Privacy Policy

This Privacy Policy explains how Trailing Comma, Inc., a company incorporated in Delaware, USA, doing business as Jsonify ("Jsonify", "we", "us", or "our"), collects, uses, and protects personal data when you visit our website or use our platform, products, APIs, and Services (collectively, the "Services"). Our operations are run from Lisbon, Portugal; our postal address is in Section 13.

This Privacy Policy applies to:

• Visitors to our website;
• Users of the Jsonify platform;
• Representatives of customers, partners, and vendors;
• Individuals whose data may be incidentally collected during Jsonify’s online data collection.

1. Roles and Scope

Depending on the context:

• Jsonify acts as a data controller for personal data relating to website visitors, customer accounts, billing, communications, platform administration, and the data Jsonify collects for its own business purposes.
• Jsonify acts as a data processor when processing data (including personal data) on behalf of self-serve customers through customer-configured pipelines, under the Data Processing Addendum.
• Where a signed agreement with a customer sets out different roles, that agreement governs for the processing it covers.

This distinction is important under applicable data protection laws, including the EU General Data Protection Regulation ("GDPR").

2. Personal Data We Collect

2.1 Data You Provide Directly

We may collect the following categories of personal data:

• Name, email address, company name, role, and contact details;
• Account credentials and authentication information;
• Stored browser sessions (session cookies) for accounts you connect to a source under Section 6 of the Terms. These are held encrypted, are used only to run your pipelines, and are deleted when you disconnect the account or close your Jsonify account. Jsonify does not store the password for a connected account;
• Billing and payment information;
• Communications with us (emails, support requests, feedback);
• Any information you voluntarily submit through forms or correspondence.

2.2 Data Collected Automatically

When you use the Services or visit our website, we may automatically collect:

• IP address;
• Device, browser, and operating system information;
• Usage data, logs, timestamps, and interaction metadata;
• Cookies and similar technologies (see Section 8).

2.3 Data Collected from Public Websites and Apps

Jsonify collects publicly available commercial data from websites and mobile apps — product listings, prices, availability, menus, and similar information — to build datasets for its customers. Jsonify may also collect public commercial data to build datasets it offers to more than one customer; such datasets are built from Jsonify’s own pipelines, not from rows delivered to a customer. Jsonify’s own pipelines target products and services, not people.

Provider-sourced data. For some sources, Jsonify obtains data through a third-party fetch provider listed on our subprocessors page, which collects the requested pages on Jsonify’s instruction. This can include professional information individuals have made public, such as name, job title and employer. Jsonify handles it as the requesting customer’s processor, delivers it only to that customer, and does not keep it for its own use. Removal requests are honoured in the same way.

Personal data can be incidentally included in what a public page shows: for example, a username attached to a product review. Where that happens:

• What is collected: the content the public page displays, such as review text, a display name or username, a rating, and a date;
• Where from: the public websites and apps configured in the relevant pipeline;
• Who receives it: the customer that commissioned the dataset, and the subprocessors listed on our subprocessors page that host and process data on our behalf;
• How long: for as long as the dataset it belongs to remains in service for the relevant customer or use case, after which it is deleted or refreshed; see Section 6.

Raw fetched content may be cached for a limited period and shared across pipelines so that sources are requested fewer times; that cache describes pages, and rows built from it go only to the customer that commissioned them. In most cases this data does not enable Jsonify to identify individuals directly. Collection targets commercial fields and reads public content, or content an account the customer has connected under Section 6 of the Terms is entitled to see; pipelines may not be used to locate or surveil individuals; removal requests are honoured. Pseudonymisation and filtering of personal-data fields can be configured into a pipeline. To ask about or object to data collected about you, see Section 7 and our privacy request form.

2.4 Customer-Provided Data Processed via the Services

Our business customers may configure our Services to process data sourced from third-party websites or documents. Such data may include personal data.

In this context:

• The customer determines the purpose and means of processing;
• Jsonify processes such data solely on the customer's documented instructions.

3. How We Use Personal Data and on What Lawful Bases

If you are a website visitor or a platform user, we process your analytical data to operate our website and platform and ensure its stability and availability. We rely on our legitimate interest in providing a functional Service.

We also measure traffic on our website and determine the source of visits. We do this without storing anything on your device, and we rely on our legitimate interest in understanding how our website is used. Outside the EEA, the UK and Switzerland we additionally measure advertising campaigns, personalise ads and recognise business visitors, using cookies and similar technologies. Section 8 describes exactly what loads where.

If you are a user of our platform or a representative of customers, partners, and vendors, we may process your personal data to: provide, operate, and maintain the Services; manage accounts, authentication, and billing; communicate with you; and provide customer support. In such cases, we rely on the performance of the contract between Jsonify and you.

We may send product news and marketing to business contacts based on our legitimate interest; you can opt out at any time. Requests to Jason and pipeline configurations are processed by large language models operated by our subprocessors; messages and emails from Jason are generated by AI.

We also work towards improving and securing our Services and preventing fraud, abuse, or security incidents. In such cases, we rely on our legitimate interest to improve the operation of our Services, their functionality, and their security, as well as to protect our legitimate interests, such as safeguarding our databases and our information systems.

When we collect public commercial data as described in Section 2.3, we may incidentally collect personal data. Collection targets commercial fields and reads public content, or content an account the customer has connected is entitled to see, and removal requests are honoured. These operations are carried out based on our legitimate interest in operating a data-collection service for business customers.

We may also have to process any of your personal data to comply with our legal obligations; for example, in response to an administrative authority or court order, or a request by you or your representative to exercise your rights.

We do not use customer data to train models, create aggregated datasets from customer data, or for unrelated commercial purposes. Jsonify may generate de-identified, aggregated operational metrics about the Services (such as source counts and repair statistics) that do not reveal customer data or personal data.

Jsonify owns its pipeline code, including extractors, and technical knowledge of website and app structures. Extractors built on an account a customer connects or credentials a customer supplies are not reused for other customers. These platform assets exclude customer schemas, source lists, rows delivered to customers, credentials, personal data and confidential business information. This ownership distinction does not change our processing instructions or data-protection obligations. See Customer Data and Platform Ownership.

4. Data Sharing and Disclosure

We may share personal data with:

• Service providers and subprocessors (hosting, payment processing, analytics, support tools, and the large-language-model providers described in Section 9) — see our subprocessors page;
• Customers, where personal data is incidentally included in a dataset collected for them, or provider-sourced at their request (see Section 2.3);
• Professional advisers (legal, accounting);
• Authorities where required by law.

Subprocessors are bound by contractual obligations to protect personal data and act only on our instructions.

We do not sell personal data.

5. International Data Transfers

Trailing Comma, Inc. is incorporated in Delaware, USA, and operates internationally. Personal data may be processed in the United States and in the European Economic Area.

Where required, we rely on appropriate safeguards for international transfers, such as adequacy decisions or Standard Contractual Clauses approved by the European Commission. You can request a copy of these safeguards by emailing us at paul@jsonify.com.

6. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected:

• Account and business-contact data is retained for the duration of our contractual relationship, and for up to 3 years after the relationship ends where we have an ongoing business-development interest;
• Billing records are retained as long as applicable accounting law requires (up to 10 years in some jurisdictions);
• Payment data is retained as long as needed to process the payment and handle disputes, and no longer than applicable payment regulations require;
• Website and platform analytics data is retained for a maximum of 13 months from collection;
• Stored browser sessions for connected accounts are retained until you disconnect the account, the session expires and is replaced, or your Jsonify account is closed;
• Public commercial data collected for datasets, including incidental personal data, is retained for as long as the dataset remains in service, and is deleted or refreshed when it no longer is; incidental personal data is not kept independently of its dataset.

7. Your Rights

Depending on your location and the applicable circumstances, you may have rights including:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
• Right to rectification: to request the correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): to request the deletion of your data.
• Right to restriction of processing.
• Right to data portability: to receive your data in a structured, commonly used, and machine-readable format.
• Right to object: to object to the processing of your data based on our legitimate interest.
• Right to withdraw consent: at any time, when processing is based on your consent.
• In France, the right to set instructions regarding the handling of your data after your death.
• Right to lodge a complaint with a supervisory authority — in the EU, the data protection authority of your member state (in Portugal, the CNPD); in the UK, the Information Commissioner's Office.

If you believe information relating to you has been included in datasets we collect from public sources, submit a request through our privacy request form or the contact details below. Provide enough information to identify the relevant data — for example a username, the website concerned, or other context. We will take reasonable steps to determine whether your personal data is being processed and respond within one month, extendable where the law allows, in accordance with our role as controller or processor. Where a customer controls the data, we may refer your request to them and will tell you when we do.

8. Cookies and Analytics

We do not show a cookie banner. In the EEA, the UK and Switzerland our website stores no cookies or other identifiers on your device for analytics or advertising, so there is nothing to ask consent for. Here is what loads, and where.

Everywhere: cookieless traffic measurement. We measure page views and clicks with PostHog in cookieless mode. No cookie, local storage or other identifier is placed in your browser. To count visitors, PostHog's servers compute a one-way hash from your IP address, your browser's user-agent string and our hostname, together with a random salt that changes every day and is then deleted. The IP address is discarded and is not stored with the events. The hash cannot be reversed, and the same visitor cannot be recognised from one day to the next. Events are received through our own domain (p.jsonify.com) and stored in the EU.

Everywhere: Google tag in cookieless mode. Google's tag (Google Analytics and Google Ads) loads with every consent signal set to denied. In that state it sets no cookies and sends only cookieless, aggregated pings that Google uses for modelled statistics. Google processes these under its own terms.

Outside the EEA, the UK and Switzerland only. When your connection comes from another country, we also:

• enable Google Analytics and Google Ads cookies, to measure campaigns and personalise ads;
• load Apollo's visitor tracker, which identifies the company a business visitor works for so that our sales team can follow up;
• store the campaign or referrer that first brought you to our website in your browser's local storage, so that a later sign-up can be attributed to it.

We determine your region from the country of your network connection. If it cannot be determined, we treat you as being in the EEA.

Operation. The platform at factory.jsonify.com uses strictly necessary cookies to keep you signed in and to protect against abuse. They are not used for analytics or advertising.

You can block or clear cookies and local storage through your browser settings at any time; the website keeps working without them. Analytics data is retained for at most 13 months (Section 6).

9. Security and Service Providers

Security. We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and logging. No system is perfectly secure; we will notify affected parties of personal-data breaches as applicable law requires.

Credentials. Account authentication is handled by our identity provider. Sessions for accounts a customer connects under Section 6 of the Terms, and source credentials supplied under an enterprise agreement, are stored encrypted, used only for that customer’s collection, and never shared across customers.

Service providers. We use Stripe for payments and invoicing, HubSpot for our CRM and email to business contacts, and Formspark to deliver requests submitted through the privacy request form. Analytics and advertising providers are described in Section 8. These providers process personal data on our behalf under contractual obligations to protect it.

Connected AI assistants. When you connect an assistant to Jsonify, the connector returns information needed for your requests from the organisations you authorise: organisation name; workspace names and identifiers; pipeline, dataset, run and conversation identifiers; pipeline status and schedules; row counts and allowance or run estimates; dataset schemas and the dataset rows you request; Jason replies and prepared briefs; and links, pagination and action-confirmation tokens. During onboarding it also returns the private preparation token described below. Dataset rows may contain personal data collected from your chosen sources. Your assistant provider receives these tool responses and processes them under its own terms and privacy policy. We do not return account passwords, OAuth access or refresh tokens, stored source credentials or payment details in connector tool results.

AI assistant onboarding tokens. When you prepare a brief through a connected AI assistant, Jsonify returns a private preparation_token and conversation identifier to that assistant, including the token in the signup link. This token is a random possession proof scoped to that onboarding conversation, not a password, API key or OAuth access or refresh token, and it is not signed. Possession allows access to the preparation and transfer into browser signup, so keep the token and link private. The token expires after 24 hours if the preparation remains unclaimed; after it creates a workspace, access requires the authenticated workspace owner. MCP requests separately require OAuth sign-in. Jsonify stores a hash of the random secret to verify the token. The assistant provider receives the token as part of the tool response and processes it under its own terms and privacy policy.

Language models. Jsonify uses third-party large language models to build and repair pipelines. Content from configured sources may be processed by these providers as subprocessors, under terms that do not permit them to train models on it. See the subprocessors page.

10. US State Privacy Rights

Residents of certain US states (including California) may have rights to know, access, correct, and delete personal information, and to opt out of sales or sharing of personal information. Jsonify does not sell personal information of its website visitors or platform users. For data we process on customers' behalf, we act as a service provider under our Data Processing Addendum. To exercise these rights, use the contact details below; we will not discriminate against you for doing so.

11. Children's Data

The Services are for business use and are not directed to anyone under 18. We do not knowingly hold personal data of children as account holders, and our terms prohibit collecting personal data relating to children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last updated" date, and material changes affecting account holders are notified by email.

13. Contact Us

If you have questions or requests regarding this Privacy Policy or personal data processing, please contact:

Trailing Comma, Inc. (d/b/a Jsonify)
1111b South Governors Avenue
Dover, DE 19904, United States
Email: paul@jsonify.com