Jovra Privacy Policy
Peeler AI Systems LLC
Effective date: September 27, 2026
1. Who we are and what this policy covers
Peeler AI Systems LLC ("Peeler," "we," "us," or "our") provides Jovra, a construction-focused service for working with project records and source-backed answers. This policy covers personal information handled through the Jovra service, its supported ChatGPT integration, and website inquiries about Jovra.
It does not replace the separate privacy notices of ChatGPT, Microsoft, Stripe, or other services you use. Other Peeler products or custom engagements may be covered by separate notices and agreements.
For privacy questions or requests, contact kamran@peeleraisystems.com. Do not include passwords, identity documents, payment card details, or other sensitive information in your initial email.
2. Business workspaces and our responsibilities
When your organization provides project information to Jovra, it generally determines the business purpose for that information and which people are authorized to use it. We process that workspace information to provide the service under the applicable customer agreement and instructions. Your organization may have its own privacy notice and responsibilities to the people identified in its records.
We also handle information for our own service administration, such as account management, billing, security, and support. Our legal role depends on the information, the applicable agreement, and the relevant law. This policy is not a substitute for a data processing agreement where one is required.
Company ownership, billing authority, and project-data access are separate. Being an owner, administrator, or billing contact does not by itself establish permission to view every project record.
3. Information we collect
Account and access information
We receive information needed to identify and authorize users, such as name, email address, identity-provider identifiers, company membership, roles, project permissions, and account or access status. Authentication providers handle sign-in. The service also processes authorization records and tokens needed to maintain supported connections; these are not materials to submit in project documents or ordinary chat messages.
Project information and generated records
We process the information you or your organization supply to supported features. This can include project names, uploaded documents, filenames, extracted text, document versions, questions, saved answers, conversations, source excerpts and citations, project notes, and company guidance. These records may identify employees, customers, contractors, subcontractors, or other people mentioned in the source material.
The features and file types available to you depend on the service, your permissions, and your plan. Describing a data category here does not mean every feature accepts every category or file format.
Integration information
When you use Jovra through ChatGPT, we receive the tool requests and context that the client sends to Jovra, together with information needed to authenticate the connection and enforce access. A request may include your question and project, document, source, or saved-answer references. The integration does not require us to retrieve your entire ChatGPT history.
Operational and billing information
We process request times, operation and access records, usage reservations and consumption, errors, and other technical information needed to operate and protect the service. Website, authentication, and hosting systems may also receive connection information such as IP address, browser or device information, and security events.
Stripe handles supported payments. We process billing contacts, selected plans, transaction and subscription references, and payment or entitlement status needed to administer the service. Do not submit card numbers or bank credentials to Jovra's project or chat features.
Communications
When you contact us, we receive your contact details, message, and any information you choose to include. Provide only the information necessary for the request. We may ask you to use a more appropriate channel for sensitive support material.
4. How we use information
We use information to provide requested features; authenticate users and enforce company and project access; process supported documents; produce and retain answers and citations; manage usage limits and billing; respond to support or privacy requests; maintain service reliability; investigate misuse or security issues; and satisfy applicable legal obligations.
Operational information also helps us identify failures and improve service reliability. Customer project content is used for the requested service, necessary support or security handling, and applicable legal obligations—not as an unrestricted source of material for unrelated purposes.
We do not sell customer project content or use it for targeted advertising. We do not use customer project content to train general-purpose AI models or opt it into a provider's general model-training program. Any materially different use would require an appropriate separate agreement or authorization and an updated disclosure.
5. AI processing and ChatGPT are separate data paths
AI processing performed for Jovra
Jovra sends a question and the relevant project evidence to its AI provider to generate and check an answer. Microsoft Azure supports hosting, storage, identity, and document extraction where those functions are used. OpenAI provides the model service used by Jovra's normal grounded-answer path.
Jovra's grounded-answer requests disable stored API responses. That is not a zero-retention guarantee and does not disable all provider processing caches. OpenAI describes API training as opt-in and default abuse-monitoring retention as up to 30 days, with legal and safety exceptions and other feature-specific storage. Provider handling is also governed by applicable agreements and settings. See OpenAI's API data controls.
Information returned to your ChatGPT account
When you invoke the integration, authorized project information—including answers and source excerpts—can be returned to ChatGPT. It then becomes subject to the terms, retention controls, sharing features, and data settings of the ChatGPT account or workspace you are using.
OpenAI states that personal ChatGPT accounts may use app information for model improvement when the relevant setting is enabled; Business, Enterprise, and Edu accounts do not do so by default. Review your account's settings and your organization's rules before using work information in a personal account. See OpenAI's connected-app data guidance.
Jovra's permissions control what its service releases. They do not recall information already returned to another service. Disconnecting the integration does not automatically erase old ChatGPT conversations, delete your Jovra project records, or cancel your Jovra subscription.
6. Who receives information
We disclose information only for the purposes described in this policy, under applicable agreements and law:
- Authorized workspace participants: Information can be made available to people with the relevant company or project permissions. Access is not automatically company-wide.
- Service providers: Core providers include Microsoft for cloud and identity services and document processing where used, OpenAI for AI processing, and Stripe for billing. The company website uses OpenAI's Sites hosting service and Cloudflare for delivery and bot protection. Incoming mail to the published business email domain is routed through Microsoft's mail protection service. Providers supporting website delivery and business communications may receive the information needed for those functions. Provider permissions and legal roles depend on the service and agreement.
- Your chosen integrations and recipients: Information is shared when you use an integration, export records, or otherwise direct an authorized disclosure. Copies you or others download are outside Jovra's direct control.
- Support and professional advisers: Personnel and advisers may access information when necessary for authorized support, service operations, security, or legal and professional advice, subject to appropriate access and confidentiality restrictions.
- Legal and business circumstances: We may disclose information when legally required, to protect rights and safety, or in connection with a business transaction, subject to applicable confidentiality and privacy requirements.
This section is not permission to disclose another customer's information or to grant project access outside the authorization model. Contact us for information about providers relevant to your contracted service.
7. Cookies and local storage
The service and its authentication providers use browser storage or cookies for functions such as sign-in, maintaining sessions, and remembering interface state. Blocking necessary storage can prevent these functions from working.
The company website uses Cloudflare bot protection, including the __cf_bm cookie. Cloudflare states that this cookie expires after 30 minutes of continuous inactivity. The website also uses browser session storage to prevent repeated navigation or page-reload failures. These functions support delivery and reliability. See Cloudflare's cookie explanation.
Website providers may also process connection and security information as described in sections 3 and 6; cookies are not the only way that technical information is processed. We will identify optional analytics or advertising technologies and provide any choices required by applicable law.
8. Retention and deletion
We retain information according to its purpose, the customer relationship, applicable agreements, security needs, and legal obligations. Different categories have different lifecycles.
Project records. Active-company data is retained while the account remains active. Project documents, extracted content, saved questions and answers, and related records are retained to provide the workspace and its history, subject to authorized deletion and offboarding. An inactive or canceled subscription does not by itself erase the project record.
Company project offboarding. Jovra's company project-data offboarding process is export-first and includes a 30-day grace period, required confirmations, and checks for legal, contractual, or retention holds. This is not a promise to erase every record within 30 days of subscription cancellation. Deletion may wait for authorization, required confirmations, completion of eligible processing, or resolution of a hold.
Account, access, billing, security, and support records. These may remain separately when needed for service provision, account and access administration, transaction history, dispute resolution, fraud prevention, security, or legal obligations. Their retention depends on these purposes rather than one fixed period for every category. Minimum administration, billing/subscription, security/audit, operation-integrity, and deletion-status records may remain after project offboarding. Support correspondence may be retained to handle requests, document their resolution, address disputes and meet legal obligations. Company project offboarding is not the same as erasing an entire user identity, all billing records, or every audit record.
Connection records. The integration retains encrypted authorization records to support connections. Temporary sign-in transactions and consent checks expire after 15 minutes; authorization codes expire after five minutes. Token validity depends on provider expiry information and the connection's authentication rules. Expiry limits use of authorization information; it does not automatically delete retained records. Some authorization records are removed when a connection is completed or renewed, but authorization and client-registration records may remain separately for connection administration, security, dispute resolution or legal obligations. Expiry, revocation, disconnection and deletion are distinct: ending access does not guarantee immediate deletion of the associated records.
Operational telemetry. The backend's Application Insights request, trace, event, exception and dependency tables are configured for 90 days of retention, with no additional archive period for those tables. This is not a promise that all logs are deleted within 90 days. Other security, identity, website and provider logs can have different retention periods, depending on the service, security needs and applicable requirements.
Residual and provider copies. The account and project-authority database uses a seven-day continuous-backup recovery window. This does not mean all backups or recovery copies disappear after seven days. Soft deletion is disabled for stored original source documents; we do not promise recovery through that feature. Provider logs, backups and recovery copies can have separate retention schedules. Deletion from a live workspace does not mean every residual copy disappears at the same time. Information retained solely for recovery or legal purposes must not be repurposed for unrelated use.
These retention criteria do not mean that cancellation, inactivity, expiry or revocation automatically starts a deletion process. The seven-day database recovery window and 90-day telemetry setting apply only to the categories described above.
9. Your choices and requests
You can use available account, workspace, and integration controls within your authority. You can disconnect supported integrations through the relevant client, review your ChatGPT data controls, and contact your organization's authorized administrator about project access.
To request access, correction, export, deletion, or another applicable privacy right, email kamran@peeleraisystems.com. Identify the account and the nature of your request without including unnecessary sensitive data. We may need to verify identity and authority and, for organization-controlled records, coordinate with the relevant customer.
Your rights depend on applicable law and can include the right to object to or restrict processing, withdraw consent where processing relies on consent, or complain to a relevant privacy regulator. We handle requests under the applicable legal requirements and explain material limitations. Internal account permissions do not override a person's statutory rights.
Disconnecting, requesting deletion, and canceling a subscription are distinct. Tell us which action you are requesting. You may opt out of marketing messages through an available unsubscribe control or by contacting us; necessary service, security, and billing communications may continue.
10. Security and processing locations
We use access controls and other technical and organizational measures intended to protect the information handled by the service. No service can guarantee that every security incident or unauthorized disclosure will be prevented.
Peeler operates in the United States. Information may be processed where we and our providers operate, subject to applicable agreements and law. We do not promise that all information stays in one country unless an applicable agreement and verified service configuration establish that restriction. Where legally required, appropriate transfer arrangements must be in place.
Contact us promptly about a suspected incident. Do not send account passwords, API keys, or confidential customer records in the initial report.
11. Children and restricted information
Jovra is intended for professional business use and is not directed to children under 13. Tell us if you believe a child has provided information contrary to these restrictions.
Do not submit government identification numbers, protected health information, payment card data, or authentication secrets through Jovra's documents or chat features. Use supported sign-in and payment interfaces for their intended purposes. Do not upload material that requires specialized handling or contractual safeguards unless the applicable service and agreement support it.
12. Changes and contact
We will identify the effective date of the published policy and provide notice of material changes as required by law. Where a change requires consent or a contractual amendment, posting a revised policy alone does not replace that requirement.
Peeler AI Systems LLC
Privacy and support: kamran@peeleraisystems.com
Business website: https://peeleraisystems.com