1. Introduction
Jara Marketing, Inc. ("Jara," "Jara Marketing," "we," "us," or "our") operates the Jara intelligent Marketing Operating System (iMOS) — an AI-powered marketing operating system that lets agencies and businesses run campaigns, CRM, proposals, invoicing, scheduling, websites, events, and workflow automation from a single platform, available at https://jara.marketing (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect personal information — including information obtained through Google APIs — when you use our Service.
The Service is designed primarily for marketing agencies and similar service providers (each, an "Agency") that manage marketing on behalf of their own clients (each, an "End Client"), and is also available directly to small and medium-sized enterprises that run their own in-house marketing. Capitalized terms used but not defined here have the meaning given in our Terms of Service.
By using Jara, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service.
2. Scope
This Privacy Policy applies to:
Visitors to our website at jara.marketing; Agencies and other business customers who register for and use the Jara platform; Authorized Users whom an Agency permits to access the platform under its account; End Clients and other individuals who interact with an Agency's White-Label Portal, booking pages, or AI agents; and Individuals whose personal information we process on behalf of an Agency (as a data processor).
Where Jara acts as a data processor on behalf of an Agency — including for End Client data the Agency uploads or generates on the platform — the Agency is the data controller, and the Agency's own privacy policy governs that processing. Contact the relevant Agency for information about its privacy practices. The relationship between Agencies and End Clients is described further in Section 10 of our Terms of Service.
3. Information We Collect
3.1 Information You Provide
- Account registration data: name, business or Agency name, email address, phone number, password hash.
- Billing information: name, billing address, and payment method details (processed by our PCI-compliant payment processor, Stripe; Jara does not store full card numbers).
- Profile and configuration data: business hours, booking rules, brand assets and brand-voice settings, AI agent settings, White-Label Portal branding and domains, and workspace configuration.
- Operational content you create on the platform: CRM contacts and account records, campaign and email content, proposals and contracts, invoices, event and ticketing data, forms, and website content — including data you upload or generate on behalf of your End Clients.
- Communications: messages you send to our support team.
3.2 Information Collected Automatically
- Usage data: pages visited, features and modules used, Agent Runs executed, booking and campaign events created, timestamps.
- Device and browser data: IP address, browser type, operating system, referring URL.
- Cookies and similar technologies: session cookies, preference cookies, analytics identifiers. See Section 10 for details.
- Log data: server access logs retained for security and debugging purposes.
3.3 Information from Third-Party Integrations — Including Google
When an Agency or user connects a third-party account (such as Google Calendar) to Jara, we receive information from that service as described below. Other integrations (such as Stripe for billing) are described in Sections 4 and 5.
GOOGLE USER DATA — HOW JARA USES YOUR GOOGLE CALENDAR
When you connect your Google account to Jara, we request access to the following Google API scopes:
- calendar.readonly — We read your Google Calendar free/busy availability to determine which time slots are open for booking. We do not read the title, description, attendees, or any other details of your existing calendar events.
- calendar.events — When a prospect or End Client completes a booking through your Jara booking page, we create a calendar event in your Google Calendar on your behalf, including the booker's name, email, meeting title, and notes provided at booking.
Scope of use: Jara's use of Google Calendar data is limited strictly to the functions described above. We do not use this data to serve advertising, build user profiles unrelated to scheduling and booking management, or share it with third parties except as described in Section 5.
Google API Limited Use Policy: Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We do not read your existing calendar event content beyond free/busy signals.
- We do not store a persistent copy of your full calendar; availability is queried in real time when a booking page is loaded.
- Booking events we create on your behalf are stored in your Google Calendar and as a booking record in Jara's database solely for the purpose of managing your scheduling workflow.
- You can disconnect your Google account at any time via Settings → Integrations inside your Jara dashboard, which will revoke Jara's access tokens.
4. How We Use Information
We use personal information to:
- Provide, operate, and improve the Service, including AI-powered campaigns, CRM, proposals, invoicing, scheduling, lead capture, and booking automation across the platform's modules.
- Authenticate users and maintain account security.
- Process payments and send receipts (via Stripe).
- Query Google Calendar availability and create booking events on behalf of connected users.
- Operate AI features powered by Google Gemini — such as campaign writing, proposal drafting, deal forecasting, and brand-voice analysis — by processing the inputs and content you submit to those features.
- Send transactional emails (booking confirmations, reminders, account notifications).
- Provide customer support and respond to inquiries.
- Analyze aggregate usage trends to improve product features (using de-identified or aggregated data where possible).
- Comply with legal obligations and enforce our Terms of Service.
We do not sell personal information. We do not use Google user data, or the content you submit to AI features, for advertising or any purpose unrelated to the functions explicitly described in this Privacy Policy. AI features are not used to train third-party advertising models, and outputs are provided to you for your review.
5. How We Share Information
5.1 Service Providers
We share personal information with vetted third-party vendors who help us operate the Service, including:
- Cloud infrastructure providers (hosting, database, storage);
- Payment processors (Stripe, for billing; they receive only the data necessary to process transactions);
- AI service providers (Google, for Gemini-powered features, processing only the inputs necessary to generate outputs);
- Email delivery services (for transactional communications);
- Analytics providers (using anonymized or aggregated data);
- Customer support tooling.
All service providers are contractually prohibited from using personal information for any purpose other than providing services to Jara.
5.2 Agencies
If you are an End Client or other individual who books a meeting or submits information through an Agency's White-Label Portal or booking page, your details (such as name, email, selected time, and meeting or form notes) are shared with the Agency that owns that portal or page. The Agency is the data controller for that information.
5.3 Google
To perform calendar read and write operations, Jara transmits necessary identifiers and event data directly to Google's Calendar API on your behalf. This transmission is governed by Google's Privacy Policy and your agreement with Google.
5.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity, subject to equivalent privacy protections.
5.5 Legal Requirements
We may disclose personal information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the rights or safety of Jara, our users, or others.
5.6 No Sale of Personal Information
Jara does not sell, rent, or trade personal information to third parties for their own marketing purposes.
6. Data Retention
We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.
- Account data: retained for the duration of the account plus 90 days following account deletion, to allow recovery and resolve disputes.
- Operational and End Client content (CRM, campaigns, proposals, invoices): retained for the duration of the Agency's account and handled on the Agency's instructions as data controller; following account termination, data is retained in a read-only state for 30 days and then may be permanently deleted, consistent with our Terms of Service.
- Booking records: retained for 3 years to support audit trails and dispute resolution, then deleted or anonymized.
- Google OAuth tokens: stored securely and deleted immediately upon disconnection of the integration.
- Server logs: retained for 90 days for security and debugging.
- Analytics data: retained in aggregated, de-identified form indefinitely.
7. Data Security
We implement commercially reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These include:
- TLS/HTTPS encryption for all data in transit;
- Encryption of sensitive data at rest;
- Role-based access controls limiting employee access to personal data on a need-to-know basis;
- Secure, encrypted storage of OAuth tokens;
- Regular security assessments and vulnerability testing.
No system is completely secure. If you believe your account has been compromised, please contact us immediately at privacy@jara.marketing.
8. Children's Privacy
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided personal information, we will delete it promptly. If you are a parent or guardian and believe your child has provided us personal information, please contact privacy@jara.marketing.
9. Your Choices
9.1 Account Information
You may update or correct your account information at any time by logging into your Jara dashboard and navigating to Settings → Profile.
9.2 Google Integration
You may disconnect your Google Calendar integration at any time via Settings → Integrations. Upon disconnection, Jara will delete your stored OAuth access and refresh tokens. Previously created calendar events will remain in your Google Calendar.
9.3 Marketing Communications
You may opt out of non-transactional marketing emails by clicking "Unsubscribe" in any marketing email or by contacting privacy@jara.marketing. Transactional emails (e.g., booking confirmations) cannot be opted out of while your account is active.
9.4 Cookies
You may configure your browser to refuse cookies or to alert you when cookies are being sent. Some features of the Service may not function properly without cookies. See Section 10 for details.
10. Cookies and Tracking Technologies
Jara uses the following categories of cookies:
- Strictly Necessary: required for the Service to function (e.g., session authentication tokens). Cannot be disabled.
- Preference/Functional: remember your settings and preferences (e.g., timezone, language). Can be disabled via browser settings.
- Analytics: help us understand how the Service is used (e.g., page views, feature usage). We use anonymized or aggregated data. Can be disabled.
We do not use advertising or tracking cookies for cross-site behavioral advertising.
11. Additional Disclosures for EEA and UK Residents (GDPR / UK GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional provisions apply.
11.1 Data Controller and Processor
Jara Marketing, Inc. is the data controller for personal information it collects directly (e.g., from Agencies, Authorized Users, and website visitors). Where Jara processes personal information on behalf of an Agency — including End Client booking data and other End Client content the Agency uploads or generates — Jara acts as a data processor and the Agency is the data controller. Agencies subject to the GDPR or UK GDPR may request a Data Processing Agreement (DPA) by contacting privacy@jara.marketing.
11.2 Legal Bases for Processing
We process personal information on the following legal bases:
- Contract performance — Art. 6(1)(b): Processing necessary to deliver the Service under our Terms of Service (e.g., creating your account, running campaigns, processing bookings).
- Legitimate interests — Art. 6(1)(f): Processing necessary for fraud prevention, security, product improvement, and analytics, where these interests are not overridden by your rights.
- Legal obligation — Art. 6(1)(c): Processing required by applicable law (e.g., tax record-keeping).
- Consent — Art. 6(1)(a): Where required, such as for optional analytics cookies or marketing emails. You may withdraw consent at any time.
11.3 International Data Transfers
Jara is based in the United States. If you are located in the EEA or UK, your personal information will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, or equivalent transfer mechanisms, as the legal basis for international transfers. You may obtain a copy of our transfer mechanism by contacting privacy@jara.marketing.
11.4 Your Rights Under GDPR / UK GDPR
Subject to applicable law and certain exceptions, you have the right to:
- Access: Request a copy of the personal information we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal information.
- Erasure: Request deletion of your personal information, subject to our legal obligations.
- Restriction: Request that we restrict processing of your personal information in certain circumstances.
- Data Portability: Receive your personal information in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests or for direct marketing purposes.
- Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please submit a request to privacy@jara.marketing. We will respond within 30 days (or 3 months for complex requests). We may need to verify your identity before processing your request. Where the request concerns End Client data for which an Agency is the controller, we will refer the request to, or act on the instructions of, the relevant Agency.
11.5 Right to Lodge a Complaint
You have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In Ireland, this is the Data Protection Commission (DPC) at dataprotection.ie. You may also contact the supervisory authority in your EU Member State of habitual residence.
12. Additional Disclosures for California Residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights.
12.1 Categories of Personal Information Collected
In the preceding 12 months, Jara has collected the following categories of personal information:
- Identifiers: name, email address, phone number, IP address, account credentials.
- Commercial information: subscription plan, billing records, transaction history.
- Internet/network activity: browsing activity within the Service, usage logs, feature interactions.
- Geolocation data: approximate location derived from IP address.
- Calendar data (via Google): free/busy signals from Google Calendar and booking event details created on your behalf.
- Operational/End Client content: CRM contacts, campaign content, proposals, invoices, and other records you process on the platform, including on behalf of End Clients.
- Professional information: business or Agency name, job title, where provided.
- Inferences: service usage patterns used to improve product features (aggregated and de-identified).
12.2 Sources of Personal Information
We collect personal information directly from you, automatically through your use of the Service, and (where you have connected integrations) from third-party services such as Google.
12.3 Business or Commercial Purposes for Collection
We collect personal information for the business purposes described in Section 4 of this Privacy Policy, including providing the Service, running campaigns, processing bookings, maintaining security, and improving the platform.
12.4 Categories of Third Parties with Whom We Share
We share personal information with service providers (as defined by CCPA), Agencies, and Google (for calendar API operations), as described in Section 5.
12.5 No Sale or Sharing of Personal Information
Jara does not sell personal information as defined by the CCPA/CPRA. Jara does not share personal information for cross-context behavioral advertising.
12.6 Your California Privacy Rights
California residents have the right to:
- Know: Request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, or sold about you in the past 12 months.
- Delete: Request deletion of personal information we have collected, subject to certain exceptions.
- Correct: Request correction of inaccurate personal information.
- Opt-Out: Opt out of the sale or sharing of personal information (Jara does not sell or share for advertising).
- Non-Discrimination: Exercise your privacy rights without discriminatory treatment.
- Limit Sensitive PI: Limit the use of sensitive personal information, where applicable.
To submit a CCPA request, email privacy@jara.marketing with the subject line "California Privacy Request" or contact us at the address below. We will verify your identity and respond within 45 days (extendable to 90 days with notice). You may submit a request on behalf of a California resident with written authorization or proof of legal authority.
12.7 Authorized Agents
California residents may designate an authorized agent to submit requests on their behalf. The agent must provide written proof of authorization and we may require verification directly from the California resident.
13. In-Product Privacy Notices Regarding Google Data
In addition to this Privacy Policy, Jara displays the following contextual privacy notices within the product:
- At the point of connecting your Google account: a clear disclosure states that Jara will access your calendar availability (read-only) and create events on your behalf when bookings are made, and that your data is not used for advertising.
- On booking pages: a notice informs prospects and End Clients that their booking information will be shared with the Agency and stored in the Agency's Google Calendar.
- In the Integrations settings panel: a summary of what Google data Jara accesses and a one-click disconnect option.
14. Third-Party Links and Services
The Service may contain links to third-party websites or integrate with third-party tools not controlled by Jara. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will:
- Update the "Effective Date" at the top of this page;
- Post a notice in the Jara dashboard and/or send an email notification to registered Agencies and account holders;
- Where required by law, seek your consent before the updated policy takes effect.
Your continued use of the Service after the updated Privacy Policy becomes effective constitutes your acceptance of the changes.
16. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Jara Marketing, Inc. Attn: Privacy Team Email: privacy@jara.marketing Website: https://jara.marketing/privacy
For EEA/UK data subjects who are not satisfied with our response, you may escalate to your local supervisory authority as described in Section 11.5.
This Privacy Policy was last updated on June 30, 2026 and is effective as of that date.