Skip to content
Try JUWEL
privacy

Your data is yours.

Plain-language privacy: what we collect, why, and the controls you keep.

Effective 2026-10-02 · policy id tos.2026-09-01 · Vext Labs, Inc., Delaware, USA

The short version

JUWEL is an operating environment that remembers. To do that it has to collect and store a fair amount: what you tell it, what you show it, which accounts you connect, and what it did on your behalf. This notice lists all of it, with where it lives and how long. Three limits, up front:

  • We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
  • We do not train a general model on the content of your instance.
  • We do not store the bodies of messages in a mailbox you connect. JUWEL reads them when you ask, in the moment, and does not keep the text.

And one thing we do not have: no SOC 2 report, no HIPAA compliance or Business Associate Agreement, no FedRAMP authorisation, no ISO 27001 certification, and no EU data residency. If a certification matters to you, we do not have it.

Who we are

Vext Labs, Inc., a Delaware corporation in the United States, is the controller of the personal data described here. Contact [email protected]. We have no establishment in the European Union or the United Kingdom and have not appointed an Article 27 representative.

What we collect

  • Account and identity. Your email address or phone number, your name if you give one, your plan, your Stripe identifiers, and the device or command-line tokens you create. A sign-in session lives in an HttpOnly cookie. Kept until you delete your account.
  • Content you give JUWEL. Anything you type, paste, or upload: chat turns, documents and the text extracted from them, workspace and pane layouts, synced client state, encrypted channel turns. Kept until you delete it or your account.
  • Episodic memory. Episodic memory on Face and in main chat (/api/chat) is an episode summary and body, the surface it happened on, and a vector embedding used to find it again. Episodic memory is off until you turn it on, and only after a signed notice is accepted. Existing chats are not recalled until you opt in. While it is on, messages are recorded automatically. Cloudflare Workers AI processes the text of those messages to produce the embedding. Recall ignores episodic memory rows older than 90 days. No scheduled job deletes those rows. You can delete one line at any time. Deleting one line has no undo. Delete all removes your episodic memory notes on every surface. A continuity record holding the shape of your ongoing work is separate, and it is not this opt-in.
  • Connected accounts. Which account is connected, its status, and the access token needed to act. We do not copy your mailbox. Kept until you disconnect or delete your account.
  • Receipts and activity. A hash-chained record of what JUWEL did under your account — approvals granted, tools run, surfaces opened.
  • Billing. Plan, prepaid credit balance and transaction log, Stripe identifiers. Card numbers never reach us.
  • Fraud and dispute evidence. When you start a payment, and when you use JUWEL signed in, we record the IP address your request arrived from, with a timestamp and browser user-agent. It lives in a dedicated store used only to answer card-network disputes and investigate abuse — never in receipts, analytics, or logs. Purchase-linked records are kept about 550 days; the signed-in usage map about 90 days, rolling. It leaves our systems only inside a confidential evidence package sent to the card network through Stripe.
  • Voice. If you start a voice session, audio is processed to produce a response. Voice is opt-in; we do not open a microphone without you starting the session.
  • Telemetry — counts, not content. See the section below.

Message bodies in a connected mailbox

Not stored. List calls return snippets; a full message body is fetched only when you open it, used for that turn, and not written to a JUWEL store. If we ever change that, it will require a separate, revocable consent from you and a clause in this notice — it will not happen quietly.

Telemetry, cookies, and Do Not Track

Two telemetry paths, both deliberately narrow. First-party: counters against a fixed catalogue of event names, plus pseudonymous actor sets derived by a keyed hash — never a user id, an address, a prompt, a filename, a search query, or a message body. Aggregates are kept about 400 days; actor sets about 35 days. If no hashing key is configured, the actor is recorded as “none” rather than as anything identifying. PostHog (US cloud): product analytics with a hashed account id, never an address, and a deny-list that blocks email, message bodies, snippets, subjects, mail fields, prompts, the session cookie, and wallet fields on the server and in the browser. Without a configured project key, nothing is sent at all — there is no silent fallback.

We honour Do Not Track and Global Privacy Control: with either set, the analytics queue — including the PostHog SDK — is disabled before it loads. You can also turn analytics off yourself: Settings → Observability → turn off product analytics (or run JuwelPosthog.optOut() in the console); the choice is stored on your device and takes effect immediately. Session replay is enabled with all inputs masked, and error autocapture is enabled with message bodies and identifying fields scrubbed; surveys are not enabled. We do not run advertising cookies and we do not run third-party ad trackers. Cookies and storage we do use: a strictly-necessary HttpOnly sign-in cookie; local storage for theme, layout, and pane state; and a pseudonymous analytics identifier in local storage when analytics is on — all of it stays in your browser until an event is sent.

Who we share it with

Only the providers we need, each receiving what the job requires:

  • Vercel — frontend hosting and serverless functions
  • Upstash — Redis: accounts, sessions, wallet, ledger, connections, synced state
  • Neon — Postgres: episodic memory and knowledge rows
  • Cloudflare — R2 object storage, CDN and DNS. Cloudflare Workers AI processes the text of your messages to produce memory embeddings.
  • RunPod — GPU compute for routed requests
  • OpenRouter — model routing for chat turns
  • OpenAI — realtime voice, and model calls where configured
  • Twilio — SMS and voice telephony
  • Stripe — payments and subscriptions; card data at Stripe only
  • ipwho.is — IP geolocation, invoked only when staff generate a dispute-evidence package; receives the IP being looked up
  • Resend — transactional email
  • Composio — OAuth broker for the apps you connect
  • Google — only the Google services you connect, such as Gmail and Calendar
  • ElevenLabs — voice synthesis, where a spoken reply is enabled
  • Scribehow — workflow capture, where you use it
  • PostHog — product analytics, US cloud
  • Open-Meteo — weather lookups; receives a coarse location, never account data
  • OpenStreetMap — geocoding via Nominatim; receives a place name, never account data

We also share when the law requires it, to protect rights and safety, and in a merger or acquisition — in which case this notice travels with the data or you are told before anything changes. We do not sell personal information.

Where your data is

The United States. Our hosting, storage, compute, telephony, payments, and analytics are US-based or global with a US default. We do not offer EU or UK data residency. If you use JUWEL from outside the United States, your data is transferred to and processed in the United States. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses with our processors where they apply, and on your explicit consent for the transfer where they do not.

Your controls

  • Access and export. Export your continuity state, synced state, and your acceptance record from the product. Export of episodic memory rows is not yet built — ask us and we will do it by hand.
  • Correction. Edit your profile in Settings; tell us anything we hold that is wrong.
  • Deletion. In-app account deletion is coming. Until then, email [email protected] from the address on your account and ask us to delete it; we will confirm by email when your account and data are deleted. The account deletion page has the details.
  • Episodic memory off. On Face and in main chat, episodic memory stays off until you turn it on, and only after a signed notice is accepted. Writes and recall can be turned off again at any time. Main chat shows a dismissible prompt for a signed-in person who has accepted a notice that is in force and has not turned episodic memory on. The prompt links to Settings, Memory.
  • Disconnect. Revoke any connected account in Settings → Connections.
  • Withdraw consent for connections, voice, or optional analytics at any time, without affecting what was lawful before.

We do not charge for these and we do not treat you differently for using them. Where the GDPR or UK GDPR applies you also have rights of restriction, portability, and objection, and you may complain to your supervisory authority; we respond within one month. In California and other US states you may request to know, delete, and correct, and be free from discrimination for asking; an authorised agent may act for you with proof of authorisation.

Retention and deletion — what actually happens

When account deletion runs it removes your account record and identity indexes, wallet and wallet log, device and agent keys, connection records, uploaded documents and their index, synced chat and memory state, continuity state, workflow state, encrypted channel turns, current-month usage, and the chargeback IP-evidence records linked to your account; it removes you from our central user index; it cancels your Stripe subscription and deletes your Stripe customer; and it purges the knowledge graph bound to your identity.

Three records deliberately survive, each for a stated reason:

  • Your acceptance record for the terms — the policy version, the time you accepted, and a truncated hash of your account id. No address, no IP, no device. We retain it because it is the evidence of the agreement that governed your account, and deleting it would erase the thing that made the relationship lawful. Once your account record and its index are gone, this row does not resolve to a person from inside our systems.
  • An SMS opt-out record, if you have sent STOP — so deleting an account can never silently undo an opt-out.
  • A deletion audit row — an account id, a receipt id, a hashed handle, and counts. It is how we can show a deletion actually ran.

On Face and in main chat, recall ignores episodic memory rows older than 90 days. Episodic memory is off until you turn it on, and only after a signed notice is accepted. No scheduled job deletes those rows. The activity ledger is not yet covered by automated deletion. Until it is, email [email protected] and we will remove it by hand. Account deletion does not itself remove episodic memory rows, and it does not remove the activity ledger. Account deletion is also currently behind an operator flag: where the flag is off, the deletion endpoint returns the exact plan of what would be removed and removes nothing. It does not report a deletion that did not happen.

Children

JUWEL is for adults. You must be 18 or older. We do not knowingly collect data from anyone under 18, and we delete an account if we learn it belongs to someone younger. Tell us at [email protected] if you believe a child has given us data.

Professional and health data

Do not submit protected health information. We do not offer a Business Associate Agreement and we are not a HIPAA business associate. Attorney-client and other privileged material remains your responsibility; treat the instance as your workspace, not a substitute for firm data-governance controls.

Changes and questions

Material changes are posted here and in the product, and the version identifier changes with them. When it changes, JUWEL asks you to accept the new version before your next consequential action. Questions: [email protected] · Vext Labs, Inc., USA.