Privacy Policy - Jodie

Last Updated: 21 October 2026

Welcome to Jodie AI Limited ("Jodie," "we," "our," or "us"). We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal information when you visit our website https://heyjodie.com (the "Website"), as well as your rights under UK data-protection laws.

1. Who We Are

• Name of Entity: Jodie AI Limited (the "Data Controller")
• Company Number: 16685106
• Registered Address: 45 Albemarle Street, Mayfair, London, W1S 4JL
• Contact Email: team [at] heyjodie.com
• Data Protection Officer: data-protection-officer [at] heyjodie.com

We are responsible for deciding how and why we hold and use your personal data. Should you have questions about this Privacy Policy or wish to exercise any legal rights, please contact us using the details above.

Our Role (Controller vs. Processor): For personal data collected when you visit our Website, create a Jodie account, or communicate with us directly, we act as the Data Controller. When callers contact a business that uses Jodie and we process that caller's personal data on the business's behalf (for example, call audio and transcripts produced when Jodie answers a call), we act as a Data Processor on the instructions of the Jodie subscriber, who is the Controller of that data. If you are a caller with a request about a specific call, please direct it to the business you were trying to reach; they are responsible for responding.

2. What Information We Collect

We may collect and process the following categories of personal data:

1. Identification & Contact Details

   • Name, email address, phone number, and postal address.

2. Call & Communication Information

   • Call audio and recordings, voicemail, AI-generated transcripts and summaries, caller telephone numbers, call metadata (time, duration, routing), messages, bookings and similar information generated when calls are handled through the Services. Where this data relates to callers contacting a Jodie subscriber, we process it as a Processor on the subscriber's behalf (see section 1).

3. Account & Login Information

   • Username, password (hashed), or other account credentials if you register an account.

4. Financial Information

   • Payment details or bank information (if relevant to transactions or fees).

5. Marketing & Communications Data

   • Your preferences for receiving marketing communications from us; social-media handles if you connect via social platforms.

6. Technical & Usage Data

   • IP address, browser type, device identifiers, cookie and pixel data, session re-play recordings, click paths, scroll depth, heat-map statistics, and other information about how you interact with our Website and marketing emails.
   • Sources: collected automatically via cookies, pixels, JavaScript, and similar technologies from:
     • Google Analytics 4 (GA4)
       Behavioural analytics (page views, events, user flows, approximate geolocation).
     • PostHog
       Product analytics, session re-play and heat-maps, hosted in the EU (Frankfurt, Germany).
     • Meta (Facebook) Pixel
       Conversion tracking, ad attribution, and custom-audience building.
     • TikTok Pixel
       Conversion tracking, ad attribution, and audience measurement for TikTok advertising campaigns.
     • Reddit Pixel
       Conversion tracking and ad attribution for Reddit advertising campaigns.
     • LinkedIn Insight Tag
       Conversion tracking, website demographics, and retargeting for LinkedIn advertising campaigns.
     • ProveSrc
       Website verification and trust signals for social proof and credibility.
     • Tolt
       User engagement tracking and behavioral analytics.
     • Intercom
       Customer support chat functionality and user communication management.

7. Other Data You Provide

   • Any other personal data you voluntarily share with us when filling out forms or contacting us (e.g., support queries).

Sensitive information: Call and message content may include health or other sensitive information supplied by callers or subscribers. Where we process that information on a subscriber's behalf, the subscriber is responsible for the additional lawful basis, notices and safeguards required, as set out in Annex A of the Data Processing Addendum. Where we act as Controller, we will rely on explicit consent or another applicable legal condition before processing special-category personal data. Please avoid providing sensitive information that is not needed for the relevant purpose.

3. How We Collect Your Data

• Direct Interactions: You provide data when you fill out forms, register for an account, request services, or communicate with us.
• Automated Technologies: As you navigate the Website, GA4, PostHog, Meta Pixel, TikTok Pixel, Reddit Pixel, LinkedIn Insight Tag, ProveSrc, and Tolt automatically collect Technical & Usage Data through cookies and similar technologies.
• Third Parties: We may receive personal data from analytics providers (Google, PostHog, Meta, TikTok, Reddit, LinkedIn, ProveSrc, Tolt), payment processors, and marketing partners.

4. Why We Process Your Data (Legal Bases)

We use your personal data only where UK law permits. Common lawful bases include:

1. Consent

   • Where you give explicit consent (e.g., when accepting optional analytics or marketing cookies).

2. Contractual Necessity

   • To perform our obligations under a contract (e.g., providing services you've registered for).

3. Legal Obligation

   • To comply with UK legal or regulatory requirements.

4. Legitimate Interests

   • To operate, improve, and secure our Website; analyse how it is used; prevent fraud; and market our services (including through GA4, PostHog, Meta Pixel, TikTok Pixel, Reddit Pixel, LinkedIn Insight Tag, ProveSrc, and Tolt), provided such interests do not override your rights and freedoms.

5. How We Use Your Data

We may use your personal data to:

• Provide Services: Facilitate services, maintain your account, and process transactions.
• Customer Support: Handle your inquiries, troubleshoot issues, and manage customer-service requests.
• Marketing & Communications: Send newsletters or promotions (only if you have opted in). You can withdraw consent at any time.
• Analytics & Improvements:
  • GA4 helps us understand traffic sources, popular pages, and overall Website performance.
  • PostHog provides product analytics, session re-plays and heat-maps so we can see where users experience friction and improve usability.
  • The Meta Pixel lets us measure the effectiveness of our ads and reach users with more relevant content.
  • TikTok Pixel allows us to track conversions and optimise our TikTok advertising campaigns.
  • Reddit Pixel helps us measure the effectiveness of Reddit advertising and reach relevant audiences.
  • LinkedIn Insight Tag enables us to track conversions and gather insights about our LinkedIn advertising performance.
  • ProveSrc provides website verification and social proof to enhance user trust and credibility.
  • Tolt tracks user engagement and provides behavioral analytics to improve user experience.
  • Intercom enables customer support chat functionality, allowing us to communicate with users and provide assistance.
• Legal & Compliance: Comply with regulatory requirements, detect fraud, or enforce our rights.

6. Cookies, Pixels & Tracking Technologies

Our Website relies on first-party and third-party cookies, pixels and local-storage objects to function. We use them to:

• Store user preferences and session information.
• Analyse traffic and user interactions via Google Analytics 4 and PostHog.
• Measure advertising performance through the Meta Pixel, TikTok Pixel, Reddit Pixel and LinkedIn Insight Tag.
• Provide website verification and social proof through ProveSrc, and engagement analytics through Tolt.
• Enable customer-support chat functionality through Intercom.

These technologies are integral to how the Website is delivered. If you do not want them to run in your browser, you can disable cookies or similar tracking via your browser settings, or stop using the Website. By continuing to use the Website, you acknowledge that these cookies and similar technologies are necessary for the Website to function as intended.

You can also manage advertising preferences directly with the providers listed below.

Opt-Out Links

7. Who We Share Your Data With

1. Service Providers

   • Analytics, advertising-pixel and customer-support vendors named in section 2: Google LLC (GA4), PostHog Inc. (PostHog, hosted in the EU in Frankfurt, Germany), Meta Platforms Ireland Ltd (Meta Pixel), TikTok Technology Limited (TikTok Pixel), Reddit Inc. (Reddit Pixel), LinkedIn Corporation (LinkedIn Insight Tag), ProveSrc Ltd (ProveSrc), Tolt Ltd (Tolt), and Intercom Inc. (Intercom).
   • Sub-processors that we engage to deliver the Services. Categories include telephony, speech and AI services, cloud hosting and storage, integrations, email and notifications, and support and operational tools. A non-exhaustive overview of providers we use or may use (including, but not limited to, Amazon Web Services, Twilio, Telnyx, ElevenLabs, OpenRouter, Anthropic, OpenAI and Google) is published in Annex C of our Data Processing Addendum. We choose among authorised providers, subject to the agreed-list, advance-notice and objection process in section 6 of the DPA; inclusion in the public overview alone is not authorisation.
   • Authorised Jodie personnel may review call recordings and related content for onboarding, quality review, support and troubleshooting. Full recordings and call content may also be copied to operational and support providers, including Slack, subject to the DPA. Those providers do not receive only alerts or metadata.
   • Payment services are provided through Paddle, which acts as merchant of record and an independent Controller for its payment and tax activities. Providers of services you independently select may also act under their own terms rather than as our sub-processors.

2. Business Partners

   • If you request or opt in to co-branded services or partnerships.

3. Legal or Regulatory Authorities

   • When required to comply with the law or to protect our rights.

4. Corporate Transactions

   • In connection with a sale, merger, or transfer of part of our business or assets, your personal data may be disclosed to the prospective buyer or merged entity.

We require our Processors and Sub-processors to be bound by the contractual protections required by applicable law and, for Subscriber Personal Data, the DPA. Other recipients may have their own Controller obligations. We do not warrant the acts or omissions of independent third parties; this does not limit our responsibility for Sub-processors under the DPA or any non-excludable duty. To the extent permitted by applicable law and transfer instruments, liability remains subject to the limitations and exclusions in our Terms of Service and DPA.

8. Where We Process Your Data (Data Residency and International Transfers)

The Services use processing locations in Ireland (within the European Economic Area) and the United States, with product-analytics data processed in Germany (within the European Economic Area) through PostHog's EU cloud. Call audio and recordings are stored on Amazon Web Services for our backend. These are service-wide disclosures, not a claim that every provider, data type or backup uses the same regions. Some telephony configurations support Australia, but Australian and other local numbers may also involve processing in the United States; a local number does not guarantee local processing. Annex D of our Data Processing Addendum explains the distinction between backend storage, processing and copies held by other providers. We may change locations subject to applicable law and the DPA's notice and transfer requirements. We do not guarantee single-region hosting unless agreed in writing and signed by us. If your business requires data to remain in a particular jurisdiction, you must agree that requirement with us before subscribing. To the maximum extent permitted by law, liability relating to processing locations remains subject to the Terms and DPA.

What is processed where

• Account, billing and support data (the data you provide when you sign up, contact us, or pay us): typically hosted in Ireland and the United States, with product-analytics data about your use of the Services processed in Germany, and payment data also processed by our payment processor in its operating regions.
• Call audio, recordings, transcripts, summaries, messages and bookings: handled by storage, telephony, speech and AI providers, including in the United States and the EU, with product analytics in Germany. Backend call audio and recordings are stored on Amazon Web Services; the applicable storage countries depend on the deployment configuration and must be identified in the agreed sub-processor list under section 6 of the DPA. Copies in support and operational tools, including Slack, use those providers' locations and retention arrangements subject to the DPA; they are not necessarily in the backend storage region.
• Website analytics, advertising-pixel and customer-support data: processed in Germany (PostHog), the United States and other locations as described by each provider in their own policies (see section 2).

Legal mechanisms for transfers outside the UK and EEA

For restricted transfers outside the UK or EEA, we use a lawful transfer mechanism before the transfer takes place. Depending on the transfer and recipient, this may be an applicable adequacy decision or regulations, or one of the following:

• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses (2021); or
• the EU-US Data Privacy Framework and its UK Extension, only where the recipient's valid certification and the applicable adequacy decision cover the transfer.

Where required, we carry out transfer assessments and apply supplementary technical and organisational measures, including encryption, access controls and contractual restrictions on further use. You may request information about the safeguards, including a copy where required by applicable law, by contacting our Data Protection Officer at data-protection-officer [at] heyjodie.com. Commercially sensitive information may be redacted only to the extent permitted by applicable law and the relevant transfer instrument.

Notice of sub-processor changes

For data we process on a subscriber's behalf as a Processor, section 6 of our Data Processing Addendum requires written notice at least fifteen (15) days before adding or replacing a sub-processor on the agreed list, with an opportunity to object on reasonable, documented data-protection grounds. Updating this policy or the public provider overview alone is not that notice. The DPA sets out how objections are handled and preserves mandatory rights.

9. How We Protect Your Information

We take technical and organisational measures to protect your personal data from unauthorised access or disclosure, including:

• Encryption (in transit and at rest, where appropriate).
• Secure data storage in controlled facilities.
• Access controls, multi-factor authentication, and staff training on data protection.
• Regular audits of our security controls and vendor due-diligence reviews.

Despite our efforts, no system is entirely secure. If you suspect your data or interaction with us is no longer secure, please notify us immediately.

10. Data Retention

We retain your personal data only for as long as reasonably necessary to:

• Fulfil the purposes for which it was collected.
• Satisfy any legal, regulatory, tax, accounting, or reporting requirements.
• Resolve disputes or enforce our legal agreements and policies.

Where we act as a Processor for a Jodie subscriber, call recordings, transcripts and related call data are retained for the duration and purposes described in Annex A of the DPA, subject to lawful deletion instructions and the return and deletion process in section 12. That process also covers copies held in support and operational tools and by sub-processors. Expiry of a playback link does not itself delete a recording or copies of it. The subscriber (as Controller) is responsible for lawful retention instructions and should contact us where its requirements are not supported by the available controls.

Retention periods for analytics data are controlled via GA4 (default 14 months), PostHog (in accordance with our configured PostHog retention settings; session recordings are kept for up to 90 days), Meta Pixel (in accordance with Meta's data-retention policies), TikTok Pixel (in accordance with TikTok's data-retention policies), Reddit Pixel (in accordance with Reddit's data-retention policies), LinkedIn Insight Tag (in accordance with LinkedIn's data-retention policies), ProveSrc (in accordance with ProveSrc's data-retention policies), Tolt (in accordance with Tolt's data-retention policies), and Intercom (in accordance with Intercom's data-retention policies). Once the retention period expires, we will securely delete or anonymise your personal data in compliance with applicable laws.

11. Your Rights

Under the UK General Data Protection Regulation (UK GDPR) and other applicable laws, you may have the right to:

• Access Your Data: Obtain a copy of the personal data we hold about you.
• Rectification: Request corrections to any inaccurate or incomplete data.
• Erasure (Right to be Forgotten): Ask us to delete your data under certain circumstances.
• Restriction of Processing: Request we limit how we use your data.
• Data Portability: Receive your data in a structured, commonly used format.
• Object to Processing: Object to certain processing activities, including direct marketing and analytics profiling.
• Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, contact us at team [at] heyjodie.com or our Data Protection Officer at data-protection-officer [at] heyjodie.com. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your personal data has been processed unlawfully or your data protection rights have been violated. You can contact the ICO at https://ico.org.uk/ or by calling their helpline on 0303 123 1113.

12. Children's Privacy

Our Website is not intended for individuals under the age of 13. We do not knowingly collect personal data from children. If you believe a child under the age of 13 has provided us with personal information, please contact us so we can investigate and delete it where required.

13. Links to Other Websites

Our Website may contain links to third-party sites not operated by us. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites or services before providing personal information.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. The "Last updated" date at the top indicates when it was last revised. Your continued use of our Website after we post any updates signifies your acceptance of the revised policy.

15. Additional Information for California Residents (CCPA / CPRA)

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies to our handling of your personal information, the following information is provided in addition to (and not in substitution for) the rest of this policy. Nothing in this section creates rights or obligations beyond those required by the CCPA/CPRA.

• Categories of personal information we collect: identifiers (name, email, phone, IP address, device identifiers); commercial information (transaction and subscription records); audio information (where you call a business that uses the Services, the call recording and transcript); internet or network activity (cookies, page views, session replay); geolocation (approximate, derived from IP); professional information (where you tell us your role); and inferences drawn from the above.
• Sources: directly from you, automatically as you use the Website, and from analytics, advertising and payment providers.
• Purposes: to provide and operate the Services, process payments, communicate with you, deliver and measure advertising, comply with law, and as otherwise described in this policy.
• Categories of third parties: cloud-hosting, telephony, AI-inference, payment, customer-support and analytics service providers; advertising partners; and government bodies where required by law.
• Sale or sharing of personal information: we do not "sell" personal information for money. We do "share" personal information for cross-context behavioural advertising via the Meta, TikTok, Reddit and LinkedIn pixels and similar advertising tools described in section 2. To opt out, send a request to team [at] heyjodie.com or use the opt-out controls listed in section 6. We honour Global Privacy Control (GPC) browser signals as an opt-out request.
• Sensitive personal information: we do not use or disclose sensitive personal information for purposes other than those permitted under CCPA/CPRA without an opt-in.
• Your rights: to know, access, correct, delete, and limit the use of sensitive personal information; to opt out of sale or sharing; and to be free from discrimination for exercising these rights. You may use an authorised agent. To exercise these rights, contact team [at] heyjodie.com.
• Retention: see section 10.

16. Additional Information for Australian Residents

If you are in Australia, the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) apply to our handling of your personal information to the extent the Privacy Act applies to us.

• Cross-border disclosure (APP 8): as described in section 8, we disclose personal information to recipients in Ireland, Germany, the United States and other countries where our sub-processors operate. Some telephony configurations support processing in Australia, but an Australian number does not guarantee Australian processing. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs, including through the contractual safeguards described in section 8, but the steps we take are not a guarantee of compliance by the recipient. Any reliance on an exception in APP 8.2 must meet its legal requirements; use of the Services alone is not informed consent to waive APP 8.1 protections.
• Complaints: you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

17. Additional Information for Canadian Residents

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25 and the Quebec Act respecting the protection of personal information in the private sector) apply to our handling of your personal information to the extent those laws apply to us.

• Cross-border processing: we process personal information in Ireland, Germany, the United States and, depending on telephony configuration, Australia, as described in section 8 and our Data Processing Addendum. While the data is in those jurisdictions it is subject to local laws, including potential lawful access requests by foreign authorities. The contractual safeguards described in section 8 apply, including any mandatory duties concerning government-access requests. Liability remains subject to the Terms and DPA to the extent permitted by applicable law and transfer instruments.
• Complaints: you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, if you are in Quebec, the Commission d'acces a l'information du Quebec at cai.gouv.qc.ca.

18. Additional Information for New Zealand Residents

If you are in New Zealand, the Privacy Act 2020 applies to our handling of your personal information to the extent that Act applies to us. Under Information Privacy Principle 12, before disclosing personal information overseas we take reasonable steps to satisfy ourselves that the recipient is subject to comparable safeguards. Our cross-border safeguards are described in section 8. You may complain to the Office of the Privacy Commissioner at privacy.org.nz.

19. Additional Information for Residents of Ireland and the EEA

If you are in Ireland or another European Economic Area country, EU GDPR and the Irish Data Protection Act 2018 apply in addition to (and where they conflict, in place of) the UK GDPR references above, in each case only to the extent those laws apply to us. References in this policy to the UK Information Commissioner's Office should be read as also referring to your local supervisory authority. You may complain to the Data Protection Commission (Ireland) at dataprotection.ie or to the supervisory authority in the EEA country where you live, work, or where the alleged infringement took place.

20. Limitations and Order of Precedence

Nothing in this policy is intended to limit any statutory rights you have under applicable Data Protection Laws that cannot lawfully be limited.

Subject to the paragraph above:

• this policy describes our practices and is not a contract; it does not create rights or obligations beyond what is required by applicable Data Protection Laws or expressly agreed between us in our Terms of Service or our Data Processing Addendum;
• where you have agreed to our Terms of Service, and to the maximum extent permitted by law and the DPA, liability arising out of our processing of personal data or this policy, including errors, omissions or outdated descriptive information, is subject to the exclusions and single aggregate cap in section 14 of those Terms, not a separate or additional cap for this policy;
• where any term of this policy conflicts with the Terms of Service or the Data Processing Addendum, the Terms of Service or the Data Processing Addendum (as applicable) prevail; and
• descriptions of providers, locations and technical implementation are general summaries, not an exhaustive account-specific specification or a guarantee that a particular configuration will remain unchanged. They create no additional contractual warranty, service level or indemnity. Changes remain subject to the DPA and applicable notice, authorisation and transfer requirements.

These limitations do not excuse inaccurate or misleading legally required disclosures, waive our duty to keep required information current, or qualify the DPA's Agreed List, security commitments or other express obligations. They do not exclude liability for fraud or fraudulent misrepresentation, or restrict Data Subject rights, regulatory powers or remedies that cannot lawfully be excluded. You can report a suspected error or request clarification using the contact details below.

21. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• General Email: team [at] heyjodie.com
• Data Protection Officer: data-protection-officer [at] heyjodie.com
• Address: 45 Albemarle Street, Mayfair, London, W1S 4JL
• ICO reference: ZB977748

For data protection matters specifically, please contact our Data Protection Officer. For complaints about data processing, you may also contact the ICO directly at https://ico.org.uk/.