Privacy Policy

Waveup OÜ is the data controller for the Joltoo website, accounts, billing relationship, and direct communications. If an organization uses Joltoo to process personal data contained in its grant materials, that organization is normally the controller of that data and Waveup OÜ acts as its processor.

Questions and privacy requests can be sent to hello@joltoo.com.

• Account data: your name, work email, authentication method, account identifiers, organization membership, role, and profile image if supplied.
• Workspace data: organization profiles, saved grants, applications, drafts, chats, instructions, generated responses, uploaded decks and documents, and collaboration activity.
• Billing data: plan, subscription status, Stripe customer and subscription identifiers, billing contact details, invoices, and tax information. Stripe collects and processes payment-card or other payment-method details; Joltoo does not store complete card numbers.
• Support and sales data: information submitted through waitlist, contact, Agency inquiry, download, support, or feedback forms, including your message and acquisition source.
• Technical data: IP address, timestamps, browser and device information, page and referring URLs, security events, error logs, and service-performance data.
• Usage data: features used, documents and uploads created, plan-limit activity, and browser analytics if you allow analytics.

We receive this information from you, other members of your workspace, your browser or device, Google when you choose Google sign-in, Stripe when you pay, and the service providers described below.

• To provide Joltoo: create and secure accounts, maintain workspaces, process uploads, generate grant research and writing help, enforce plan limits, and provide support. The legal basis is performance of our contract or steps requested before entering one.
• To bill you: create subscriptions, collect payment, provide invoices, prevent fraud, and keep accounting records. The bases are contract, legal obligation, and our legitimate interests in receiving payment and preventing abuse.
• To operate and improve: diagnose errors, monitor performance, understand authenticated product use, and improve reliability and usability. We rely on our legitimate interests, balanced against your rights.
• To communicate: send service, security, billing, invitation, verification, and support messages. These are necessary for the contract or our legitimate interests. Marketing messages are sent with consent where required and always include an opt-out.
• Optional browser analytics: measure visits and page interaction after you choose “Allow analytics.” The legal basis is consent, which you can withdraw at any time.
• To meet legal duties: respond to lawful requests, enforce our terms, protect users and the public, and establish or defend legal claims.

Joltoo uses the AI models we consider best suited to each task. When you request an AI feature, we send only the instructions and content needed for that feature to vetted AI service providers. Production providers are selected for business use without training on customer content. Waveup OÜ does not use private workspace content to train AI models or make it available to other customers.

AI output is assistive. It does not make decisions that produce legal or similarly significant effects about you. You choose what to keep, edit, export, or submit, and the relevant funder makes any funding decision.

We disclose only the data reasonably needed for each provider to do its job. The main categories of recipients are:

• Hosting, database, file-storage, security, caching, and workflow providers that keep Joltoo available and protect the service.
• AI service providers that process the limited workspace content needed to produce output you request.
• Authentication, transactional-email, customer-support, and business communication providers.
• Stripe for subscriptions, payments, billing, tax information, fraud prevention, and legally required financial processing. Stripe may also act as an independent controller for some of those activities; see the Stripe Privacy Policy.
• Analytics and error-monitoring providers, with consent where consent is required.
• Professional advisers, authorities, or a buyer of the business where reasonably necessary and permitted by law.

We do not sell personal data or customer content. We do not disclose one customer’s private workspace content to another customer.

We use EU-region services where they are available, including EU file storage, transactional email, and product analytics. Some providers or their subprocessors may process data outside the European Economic Area. Where required, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer safeguard.

Contact us if you would like information about the safeguard relevant to a particular transfer.

Essential cookies and local storage keep you signed in, protect the service, remember your organization and settings, and store your cookie choice. They are required for Joltoo to work and are not switched off by the analytics choice.

Optional browser analytics and session-replay tools load only after you allow analytics. Replay is configured to mask text and block media. These tools help us measure visits and improve the product; they are not used to sell your data. You can reject analytics without losing access to Joltoo and can reopen “Cookie settings” in the footer at any time.

If you open Stripe Checkout or the Stripe billing portal, you move to a Stripe-hosted page. Stripe may use cookies needed for payment, security, fraud prevention, and preferences under its own notice. Joltoo's Cookie settings control optional analytics on Joltoo, not cookies on Stripe's website.

We also create limited server-side events for authenticated actions to operate, secure, meter, and understand the service. These do not depend on browser analytics cookies and are processed under our legitimate interests.

• Account and workspace data is kept while the relevant account or workspace exists and is deleted or anonymized when it is removed, subject to legal obligations and limited backup cycles.
• Billing, invoice, tax, and transaction records are kept for the period required by applicable accounting, tax, and financial laws.
• Support, waitlist, and sales records are kept while we handle the request and while reasonably needed to manage the relationship or legal claims.
• Security logs, error telemetry, and product events are kept only as long as reasonably needed for security, reliability, abuse prevention, and product analysis, after which they are deleted or aggregated where practicable.

We may preserve specific information longer where required by law, a legal hold, fraud prevention, dispute resolution, or enforcement of an agreement.

Depending on applicable law, you may ask us to access, correct, erase, restrict, or provide a portable copy of your personal data; object to processing based on legitimate interests; or withdraw consent. You may also ask your workspace administrator to correct or remove workspace content.

You can request deletion of your personal account in Account settings. We send a confirmation link to your account email before anything is deleted. A workspace where you are the only member is deleted with the account and any active subscription for it is cancelled immediately. A shared workspace remains with its other owners; if you are its only owner, you must promote another owner first.

For access, portability, restriction, objection, or a request that cannot be completed in the product, contact hello@joltoo.com. We may need to verify your identity and normally respond within one month. Some rights are subject to legal exceptions.

You may complain to the supervisory authority where you live or work, or to the Estonian Data Protection Inspectorate.

We use access controls, tenant separation, encryption in transit and at rest, signed payment webhooks, rate limits, and monitoring designed to protect the service. No system is perfectly secure. If an incident creates a legally reportable risk, we will notify the appropriate authority and affected individuals as required by law.

More detail is available on our Security page.

We may update this policy as Joltoo or the law changes. We will post the new date here and provide additional notice when a change is material. Questions or requests can be sent to hello@joltoo.com.