Your grant data is yours.

Everything you put into Joltoo - your RFPs, drafts, answers, and uploads - is yours. We use it only to give you the result you asked for, operate the service, keep it secure, and support your workspace. We do not sell it or share it with other customers.

The service providers listed in our Privacy Policy process only the data needed for their contracted work. We may use service metrics and de-identified statistics to improve Joltoo, but we do not use private workspace content to train AI models.

Joltoo's writing help uses the AI models we consider best suited to each task. Production services that receive private workspace content are selected for no-training business use. Waveup OÜ does not use that content to train AI models. Your content is sent only when an AI feature needs it. See our Privacy Policy for the processor and transfer details.

All traffic between you and Joltoo is encrypted in transit, and everything we store - documents, drafts, and account data - is encrypted at rest, using strong, industry-standard encryption.

Joltoo is operated by Waveup OÜ, a company registered in Estonia, in the EU, and serves customers worldwide. We use EU-region hosting and storage where available. Some vetted providers or their subprocessors may process data outside the EEA under a lawful transfer safeguard. We explain this in our Privacy Policy.

Your organization's data is kept separate from every other customer's, and access inside your team is limited by role. Sign-in is protected with email verification and secure password handling.

Under GDPR you can ask to access, correct, export, or delete your personal data. You can remove supported content from your workspace and request account deletion directly in Account settings. We confirm the request through your account email.

A workspace where you are the only member is deleted with your account and its subscription is cancelled immediately. Shared workspaces remain with their other owners. Deletion is permanent and can't be undone. We keep a limited set of records only where the law requires it - for example, billing and tax history.

Waveup OÜ is established in the EU, and GDPR is the baseline for Joltoo's privacy programme wherever our customers are. We don't claim certifications we don't hold - if you need specifics for procurement or a vendor review, ask and we'll tell you exactly where we stand.

Found a security problem? We want to hear about it. Email hello@joltoo.com with the subject “Security report” and enough detail to reproduce it. Please give us a reasonable window to fix it before sharing it publicly - we won't pursue researchers who report in good faith.