Privacy Policy

• When you sign up: your name, email address and (if you provide it) phone number, plus a hashed password.
• When you onboard: an audio recording of your voice intro with Jonty, a written transcript of the call, and details you tell Jonty about your business (sectors, regions, contract sizes, what you do).
• When you use Jonty: which opportunities you view, save or skip; your interactions in chat; and anonymous product usage telemetry.
• When you pay: our payment processor handles your card details directly. We only store your customer ID, plan and subscription status.
• When you upload documents: tender packs and documents you add to your Vault are malware-scanned and read inside an isolated, single-use sandbox before we process them.

For voice recording, our legitimate-interest assessment concluded that recording is necessary for service quality, expected by users (a notice is shown before the call begins), and low-impact relative to the benefit of better matches.

Your data is processed by trusted service providers in the following categories:

• Cloud infrastructure (hosting, storage, databases) in the UK
• Voice and AI processing providers (speech-to-text, text-to-speech, large language models)
• AI processing of your documents (reading them, building your search index, analysing tender packs) runs in the EU on Microsoft Azure OpenAI in the EU data zone, with storage in Sweden, and on Google Cloud Vertex AI in the EU. Neither uses your data to train models, and our code refuses to send this work anywhere else, with one exception that runs only if you ask for it: scoring which pages of your Vault answer a question, described in the next entry.
• AI matching, which scores public tender notices against your business profile, uses TypeSafe, an AI classification provider hosted in the United States. For each tender we send the public notice and a description of your business (what you do and how you deliver it, including a summary we derive from your onboarding call, your services and capabilities, the sectors you target, what you exclude and your deal-breakers). Before sending, our code removes your company’s name and your team members’ names from that description, and email addresses, phone numbers and web links from both. Only if you ask us to switch it on, TypeSafe also scores which pages of your Vault answer a question asked of it: for each page we send the question and that page’s text, with the same details removed, and nothing else from your Vault. Other people’s names on those pages, such as staff named in a bid or a referee, are not removed. TypeSafe returns scores only, does not use what we send to train its model, and never receives your call recordings, transcripts or chat, or any of your documents unless you have switched Vault scoring on. This transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Web search for company, buyer and people research, including research into your own company’s public information when you sign up, uses Tavily, a search provider hosted in the United States. It receives search queries only, such as company names and websites, buyer names and the names of people you ask Jonty to research. We use Tavily under its standard terms, without a data processing agreement, and those terms allow it to keep queries and use them to improve its service.
• Email delivery providers for transactional emails
• Text message and phone providers for verification codes
• Payment processing
• Bot protection on sign-up
• Internal team messaging, for account notifications and for reviewing our replies to your messages
• Product analytics and error monitoring

Some providers operate outside the UK. Every transfer except web search relies on UK adequacy regulations (for the EU, and for US providers certified under the UK Extension to the EU-US Data Privacy Framework), a UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Web search has no transfer safeguard yet, as described above. You can ask us which safeguard covers any provider.

Microsoft applies its standard abuse monitoring to the Azure OpenAI service. Where its automated classifiers flag a pattern of abuse, text we send to Azure OpenAI, whether to build your search index or for a model call, may be sampled, stored in Sweden and reviewed by authorised Microsoft staff located in the EEA. It is never used to train models. We are applying to Microsoft for this monitoring to be limited to automated review only.

We never sell your data and we do not share it with marketers, advertisers or data brokers.

• Audio recordings: 30 days, then automatically deleted from storage.
• Transcripts, profile and account data: for as long as your account is active.
• After you close your account: we delete your data within 30 days, except where we are legally required to retain it (for example, billing records kept for six years for HMRC).
• Backups: deleted data may persist in our encrypted backups for up to 7 days after deletion, as part of our standard backup cycle.

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct anything that is wrong
• Delete your data (the “right to be forgotten”)
• Restrict how we use it
• Object to processing carried out under legitimate interest, including the voice recording
• Receive your data in a portable format

To exercise any of these rights, email us at jonty@askjonty.ai. We will respond within one month.

If you are unhappy with how we handle your data, you can lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk (opens in a new tab).

Jonty uses AI to match you with public-sector opportunities. These matches are suggestions, not decisions with legal effect. You can review every match, save it, skip it or ignore it. Jonty does not make automated decisions that legally bind you.

For more detail on how we handle the audio of your onboarding call, see our Recording Policy.

Data controller: Jonty AI Inc.
Email: jonty@askjonty.ai