Jarel
Legal
Last updated: November 2026
Bizlution AB ("Jarel", "we", "us") is the data controller for personal data processed through the Jarel platform. Bizlution AB is incorporated in Sweden and headquartered in Gothenburg. Our primary contact for data protection matters is privacy@jarel.se.
We collect information you provide directly: name, work email address, organization name, and role. We also collect data created through your use of the Service, including documents you upload, AI queries and responses, audit log entries, and usage metrics (session duration, feature interactions). We collect technical data such as IP address, browser type, and device identifiers for security and performance purposes.
We use your data to: (a) provide and operate the Service; (b) authenticate your identity and authorize access; (c) generate AI-powered analysis and document outputs in response to your requests; (d) maintain audit logs for security and compliance; (e) send transactional communications (access invites, security alerts); (f) improve the reliability and performance of the Service; (g) learn how the app is used so we can make it better: when you use a feature, our servers count it (for example that a message was sent and its length as a range such as 200 to 1,000 characters, how long the reply took, whether a card in a reply was answered, and the type and size range of a file you uploaded), linked to your pseudonymous account ID. We never record the text of messages, documents, file names or searches. They also note which area of Jarel an action belonged to (for example that a redline was started, never what was in it) and that you were active on a given day, which is how we see whether people come back. Our servers also note, for each AI call, which model answered, how many tokens it used, how long it took, what it cost and whether it failed, and, when our software throws an error, the error type and where in the code it happened (never the error message, and never tied to you). These counts need nothing stored on or read from your device. You can object to them at any time by writing to privacy@jarel.se. If you said yes to email from Jarel when you set up your account and then stop using the app for a couple of days, we may send you up to three short messages over your first month, at least three days apart: a personal question about how you found Jarel, a suggestion for your kind of work, and an overview of what Jarel can do. We stop when you are active again or unsubscribe. We use your name, email address, the role you chose in the setup, your language, the country your sign-up request came from (coarse, from the network, used only to name the law sources we cover there) and the dates of your last activity for this, never the content of your chats or documents, on the basis of your consent. Separately, when you create an account we send one welcome message about how to get started, which needs no consent because it is part of providing the Service. Replying is optional, and you can withdraw your consent at any time with the unsubscribe link in the email or in Settings.
Documents you upload and queries you submit are processed to provide the Service. They are stored securely, encrypted at rest (AES-256) and in transit (TLS 1.2+). Customer content is not used to train Jarel models. Model providers are configured not to train on it where their terms support that. Jarel employees do not access your documents except where required for support with your explicit consent. To work the way you prefer, Jarel's AI can save short notes about how you work (for example "memos under one page") and, once you confirm them, positions and facts from your matters. These notes serve only your own requests, across your AI team and chats, and are never shown to other users. You can see, confirm or delete them at any time in the app. Requests to AI models go through the Vercel AI Gateway, which asks every model provider for zero data retention and no training; requests are only sent to providers that agree. Text requests to the AI model are also pinned to the EU: OpenAI runs them in an EU data center, and if that is not possible the request fails instead of running elsewhere. The request can still pass through Vercel's gateway outside the EU on its way, and OpenAI keeps requests it flags for abuse under its own rules. If the EU data centers are unavailable we may lift the EU pin for a while so the Service keeps working; requests then run wherever the gateway routes them, still with zero data retention and no training. Some helpers are not pinned to the EU. Two helpers do not offer zero data retention: the reranker (Cohere), which sees search queries and retrieved passages, and the fallback web search (Perplexity), which sees only web search queries. Neither uses the data for training, and the reranker has no EU region. A small yes-or-no model (Typesafe Jev) screens documents before a large review and makes quick agent decisions. It sees up to 6,000 characters of each document screened, runs with zero data retention and no training through the Vercel AI Gateway. According to the gateway's listing it is available only in the United States, and it is not pinned to the EU. Audio takes a different route. When you dictate or upload an audio or video recording, the audio is sent through the Vercel AI Gateway to OpenAI in the United States to be turned into text. When you talk to Jarel in voice mode or have a reply read aloud, the audio (for read-aloud, the text) is sent to OpenAI in the United States. OpenAI does not use it for training. Unlike text requests, audio is not covered by a zero data retention commitment. Under OpenAI's published API data controls, audio sent for transcription is not stored after the text is returned, while voice-mode audio and read-aloud text may be kept by OpenAI for up to 30 days to detect abuse and are then deleted. Jarel keeps the resulting text like any other message or document. It does not keep dictated or spoken audio; a recording you upload is stored as a file, like any other document, if it is 25 MB or smaller; for larger recordings only the transcript is kept.
For users in the European Economic Area, we process your data on the following legal bases: (a) Contract — processing necessary to provide the Service; (b) Legitimate interests — security monitoring, fraud prevention, service improvement (including the usage counts in section 3), and learning which marketing channels bring customers; (c) Legal obligation — compliance with applicable laws. Where we rely on legitimate interests, you have the right to object to that processing.
We share data only with: (a) your workspace administrator, who manages your account; (b) subprocessors who help us deliver the Service (listed on our Security page); (c) law enforcement or regulators where required by law. We do not sell personal data. A full subprocessor list is available at jarel.se/security or on request. When you connect a Google account (for example Gmail, Calendar or Drive), Jarel's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to do what you ask, we do not use it for advertising, we do not sell it, and we do not use it to train AI models. People at Jarel do not read it unless you ask us to for support, it is needed for security, or the law requires it.
We retain your personal data for as long as your workspace account is active. Upon account termination, personal data is deleted within 90 days, except where retention is required by law. Anonymized usage statistics may be retained indefinitely. Usage counts and product analytics events linked to your account ID are deleted after 13 months. You may request deletion of your data at any time by contacting privacy@jarel.se. Audit log entries (who did what and when, never the content of your documents or chats) are not deleted when an account or workspace is deleted. We keep them as a record for security and legal reasons.
Workspace data is stored in Dublin, Ireland. Some processors, including our AI model provider, process data outside the EEA; the subprocessor list on our Security page shows where. Where personal data is transferred outside the EEA, we rely on a safeguard under Chapter V GDPR, such as the EU-US Data Privacy Framework or Standard Contractual Clauses. Which safeguard applies to each processor is not yet listed there; ask privacy@jarel.se. Additional residency options are discussed only for eligible enterprise deployments.
Under GDPR and applicable Swedish law, you have the right to: access your personal data; correct inaccurate data; request deletion ("right to be forgotten"); restrict or object to processing; receive your data in a portable format; withdraw consent at any time. To exercise any of these rights, contact privacy@jarel.se. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.
We use strictly necessary cookies to authenticate sessions and maintain security. With your consent, we also use PostHog (product analytics, EU, including session replay, click heatmaps error reports and page-speed measurements; all text and form fields inside the app are masked, so documents and chats are never recorded; after several finished replies we may also ask once, at most every 90 days, how likely you are to recommend Jarel, and store only your score from 0 to 10 with no free text), Google Tag Manager, Google Analytics and Google Ads, and the Meta Pixel to understand site performance and measure campaigns. Where we count visits to our public marketing pages anonymously, we send a page-view event to PostHog without cookies or local storage, without a person profile, and whatever your cookie choice is; we use it only to see which pages and channels bring visitors. If you have not made a choice, the sign-up page may do the same. If you click one of our Google ads and accept cookies, we save Google's click identifier with your account. When you pay for a plan, we tell Google Ads the amount of that payment (not your name or email address) so we can see which ads bring paying customers. We do not do this if you decline cookies, and you can withdraw your consent at any time. To learn which channels bring customers, we keep with your account how you came to sign up: the campaign tags in the link (for example utm_source=google) and the site you came from (for example google.com), also if you have not accepted cookies. If you accept cookies, your browser also keeps a list of how you arrived at Jarel (at most 20 visits, for 90 days: the channel, the campaign tags, the referring site and which kind of ad was clicked, never the pages you read), and we add it to your account once you are signed in, including later visits. We use these touches, also in PostHog, only to split the credit for a customer between our marketing channels. They are deleted with your account, and rejecting cookies clears the list in your browser. You can change your choice at any time with Cookie settings in the footer. The cookies are listed in our Cookie Policy. The client portal loads no analytics or advertising cookies. Inside the app we ask separately whether you want to help improve Jarel: with an unticked box at sign-up, once in the app, and in Settings under Profile. If you say yes, PostHog records clicks, heatmaps and screen recordings of the app with all text, form fields, files and images hidden, so documents and chats are never recorded. This answer is stored with your account together with when you gave it, and while you are signed in it decides whether PostHog runs, instead of the cookie banner; advertising cookies always follow the banner. Saying no is as easy as saying yes, and you can change your answer at any time in Settings.
We implement security-conscious measures including encryption at rest and in transit, multi-factor authentication options, role-based access controls, and audit logs for review where available. For a detailed description of our security practices, see our Security Policy at jarel.se/security.
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at privacy@jarel.se.
The Jarel iOS and Android apps process the same categories of data described above. In addition: (a) Microphone — when you initiate a voice query or dictation, the app captures audio on-device; audio is sent to OpenAI for transcription as described in section 4; Jarel does not keep the audio; (b) Speech Recognition — Apple's on-device speech recognition may be used and is governed by Apple's privacy terms; (c) Push Notifications — if you grant permission, your device's push token is stored to deliver alerts (security events, completion notifications); you can revoke this in iOS/Android settings at any time; (d) Local storage — auth tokens and cached content are stored in the iOS Keychain / Android Keystore and the app sandbox; (e) Usage — the app sends pseudonymous usage events to PostHog and does not send crash reports to any external service. The mobile app does not use advertising SDKs or cross-app tracking; (f) Photos — the app reads a photo only when you choose one to attach. We do not access your contacts or location. The desktop app for Mac and Windows shows the same web app and adds no analytics or cookies of its own. The Windows app checks for updates with our update host (Microsoft Azure), which sees your IP address and app version.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-product notification at least 30 days before they take effect. The date of the most recent revision appears at the top of this page.
For privacy questions, data subject requests, or DPA enquiries, contact privacy@jarel.se or write to: Bizlution AB (org. no. 559264-7050), Kalvhagen 7, 427 50 Billdal, Sweden. We aim to respond to all requests within 72 hours and to resolve them within 30 days.
Questions about this policy? Contact privacy@jarel.se. See also our Terms of Service and Security Policy.