DRAFT – NEEDS LAWYER REVIEW BEFORE USE

Privacy Policy for Jarvis

Last updated: [DATE]

Draft note: All boxes marked "TODO" are internal working notes and must be removed before publication. All information about service providers (registered office, server location, certification, retention period) is unverified and must be checked individually before publication: TODO(owner): verify. The text must match exactly the actual technical state of the published version.

TODO(owner) + TODO(lawyer): This English version is a translation of the German "Datenschutzerklärung". Decide whether the German version prevails in the event of any discrepancy.

TODO(owner) – CRITICAL: According to the current project documentation, in "Always listening" mode the browser's speech recognition service (Google or Microsoft) receives the microphone signal continuously, i.e. also before the wake word. Local wake-word detection is only planned. Until it ships, only Variant B in Section 6.1 may be used.

1. Summary

• Jarvis is a voice assistant for Windows PCs. Much of your data (settings, memories, history, activity log) stays on your PC only.
• So that the AI can understand and carry out your request, we send the text of your request and – where needed for the task – page content, file content or screenshots of your screen via our server to our AI provider Anthropic (USA).
• To turn your speech into text, Jarvis uses your browser's speech recognition service (Google or Microsoft) or a cloud service (Groq or OpenAI).
• Payments are handled by Stripe; we manage your account and licence with Supabase.
• We send error reports and usage statistics (telemetry) only with your consent.
• You can export and delete your data in Settings and you have the rights described in Sections 24–27.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

[NAME] [ADDRESS] Email: [EMAIL] Phone: [PHONE]

(hereinafter "we" or "us")

3. Data protection officer

We have not appointed a data protection officer because there is no legal obligation to do so. If you have questions about data protection, please contact [EMAIL].

TODO(lawyer): Check whether an obligation to appoint exists under Art. 37 GDPR / Section 38 of the German Federal Data Protection Act (BDSG) (e.g. if a data protection impact assessment is required, Section 38(1) sentence 2 BDSG).

4. Scope

This privacy policy applies to

• the desktop application Jarvis for Windows ("App"),
• the associated phone web app and the optional Siri shortcut,
• our server services (licence and relay server, customer account, payment processing), and
• our website [WEBSITE URL].

5. Data stored locally on your PC only

The App stores the following data exclusively locally on your PC. We have no access to it unless you send it to us yourself (e.g. as part of a support request) or it becomes part of an AI request (see Section 7):

• settings (including licence key and pairing key for your phone),
• facts you ask the App to remember ("Remember that …") and names and terms the speech recognition should know,
• reminders you set up,
• voice shortcuts and routines,
• list of people you have messaged via the App,
• usage and cost estimates,
• activity log of the actions performed and safety decisions taken (default retention: 30 days, adjustable in Settings),
• optional screenshots in the activity log (switched off by default),
• files moved to quarantine,
• the App's own browser profile (cookies, logins and history of the websites you sign in to in the App's browser window).

This data is stored [unencrypted / encrypted] in your Windows user profile. Please protect your PC and your user account (e.g. with a password and disk encryption).

Export and deletion: Under "Settings" → "[Privacy]" you can export and delete this data. [Uninstalling the App deletes the local data / The local data remains until you delete the folder [PATH].]

TODO(owner): verify – Enter storage location, encryption, behaviour on uninstall and the exact menu names.

TODO(lawyer): Confirm that data stored purely locally, to which we have no access, is not processed by us; adjust wording if necessary. Check whether Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG – storage of information on terminal equipment) requires information or consent. Our understanding: local storage is strictly necessary for the service expressly requested (Section 25(2) no. 2 TDDDG); telemetry and crash reports are not covered by this (see Sections 12, 13).

6. Voice input and voice output

6.1 Wake word ("Always listening")

On the PC, Jarvis can wait permanently for a wake word. Alternatively, you can speak by pressing a key or clicking ("push to talk") or type your request. You can switch "Always listening" off in Settings at any time.

TODO(owner): Use exactly ONE of the two variants – depending on the actual technical state of the published version.

Variant A – local wake-word detection (use only once implemented): While Jarvis is waiting for the wake word, the microphone signal is analysed exclusively locally on your PC. Before the wake word is detected, no audio leaves your PC and nothing is stored. Only after the wake word is your request converted into text as described in Section 6.2.

Variant B – detection via the browser's speech recognition service (current state according to the project documentation): If "Always listening" is switched on (on by default on the PC), the speech recognition service of the browser in which Jarvis runs (Google for Chrome, Microsoft for Edge) continuously receives the microphone signal in order to convert it into text – also before you say the wake word. Conversations of other people within earshot may also be captured. Only what you say after the wake word is passed on to us and to our AI provider. If accurate speech recognition (Section 6.2 b) is also active, the App sends a short audio clip (approx. two seconds) to the cloud speech recognition service about once per second while Jarvis is speaking, in order to detect whether you want to interrupt the output with the wake word.

TODO(lawyer): For Variant B, check whether "Always listening" should be off by default and only activated after express consent (Art. 6(1)(a) GDPR) – in particular because of the continuous transmission to Google/Microsoft and the capture of bystanders. Recommendation of this draft: opt-in with a clear notice when first switched on.

6.2 Converting your speech into text

After the wake word (or after the key press), the recording of your request is converted into text in one of the following ways:

a) The browser's speech recognition (default): The audio is sent to your browser's speech recognition service – for Google Chrome to Google (Google Ireland Limited, Ireland / Google LLC, USA), for Microsoft Edge to Microsoft (Microsoft Ireland Operations Limited, Ireland / Microsoft Corporation, USA). Processing takes place under the respective browser provider's privacy terms. On the phone, the web app likewise uses the service of the phone's browser (e.g. Google for Chrome on Android, Apple for Safari).

TODO(lawyer): Clarify the role of the browser providers (independent controller, processor or joint controller under Art. 26 GDPR). There is usually no data processing agreement with Google/Microsoft for this browser feature. Consider switching the legal basis to consent.

TODO(owner): verify – Which providers actually process the browser speech recognition, and where?

b) Accurate speech recognition (cloud service, optional or depending on plan): The audio recording of your request is sent, together with a hint list (e.g. names of contacts and app terms you have saved), to a cloud speech recognition service:

• Groq, Inc., USA ("Whisper" model) or
• OpenAI ([OpenAI Ireland Limited, Ireland / OpenAI, L.L.C., USA]).

In licensed versions, the transmission takes place via our relay server (Section 8) and on our behalf; the provider is then our processor. If you enter your own API key for one of these providers in Settings, the App sends the recording directly to the provider under your own contractual relationship with that provider.

TODO(owner): verify – Which provider is the default? Contracting entity at OpenAI (EEA entity)? Data processing agreements (DPA) with Groq / OpenAI in place? Retention at the provider? Use for training excluded? Server location?

Purpose and legal basis: Carrying out your voice commands; Art. 6(1)(b) GDPR (performance of a contract). The App does not store the recording after conversion. [TODO(owner): verify]

6.3 Voice output

By default, answers are read aloud using the voices of your browser or of Windows. With certain voices (e.g. the "natural" online voices in Microsoft Edge), the text to be read is sent to the voice provider and converted into speech there. If you choose an optional cloud voice, the answer text is sent to [TTS PROVIDER, REGISTERED OFFICE].

TODO(owner): verify – Which voices are local and which are cloud-based? Which provider for the optional cloud voice (registered office, DPA, third-country transfer)?

6.4 No voice biometrics

We do not use your voice to identify you or other persons (no voice recognition in the sense of biometric data).

TODO(owner): verify – Keep only if true (including for the planned local wake-word detection).

7. Processing of your requests by the AI (Anthropic)

What is transmitted: To understand and carry out your request, we transmit the following data via our relay server (Section 8) to our AI provider:

• the text of your request and the history of the current conversation,
• context the App needs for the task, e.g. relevant saved memories, names of contacts, your autonomy mode settings, names of open windows and results of previous steps,
• content of websites the App opens for you (page text),
• content of files and documents you ask about or ask the App to edit,
• screenshots of your screen if a task cannot be done any other way (e.g. to find a button). A screenshot shows everything visible on your screen at that moment – including content of other programs and data of other people,
• search queries, if the AI searches the internet for your request.

TODO(owner): verify – Check the list of context data (which memories/contacts/window content are actually sent?). Can screenshots be redacted or limited to the active window? If so, mention it here.

Recipient: Anthropic, PBC, San Francisco, USA. Anthropic processes the data as our processor on the basis of a data processing agreement. Under Anthropic's terms for commercial customers, content transmitted via the application programming interface (API) is not used to train AI models. According to Anthropic, it stores inputs and outputs for [X] days; longer retention may occur if a violation of the usage policies is suspected. For web searches, Anthropic may pass search queries on to a search provider.

TODO(owner): verify – Contracting entity (Anthropic, PBC or Anthropic Ireland, Limited), incorporation of the Data Processing Addendum, current retention period, no training, any "zero data retention" arrangement, place of processing, sub-processors (incl. search provider for web search).

Purpose: Understanding and carrying out your requests.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Where data of other persons is concerned, see Section 17.

Third-country transfer: USA – see Section 21.

Please note: Do not tell the App anything you do not want to be transmitted to the AI, and do not leave confidential content visible on screen when the App might use screenshots. The App does not enter passwords or card numbers itself; you enter them yourself in the App's browser window. [TODO(owner): verify]

8. Licence and relay server, usage counting

So that we can check your licence and enforce the usage limits of your plan, AI requests (and, in licensed versions, the recordings for accurate speech recognition) are routed through our own relay server ("Relay"). It

• checks your licence key (valid, not blocked, not expired),
• checks the limits of your plan (e.g. requests per minute, costs per day and month, permitted AI models),
• forwards the request to Anthropic or to the speech recognition service, and
• records the estimated cost of the request against your licence key (usage counter).

We do not store the content of your requests permanently on the Relay; it is only processed for forwarding. The usage counters per licence and period are stored. You see these counters in the App as a usage bar.

Service providers:

• Hosting of the Relay: Vercel Inc., USA; server region: [USA / EU – TODO(owner)]. Vercel processes technically necessary connection data (e.g. IP address, time, endpoint called) and may store it in logs ([X] days).
• Usage counters: Upstash, Inc., USA (Redis database); data region: [TODO(owner)]. The counters expire automatically at the end of the respective period.

TODO(owner): verify – That the Relay does not log any content (including no error logs containing request content); Vercel log retention; regions; DPAs with Vercel and Upstash; whether IP addresses are stored.

Purpose and legal basis: Provision of the service and enforcement of the contractually agreed usage limits (Art. 6(1)(b) GDPR); protection against misuse, fraud and overload and security of our systems (Art. 6(1)(f) GDPR – our legitimate interest in secure and economically viable operation).

9. Customer account and licence management (Supabase)

For your customer account and licence we process: name, email address, licence key, plan, contract status, term, trial period, payment status, Stripe customer ID and [device/installation ID, time of activation – TODO(owner): verify].

Service provider: Supabase, Inc., USA; data region: [EU (e.g. Frankfurt) – TODO(owner): verify].

Purpose and legal basis: Performance of the contract, licence management (Art. 6(1)(b) GDPR).

10. Payment processing (Stripe)

We process payments, subscriptions and invoices via Stripe Payments Europe, Limited, Dublin, Ireland. Stripe processes in particular your name, email address, billing address, payment method and payment data (e.g. card details), amount, time and IP address. We do not receive full card details. Stripe may transfer data to affiliated companies, in particular Stripe, Inc. (USA). Where Stripe processes data for fraud prevention, to comply with its own legal obligations (e.g. anti-money laundering) or to improve its own services, Stripe is itself the controller. More information: [LINK TO STRIPE PRIVACY POLICY].

Purpose and legal basis: Processing the payment (Art. 6(1)(b) GDPR); compliance with tax and commercial law retention obligations (Art. 6(1)(c) GDPR); fraud prevention (Art. 6(1)(f) GDPR).

TODO(owner): verify – Contracting entity at Stripe, Stripe products used (Checkout, Billing, Customer Portal, Tax), certification under the EU-US Data Privacy Framework.

11. Sending licence and contract emails

To send emails (e.g. licence key, contract confirmation, invoice notices, reminder before the end of the trial), we use [EMAIL SERVICE PROVIDER, e.g. Resend or Postmark – REGISTERED OFFICE]. Your email address, your name and the content of the email are processed.

Purpose and legal basis: Performance of the contract (Art. 6(1)(b) GDPR).

TODO(owner): Choose a provider; enter registered office, data region, DPA, third-country transfer and retention of sending logs. Marketing emails/newsletters only with separate consent (see checkout-consent.md).

12. Error reports – only with your consent

Only if you have consented (on first start or in Settings, Privacy; the box is unticked by default) does the App send a short error report to our own server when something in the App fails. It is stored in our database (hosting providers: see Sections 8 and 9); no other company receives it. The report contains only: the type of error, a shortened error message, where in the App's own program code it happened (file, line, function), the App version, your operating system (e.g. "Windows 11") and your plan. It does not contain what you said or typed, the content of pages or files, names, email addresses, keys, your user folder name or your IP address; these are removed in the App before sending, and our server discards messages that still look personal. The license key is only used to accept the report and is not stored with it.

Legal basis: Your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG). You can withdraw your consent at any time in Settings.

Storage period: 90 days after the same error last occurred.

13. Usage statistics (telemetry) – only with your consent

Only if you have consented does the App send usage statistics to [TELEMETRY PROVIDER or "our server" – TODO(owner)], e.g. which features are used, error rates and performance figures. This data contains no content of your requests and is processed in [pseudonymised/anonymised] form to improve Jarvis.

Legal basis: Your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG), which you can withdraw at any time in Settings.

TODO(owner): Define provider, data scope, identifier and retention period. If no telemetry is implemented, delete this section.

14. Licence checks and software updates

On start-up and at regular intervals, the App queries our server for the status of your licence and your usage. The App also checks whether updates are available and downloads them from [UPDATE SERVER/PROVIDER – TODO(owner)]. Your IP address, your licence key, the App version and [TODO(owner): other data] are processed.

Legal basis: Performance of the contract, including our obligation to provide updates (Art. 6(1)(b) GDPR); security (Art. 6(1)(f) GDPR).

15. Phone access, Tailscale and Siri

Phone web app: You can pair a phone with your PC using a QR code. The web app is served directly by your PC; the connection between phone and PC runs over your local network or via Tailscale and is protected by a key generated by the App. The pairing key is stored in your phone's browser. Our servers are not involved in this connection; however, requests you make from the phone are processed as described in Sections 6 and 7.

TODO(owner): verify – Does pairing/the connection really run without our servers? Speech recognition on the phone is performed by the phone's browser (Section 6.2 a).

Tailscale (optional): If you use remote access via Tailscale, this takes place via your own Tailscale account with Tailscale Inc. ([REGISTERED OFFICE – TODO(owner): verify]) under its terms and privacy policy. We have no access to your Tailscale account. Tailscale processes, among other things, connection and device data.

Siri shortcut (optional, iPhone): If you set up the "Hey Siri, Jarvis" shortcut, Apple processes your speech on your iPhone under Apple's terms and privacy policy. The shortcut sends the recognised text together with your secret key to your PC. Your PC's answer can instruct the shortcut to send an iMessage or open a link on the iPhone; this takes place via Apple services.

16. Actions in third-party services (e.g. WhatsApp, Discord, Amazon, Gmail, Uber Eats)

When Jarvis uses third-party websites or services on your instruction (e.g. sends messages via WhatsApp Web, Discord or email, or orders from Amazon or Uber Eats), it does so with your accounts in those services. The respective providers receive the data needed for the action (e.g. message content, recipient, order and delivery details) and process it under their own responsibility and privacy policies. Login data and cookies for these services remain in the App's local browser profile on your PC (Section 5). Content of these pages may be sent to the AI as page text or screenshots (Section 7).

17. Data of other people

When you use Jarvis, data of other people may be processed, e.g. names, phone numbers or user names of contacts, content of messages and emails, content visible on your screen or on websites, or voices of people within earshot of the microphone. Where we process this data (in particular when forwarding it to the AI), we rely on Art. 6(1)(f) GDPR: our legitimate interest and that of our customers lies in carrying out the tasks requested by the customer. We process this data only as far as necessary for the respective task and do not store it permanently on our servers.

Please only process data of other people via Jarvis where it is necessary for your task.

TODO(lawyer): Check the legal basis and the duty to inform third parties (Art. 14 GDPR, possibly exemption under Art. 14(5)(b)). Clarify the customer's role (household exemption, Art. 2(2)(c) GDPR, only for purely personal use) and the situation where customers use the App for business purposes (then possibly processing on behalf by us, DPA needed).

18. Particularly sensitive data

Jarvis is not intended for processing special categories of personal data (e.g. health data, religious or political beliefs). However, if you mention such data in a request or it is visible in a screenshot, it is processed as part of the request as described in Section 7.

TODO(lawyer): Check the legal basis under Art. 9(2) GDPR (e.g. explicit consent during onboarding) or define a technical/organisational solution.

19. Website and cookies

Hosting and server logs: Our website is hosted by [HOSTING PROVIDER, REGISTERED OFFICE – TODO(owner)]. When you visit it, technically necessary data is processed (IP address, date and time, page requested, referrer, browser and operating system) and stored in server logs for [X] days. Legal basis: Art. 6(1)(f) GDPR (secure and stable provision of the website).

Cookies and similar technologies: [Variant A: On our website we only use technically necessary cookies (e.g. for logging in to the customer account and for the payment process via Stripe). These are permitted without consent under Section 25(2) no. 2 TDDDG.] [Variant B: In addition, we use [ANALYTICS/MARKETING SERVICES] only with your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time at [LINK].]

TODO(owner): Define the website technology (host, analytics, fonts, embedded content, Stripe Checkout). For each tool add purpose, provider, legal basis, retention and third-country transfer. Use a consent banner for non-essential cookies. TODO(lawyer): review.

20. Contact and support

If you contact us by email or contact form, we process your details (e.g. name, email address, message, and any logs or screenshots you send) in order to answer your request. Legal basis: Art. 6(1)(b) GDPR where the request concerns a contract, otherwise Art. 6(1)(f) GDPR. Please check logs before sending them to us, as they may contain data about your activities and about third parties.

21. Transfers to third countries

Some of our service providers are based in the USA or process data there. For the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework, Art. 45 GDPR) for companies certified under that framework. Where a provider is not certified, the transfer takes place on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request at [EMAIL].

TODO(owner): Conclude/document a DPA with each processor and check DPF certification at dataprivacyframework.gov. TODO(lawyer): check whether a transfer impact assessment (TIA) is needed for SCC transfers.

22. Retention periods

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations.

23. No automated decision-making; how the AI works

We do not make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

How the AI in Jarvis works: an AI language model analyses your request, plans the necessary steps and carries them out using the App's tools on your PC (e.g. opening an app, drafting a message, adding an item to a basket). You yourself decide what happens without asking via the autonomy mode ("Full auto", "Smart", "Careful") and your payment limit. Orders, payments and messages are made on your instruction and in your name; they are not decisions about you. Certain safety rules are hard-coded in the program (e.g. asking before payments above your limit, before flagged downloads and before mass deletions); the AI cannot confirm such a question on your behalf. The AI can make mistakes – please check important results (see AI notice).

We also automatically check your licence status and usage limits. If your plan's limit is reached, AI tasks are paused until the next period; this is part of the contractually agreed service.

TODO(lawyer): Confirm this assessment, in particular for orders in "Full auto" mode and for the automatic pause when usage limits are reached (possibly Art. 22(2)(a) GDPR).

24. Your rights

You have the following rights against us regarding your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR, see Section 25),
• right to withdraw consent (Art. 7(3) GDPR, see Section 26).

To exercise your rights, a message to [EMAIL] is sufficient. You can export and delete locally stored data yourself in Settings.

25. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process data for direct marketing, you can object at any time without giving reasons. The objection can be made informally, e.g. by email to [EMAIL].

26. Withdrawal of consent

You can withdraw any consent you have given (e.g. for crash reports, telemetry, non-essential cookies) at any time with effect for the future – in the App's Settings, via the website's cookie settings or by email to [EMAIL]. The lawfulness of processing carried out before the withdrawal remains unaffected.

27. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:

[COMPETENT SUPERVISORY AUTHORITY, ADDRESS, WEBSITE]

TODO(owner): The competent authority is the data protection authority of the German federal state in which you are established ([FEDERAL STATE]).

28. Obligation to provide data

Providing the data required to conclude and perform the contract (e.g. email address, payment data, content of your requests) is necessary; without this data we cannot conclude the contract or provide the AI features. Consents (e.g. crash reports, telemetry) are voluntary; refusing them has no disadvantages for using the App.

29. Children and young people

Jarvis is not directed at persons under [MINIMUM AGE - TODO] years of age. We do not knowingly process data of persons below this age. If we learn that this happens, we delete the data. Where processing is based on consent, such consent is only valid in Germany from the age of 16 (Art. 8 GDPR); below that age, parental consent is required.

TODO(owner) + TODO(lawyer): Set the minimum age (recommendation: 18, since orders/payments can be made on the user's behalf). Check minimum-age requirements in Anthropic's usage policies.

30. Data security

We use technical and organisational measures to protect your data, in particular encrypted transmission (TLS) between the App, our servers and the service providers, access protection via licence and pairing keys, limiting stored data to what is necessary, and [TODO(owner): further measures].

TODO(owner) + TODO(lawyer): Create a record of processing activities (Art. 30 GDPR) and documentation of technical and organisational measures (Art. 32 GDPR). Check whether a data protection impact assessment (Art. 35 GDPR) is required – likely, given screenshots, continuous microphone processing, third-party data and the use of new AI technology.

31. Changes to this privacy policy

We will update this privacy policy if the features of Jarvis, our service providers or the legal situation change. The current version is available at [WEBSITE URL]/privacy and in the App. We will inform you about material changes in the App or by email.