiru Lee.