Error

Jeeves Privacy Policy

Version 4.0

Download

Table of Contents

    Jeeves Inc.

    Global Privacy Policy — Version 4.0 (2026 Draft)

    Prepared by the Office of the General Counsel · Policy effective date: August 1, 2026.

    Policy Name

    Jeeves Global Privacy Policy

    Version

    4.0

    Policy Owner

    Legal Department

    Author

    Legal Department

    Effective Date

    August 2026

    Table of Contents

    • 1. About Us
    • 2. About This Privacy Policy
    • 3. Your Personal Data — What We Collect
    • 4. How We Use Your Personal Data
    • 5. Artificial Intelligence and Automated Decision-Making
      • AI Agent Services for Business Customers
    • 6. How We Share Personal Data
    • 7. International Data Transfers
    • 8. How Long We Keep Your Personal Data
    • 9. Security of Your Personal Data
    • 10. Your Rights and Choices
    • 11. Cookies and Tracking Technologies
    • 12. Children and Minors
    • 13. Changes to This Privacy Policy
    • 14. Contact Us
    • 15. Jurisdiction-Specific Supplemental Terms
      • United States / Brazil / Mexico / Colombia / Canada / UK / EEA
    • 16. Jeeves Entities

    1. About Us

    Jeeves is made up of different companies operating across North America, Latin America, the United Kingdom, and Europe. The Jeeves company that provides you with services depends on where you are located; the current list of Jeeves entities and the jurisdictions in which they operate is set out in Section 16 (Jeeves Entities).

    2. About This Privacy Policy

    We collect personal data about you when you use:

    • our website at www.tryjeeves.com;
    • the Jeeves app or platform;
    • any Jeeves card, payment, foreign exchange, treasury, or stablecoin/digital-asset service;
    • Jeeves' AI Agent Services, described in Section 5.6; or
    • any other service you access through the Jeeves app, platform, or website.

    ‘Personal data’ means information that can be used to identify you, directly or indirectly. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices available to you. ‘Process’ or ‘processing’ means, collectively, using, collecting, transmitting, storing, sharing, and erasing data.

    If you have questions about this Policy or how we process your personal data, contact our Privacy Team at privacy@tryjeeves.com.

    Policy effective date: August 1, 2026. This Policy replaces Version 3.0, effective February 12, 2024.

    3. Your Personal Data — What We Collect

    We collect information directly from you, automatically through your use of our products, and from third parties, as described below. The categories below are illustrative of the personal data we process; they are not intended to be exhaustive.

    3.1 Information you give us

    We collect information you provide when you fill in an application form, correspond with us, register for or use the Jeeves app or platform, open an account, browse tryjeeves.com, use our mobile apps, log into your account, connect other accounts to your Jeeves account, or speak with our support team.

    3.2 Information we collect when you apply for an account

    To open a Jeeves account and to comply with our know-your-customer (KYC) and know-your-business (KYB) obligations, we collect information about you, your business, and individuals associated with your business, including:

    • Your name, title, email, phone number, and a unique password;
    • Your business's legal name, address, Employer Identification Number (or local equivalent), and information about individuals with an ownership interest in the business;
    • Business bank account information;
    • Identity documents (e.g., passport, driver's license, or other national ID);
    • Your Tax Identification Number, Social Security Number, or local equivalent;
    • Information from third parties who help us provide services and prevent fraud, including credit records, identity-verification results, and transaction-risk data from financial-service providers, credit reference agencies, entity-verification services, public sources, and fraud-prevention agencies;
    • Information needed to underwrite your product and determine your credit limit and eligibility for rewards, including bank account credentials and associated account data (processed via a service provider; Jeeves does not store your bank account credentials); and
    • For rejected applications, certain personal data retained to comply with legal and regulatory recordkeeping obligations.

    3.3 Information we collect when you use our products and services

    When you are issued a Jeeves card or use our products (for example, as an employee or authorized representative), we process your name, business email, business phone number, and details of your product usage. When you use the Jeeves app or platform, we process your name, IP address, and biometric information (for sign-in purposes).

    When you make a card transaction, we process payment method information, purchase amount, date, location, channel, receipt information, and information provided by the applicable card network (such as Mastercard® or Visa®).

    When you use Jeeves' payment services — including Jeeves Pay, Digital Services, InstantPay, cross-border wires, and foreign exchange — we process payment method information, wire or transfer amount, date, destination, recipient details, and information provided by the applicable payment network.

    3.4 Digital asset and stablecoin data

    Where you use InstantPay, the Stablecoin Wallet Services, or a stablecoin-denominated yield or “Earn” product, we and our licensed banking, custody, and stablecoin-infrastructure partners process additional information, including:

    • Digital wallet addresses and identifiers associated with your account;
    • On-chain transaction data (amounts, counterparties, timestamps, and network/chain identifiers) to the extent recorded on public or permissioned distributed ledgers;
    • Information relating to the conversion between fiat currency and stablecoins, including exchange rates and conversion fees; and
    • Information shared with or received from custody, stablecoin-issuance, and payment-infrastructure partners to facilitate settlement and to comply with applicable anti-money-laundering, sanctions, and virtual-asset service provider (VASP) regulatory requirements in the relevant jurisdiction.

    Note: On-chain data associated with public blockchains may be permanently and publicly viewable irrespective of Jeeves' own retention practices; this Policy does not govern data recorded directly on public ledgers by third parties.

    3.5 Information processed through AI-enabled features and AI Agent Services

    Where you interact with an AI-enabled feature of our products (for example, a support chatbot, a document- or receipt-processing tool, or an in-app assistant), we process the content of your inputs (text, images, or documents you submit) and the outputs generated in response, as described further in Section 5 (Artificial Intelligence and Automated Decision-Making).

    Where your business has engaged Jeeves' AI Agent Services (Section 5.6), we additionally process the connected financial data your business configures the agent to use (for example, transactions, invoices, ledgers, receipts, and related records, which may include the names and contact details of your personnel, customers, and vendors), together with feedback, ratings, and corrections your personnel provide on the agent's outputs.

    3.6 Information we collect or generate when you link your Jeeves account

    We offer integrations with accounting and expense services (such as QuickBooks® Online, Xero®, and NetSuite®) and other business-partner products. When you link these services, we collect associated personal data as needed to make the integration work, which may include unique identifiers, general ledger account codes, locations, classes, departments, and email addresses.

    3.7 Information we collect from our website and mobile app

    We collect technical information (IP address, device identifiers, operating system, browser information, referring/exit pages, and device event data), information about your use of our site or app (location, clicks, session duration), photos you choose to upload (such as receipt images), and information from cookies and similar trackers, as described in Section 11 (Cookies and Tracking Technologies) and our Cookie Policy.

    3.8 Other information we collect

    • Information you provide when you contact our Customer Support, Sales, or Marketing teams, including the content of your communications;
    • Information you provide to enter a sweepstakes, contest, or promotion; and
    • Information generated through a business partnership, referral, or agreement with us.

    4. How We Use Your Personal Data

    We process your personal data only where we have a legal basis to do so. Depending on the jurisdiction, our legal basis will be one or more of: performance of our contract with you, compliance with a legal obligation, our legitimate interests (balanced against your privacy rights), or your consent.

    Purpose

    Legal Basis

    Provide our products and services; communicate with you; manage notifications; identify and troubleshoot account issues; determine eligibility for and calculate rewards; conduct required KYC/KYB checks

    Contract; Legal obligation; Legitimate interests

    Protect against fraud; monitor and detect unauthorized activity; verify information against other data sources; assess business financial circumstances and manage related risk

    Legal obligation; Legitimate interests; Consent (where geolocation sharing is elected)

    Underwrite credit products, set credit limits, and price stablecoin/FX conversions

    Contract; Legitimate interests; Legal obligation

    Develop, train, test, and improve AI/ML models and automated features (see Section 5)

    Legitimate interests; Consent (where required by applicable law)

    Configure, operate, and improve a customer's AI Agent under Jeeves' AI Agent Services (see Section 5.6)

    Contract with the business customer; Legitimate interests (for de-identified, aggregated improvement uses only)

    Market and provide new products and services; conduct surveys; understand product usage to make improvements

    Legitimate interests; Consent (where legally required for B2B marketing)

    Keep our services secure and operational; identify, fix, and troubleshoot errors

    Contract; Legitimate interests; Consent (where required by law)

    Prepare de-identified or aggregated statistical datasets

    Legitimate interests

    Meet legal obligations; enforce our rights; mitigate financial loss, claims, or liability; facilitate reporting and audit

    Legitimate interests; Legal obligation

    We may rely on more than one legal basis for a given processing activity. Contact privacy@tryjeeves.com for details on the specific basis applicable to a particular use of your data.

    5. Artificial Intelligence and Automated Decision-Making

    Jeeves uses artificial intelligence and machine learning (“AI”) to help operate, secure, and improve our products, and to power the AI Agent Services we build for business customers. This section describes how, consistent with the EU General Data Protection Regulation (Article 22), the EU AI Act, the Colorado AI Act, and other applicable automated-decision-making and AI-specific laws.

    5.1 Where we use AI

    • Underwriting and credit limit decisions — to help evaluate a business's financial circumstances and set an available credit limit or eligibility for rewards;
    • Fraud and financial-crime detection — to monitor transactions and account activity for suspicious or unauthorized activity and potential sanctions exposure;
    • Identity verification — to support KYC/KYB checks, including document and biometric verification;
    • Customer support — through AI-assisted or AI-generated responses to support inquiries;
    • Content and document processing — for example, extracting data from receipts or invoices you upload;
    • Personalization — to tailor in-app content, recommendations, or communications; and
    • AI Agent Services — custom AI agents Jeeves builds and operates for a business customer's finance team, described in Section 5.6.

    5.2 Human oversight

    Where an automated process produces a decision that has a legal or similarly significant effect on you — such as a credit limit determination, an account restriction, or a fraud hold — a human reviews that decision before it is finalized, or you may request a human review after the fact by contacting privacy@tryjeeves.com. AI-generated outputs used in customer-facing or externally-published materials are reviewed by a person before use. Our AI tools, including AI Agent Services, are designed to assist, not replace, human decision-makers in matters with material consequences for you or your business.

    5.3 Your rights regarding automated decisions

    • The right to be informed that an automated decision is being made about you;
    • The right to request a manual, human review of a decision that significantly affects you;
    • The right to obtain a meaningful explanation of the logic involved and the significance and envisaged consequences of the processing; and
    • The right to contest the decision and provide additional information for us to consider.

    5.4 Model training and data retention

    Jeeves may use customer prompts, documents, or transaction data to train or fine-tune Jeeves' own general-purpose AI/ML models. Where users provide feedback on an AI-generated output (for example, a rating, correction, or similar input), Jeeves may use that feedback to tune and improve its models, but only after the feedback has been de-identified in accordance with the standard described in Section 5.6.3.

    Jeeves may share personal data with third-party foundation-model or general-purpose-model providers for purposes of training those providers' own models. Consistent with prevailing industry practice among AI providers — which commonly default to retaining API and interaction inputs and outputs for approximately 30 days for debugging, safety, and abuse-monitoring purposes, within a generally accepted range of 30 to 90 days for general business application logs — Jeeves retains AI inputs and outputs for 90 days from the date of the interaction, after which they are deleted or de-identified in accordance with Section 5.6.3. Where an AI-generated output becomes part of an underlying business or account record (for example, a credit-decision rationale, a fraud-review note, or data extracted from a submitted document for accounting purposes), that output is instead retained for the period applicable to the underlying record under Section 8, rather than the shorter period described above.

    5.5 Third-party AI providers

    Some of Jeeves' vendors and service providers (for example, those supporting document processing, underwriting/decisioning, and fraud detection) have AI/ML functionality embedded in the tools they license to Jeeves, and process Jeeves and customer data as part of delivering those services. Those vendors act as our service providers/processors under contractual terms that govern their permitted use of that data, which in some cases includes benchmarking the vendor's AI performance but, consistent with Section 5.4, does not permit the vendor to use that data to train its own general-purpose or foundation model.

    Consistent with our practice of describing vendor/subprocessor categories generically rather than publishing an exhaustive named list in this Policy, Jeeves' AI-enabled vendors generally fall into the following categories:

    • Document and data-extraction providers — used to process receipts, invoices, and bank statements you or your business submit (for example, in the nature of a document-intelligence vendor such as Ocrolus).
    • Underwriting and credit-decisioning providers — used to support credit-limit and eligibility decisions (for example, in the nature of a decisioning-platform vendor such as Taktile).
    • Fraud and financial-crime detection providers — used to monitor transactions and account activity for suspicious or unauthorized activity (for example, in the nature of a fraud-risk vendor such as SardineAI).
    • Generative AI and customer-support providers — used to power AI-assisted support responses, document drafting, and the AI Agent Services described in Section 5.6.

    5.6 AI Agent Services for Business Customers

    Jeeves offers a service through which we build and operate custom AI agents (“AI Agent Services”) for a business customer's finance team. An AI Agent Service is configured by, and for, a specific business customer and may be used to perform tasks such as transaction categorization, reconciliation, anomaly flagging, drafting of reports or correspondence, and other finance-team workflows the customer configures. This section sets out our data-handling commitments for that service; it supplements, and does not replace, the data-processing terms in our agreement with the relevant business customer.

    5.6.1 What data we use, and for what

    • Customer Data: the financial data, records, and other information a business customer connects to or inputs into its AI Agent (for example, transactions, invoices, ledgers, receipts, and related records, which may include personal data of the customer's own personnel, customers, or vendors).
    • Interaction Data: prompts, queries, corrections, ratings, and other feedback a customer's personnel provide when using the AI Agent.
    • Jeeves uses Customer Data and Interaction Data to configure, operate, maintain, secure, and improve that specific customer's AI Agent, and to provide support in connection with it. This is the default, primary use of the data and does not require de-identification, because it stays within the scope of the services provided to that customer.

    5.6.2 No cross-customer training on raw data

    Jeeves will not use one business customer's Customer Data or Interaction Data to train, fine-tune, or benchmark AI models for the benefit of another customer, and will not incorporate it into any shared or general-purpose model, except in de-identified, aggregated form as described in Section 5.6.3 — consistent with, and not broader than, the existing license the Program Agreement already grants Jeeves to generate and use De-Identified Data for the development of products and services, including data products. Each customer's Customer Data is logically segregated from other customers' data and is not accessible to, or usable in the operation of, another customer's AI Agent.

    5.6.3 De-identification standard for any go-forward improvement use

    Where Jeeves uses Interaction Data or Customer Data to improve its AI Agent Services generally (rather than solely to operate a specific customer's own agent), it will first de-identify that data, consistent with the Program Agreement's existing definition of “De-Identified Data”: data derived from Company Data that has been anonymized or aggregated with other data and that can no longer be used to identify a specific company or individual, whether on its own or when combined with other information. In practice, Jeeves implements that standard for AI Agent Services by (i) removing direct identifiers, such as name, email address, phone number, government identification or tax number, wallet address, and precise geolocation; (ii) generalizing or removing indirect identifiers reasonably capable of being used, alone or in combination, to re-identify a specific business customer or individual; and (iii) aggregating the resulting data across a minimum pool of no fewer than 5 distinct business customers before use — a threshold informed by k-anonymity principles, under which common data-disclosure guidance sets minimum aggregation group sizes in a range of approximately 5 to 30 depending on data sensitivity, with more conservative practice (typically 20–25 or higher) applied to sensitive financial data of the kind Jeeves processes. Jeeves will not attempt to re-identify de-identified data, and will contractually and technically prohibit its AI subprocessors from doing so.

    5.6.4 Controller and processor roles

    For personal data about you as an individual using or administering your business's Jeeves account, Jeeves is the controller, as described elsewhere in this Policy. Where Customer Data includes personal data about a business customer's own personnel, customers, or vendors (for example, a name on an invoice processed by an AI Agent), Jeeves processes that data as a service provider/processor on behalf of the business customer, who remains the controller responsible for that data and for ensuring it has the right to share it with Jeeves. The specific terms of that processing relationship are governed by the parties' Program Agreement and data processing addendum, which take precedence over this Policy for that data.

    5.6.5 Retention, deletion, and customer controls

    • Jeeves retains Customer Data and Interaction Data for as long as the AI Agent Services agreement is in effect, and for a limited period afterward as agreed in the customer contract, to allow for transition or reactivation, after which it is deleted or returned, except where retention is required by law.
    • A business customer may configure what data feeds its AI Agent and may request deletion of its Customer Data on termination, subject to any legal retention obligations described in Section 8.
    • Jeeves' use of a business customer's de-identified, aggregated data to improve AI Agent Services generally (Section 5.6.3) is authorized under the Program Agreement's existing license permitting Jeeves to generate and use De-Identified Data for the development of products and services, including data products. Consistent with the Program Agreement as currently in effect, no separate opt-out from this de-identified, aggregated use is available to business customers at this time.

    5.6.6 Security

    AI Agent Services are subject to the same security measures described in Section 9, including encryption, access controls, and logging, together with tenant-level data segregation described in Section 5.6.2.

    6. How We Share Personal Data

    We share personal data with: our group companies; professional advisors (lawyers, accountants, auditors); credit reporting agencies; legal and regulatory authorities; and taxation authorities. We also share personal data with vendors that provide products or services to Jeeves (for example, cloud hosting, CRM, and — as described in Section 5 — AI providers). These third parties may independently control the personal data they receive, and it will be processed in accordance with their own privacy policies.

    6.1 Categories of sharing

    • Business purposes — to operate and improve our products, verify your identity, integrate business-partner services, and host our website and data in the cloud.
    • Payment purposes — sharing your name and payment method information with the merchant or person you are paying.
    • Aggregated or de-identified information — shared with other parties without directly identifying you or your business.
    • Jeeves affiliates — to provide additional services, assess eligibility for new products, and other legitimate business purposes.
    • Service providers — who process personal data on our behalf to deliver, secure, and improve our services, including AI-enabled features and AI Agent Services.
    • Financial and business partners — including card-issuing banks, payment processors, and stablecoin/custody infrastructure partners, to facilitate the services we provide to you and to meet their and our regulatory obligations.
    • Telecommunications providers — for identity-verification purposes.
    • SMS messaging — a third-party provider generates one-time-password security messages if you opt in; you may opt out at any time by replying STOP or contacting privacy@tryjeeves.com.
    • Credit reporting agencies — to verify and report on your business's performance.
    • Card and payment network partners — such as Mastercard® and Visa®, which separately process transaction data under their own privacy notices.
    • Referral partners — to confirm account activity for referral-fee calculation, where applicable.
    • Accounting/expense integrations — shared solely as directed by you or your authorized users.
    • Corporate transactions — in the event of a sale, merger, financing, reorganization, or similar transaction, personal data may be transferred as part of the transaction, subject to this Policy.
    • Compliance and compelled disclosure — to comply with law, regulation, or payment-network rules; to enforce our rights; or to respond to courts, regulators, and law enforcement, including outside your country of residence.

    7. International Data Transfers

    To provide our services, we may transfer your personal data outside the jurisdiction in which you provided it, including transfers to or from the European Economic Area (“EEA”), the United Kingdom, Brazil, Canada, Mexico, Colombia, and the United States — the jurisdictions where Jeeves currently has an active operating entity (see Section 16). Depending on the jurisdictions involved, we rely on the following safeguards:

    • EEA/UK transfers to third countries: the EU Standard Contractual Clauses and, for transfers from the UK, the UK International Data Transfer Addendum to those clauses.
    • Brazil transfers: standard contractual clauses approved by Brazil's Autoridade Nacional de Proteção de Dados (“ANPD”) under Resolution CD/ANPD No. 19/2024. For transfers specifically between Brazil and the EEA, Jeeves relies on the mutual adequacy recognition formalized by ANPD Resolution No. 32/2026 and the corresponding European Commission adequacy decision, both effective January 2026, which permit such transfers without additional contractual safeguards.
    • Mexico, Colombia, and Canada transfers: contractual data-protection clauses with the receiving party and, where applicable, your consent, consistent with the LFPDPPP, Law 1581 of 2012, and PIPEDA, respectively (see Section 15 for details).

    Where the level of protection in the receiving country is less than that offered in the country of origin, we implement appropriate measures to ensure your personal data remains protected consistent with applicable law. Contact privacy@tryjeeves.com for more information about the safeguards applicable to a specific transfer.

    8. How Long We Keep Your Personal Data

    We retain personal data for as long as necessary to fulfill the purposes described in this Policy or the terms of our contract with you, or for as long as required by applicable law or regulatory obligation (including anti-money-laundering recordkeeping requirements, which in most jurisdictions require retention of certain KYC/KYB and transaction records for a period of years following account closure). After this period, and where permitted by law, we will erase your personal data. Retention of Customer Data and Interaction Data processed through AI Agent Services is described in Section 5.6.5.

    9. Security of Your Personal Data

    We maintain organizational, technical, and administrative measures designed to protect your personal data. No security program can guarantee complete protection. If you believe your personal data or other confidential information you provided to us is no longer secure, or has been lost or stolen, please contact us immediately at privacy@tryjeeves.com.

    10. Your Rights and Choices

    If you are an employee of a business that holds a Jeeves account, your business — rather than Jeeves — is generally responsible for handling your rights request. Where Jeeves is responsible, we may decline a request where we have a legitimate reason to do so, or the right does not apply to the information we hold. Where your personal data appears in Customer Data processed under a business customer's AI Agent Services (Section 5.6.4), the business customer, as controller, is generally responsible for handling your request; Jeeves will assist that customer as its processor.

    10.1 Rights available outside the United States (general overview)

    Subject to the jurisdiction-specific statutory citations, terminology, and regulator names set out in Section 15, individuals outside the United States generally have the following rights:

    • Right to be informed how we use your personal data (provided by this Policy);
    • Right to access a copy of your personal data;
    • Right to correct inaccurate or incomplete personal data;
    • Right to request deletion of your personal data, subject to legal and regulatory retention requirements;
    • Right to object to processing based on legitimate interests, or to processing for marketing purposes;
    • Right to restrict how we use your personal data in certain circumstances;
    • Right to data portability, where technically feasible;
    • Right to withdraw consent at any time, without affecting the lawfulness of prior processing; and
    • Right to request human review of an automated decision that significantly affects you (see Section 5).

    10.2 Rights available under U.S. state privacy laws

    Depending on your state of residence, you may have rights under comprehensive state privacy laws now in effect — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Maryland, Minnesota, Washington, Indiana, Kentucky, Rhode Island, and Arkansas — which generally include the rights to:

    • Confirm whether we process your personal data and access that data;
    • Correct inaccurate personal data;
    • Delete personal data, subject to legal exceptions;
    • Obtain a portable copy of your personal data;
    • Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects; and
    • Appeal a decision if we decline to act on your rights request, by contacting privacy@tryjeeves.com; we will respond to an appeal within the time period required by applicable law and will inform you of any further complaint rights, including the right to contact your state Attorney General.

    Where required, we obtain opt-in consent before processing sensitive personal data (such as precise geolocation, government identification numbers, or biometric data) for purposes beyond providing the services you requested.

    Universal Opt-Out Mechanisms: where required by applicable state law, we recognize opt-out preference signals, such as the Global Privacy Control (GPC), sent by your browser or device with respect to applicable processing on our website.

    We do not sell personal data in the traditional sense of exchanging it for money; to the extent any sharing with advertising or analytics partners is deemed a “sale” or “sharing” under applicable state law, you may exercise your opt-out rights as described above.

    10.3 How to exercise your rights

    You may exercise any of these rights by emailing privacy@tryjeeves.com. We do not charge a fee to respond to a legitimate request, though we may charge a reasonable fee, or decline to act, if a request is manifestly unfounded, repetitive, or excessive. We may need to verify your identity before responding. We aim to respond within the timeframe required by applicable law (generally one calendar month for EEA/UK/Brazil requests, and 45 days for most U.S. state requests, each subject to a permitted extension for complex requests, with notice to you).

    If you are unhappy with how we handled your request, you may contact our Privacy Officer at privacy@tryjeeves.com, or raise a complaint with your local supervisory authority — for example, the Information Commissioner's Office in the UK, the Autoridade Nacional de Proteção de Dados in Brazil, or your state Attorney General in the United States.

    11. Cookies and Tracking Technologies

    We use cookies and similar technologies to operate our website and to analyze how it is used. Please see our Cookie Policy for details on the categories of cookies we use, their purposes, and how to manage your preferences, including through our cookie consent banner and, where applicable, recognition of the Global Privacy Control signal.

    12. Children and Minors

    Our products and services are intended for use by businesses and their authorized representatives. If you are under the age of 16 (or the applicable age of digital consent in your jurisdiction, if higher), you may not open an account or use our products or services, and we do not knowingly collect personal data from, or direct our products or services to, children under that age. Please do not provide us with personal data relating to children.

    13. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time. We will post any changes on our site, and where a change materially affects our practices with respect to personal data previously collected from you, we will provide advance notice by highlighting the change on our site or by other appropriate means required by applicable law. We intend to review and, where appropriate, update this Policy at least every 12 months.

    Our previous privacy policies are available on request and include Version 3.0 (effective February 12, 2024), the June 1, 2022 version, and the August 13, 2021 version.

    14. Contact Us

    If you have concerns, questions, or would like to better understand our privacy practices, please contact our Privacy Team at privacy@tryjeeves.com.

    15. Jurisdiction-Specific Supplemental Terms

    This Policy is designed to operate as a single omnibus policy across every jurisdiction where Jeeves has an active operating entity. The sections above set out our general, global data practices. This Section 15 supplements those sections with the specific statute, regulator, local rights terminology, and any other jurisdiction-specific requirement that applies where you are based. Where a conflict exists between the general sections above and this Section 15 for a given jurisdiction, this Section 15 controls for users in that jurisdiction.

    15.1 United States

    See Section 10.2 above for the rights available under the U.S. state comprehensive privacy laws currently in force. Jeeves Inc. is the controller for U.S. users.

    15.2 Brazil

    • Governing law: Lei Geral de Proteção de Dados Pessoais (“LGPD”), Law No. 13,709/2018.
    • Regulator: Autoridade Nacional de Proteção de Dados (“ANPD”).
    • Rights (LGPD Art. 18): confirmation of the existence of processing; access; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about the public and private entities with which we share data; information about the possibility of denying consent and the consequences; and revocation of consent.
    • Automated decisions (LGPD Art. 20): you may request review of a decision based solely on automated processing that affects your interests, including decisions defining your personal, professional, consumer, or credit profile. Brazilian law does not itself require that this review be conducted by a human, but Jeeves provides human review as a matter of policy (see Section 5).
    • International transfers: see Section 7 above regarding ANPD-approved standard contractual clauses (Resolution CD/ANPD No. 19/2024) and the Brazil–EU mutual adequacy recognition effective January 2026.
    • Response timeline: we aim to respond to LGPD requests within 15 days, consistent with applicable ANPD guidance.
    • Controller entities: Jeeves Brasil Instituição de Pagamento and Jeeves Inc. (Jeeves Holdings Brasil Ltda. is a non-customer-facing holding company and is not a controller for purposes of this Policy).

    15.3 Mexico

    • Governing law: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (“LFPDPPP”), as reformed and republished March 21, 2025.
    • Regulator: the Secretaría Anticorrupción y Buen Gobierno (“SABG”), which assumed Mexico's data protection oversight functions following the 2024 constitutional reform that dissolved the INAI (formal wind-down completed May 9, 2025). References in prior versions of this Policy to the INAI should be read as referring to the SABG.
    • Rights: the ARCO rights — Access, Rectification, Cancellation, and Opposition — together with the right to revoke your consent and to limit the use and disclosure of your personal data.
    • Controller entities: JVS Inc. México, S.A. de C.V.; JVS México Soluciones, S.A.P.I. de C.V., SOFOM E.N.R.; and Jeeves Inc. (Operadora Jeevma S.A.P.I. is not customer-facing and is not a controller for purposes of this Policy).

    15.4 Colombia

    • Governing law: Law 1581 of 2012 and its implementing Decree 1377 of 2013 (general Habeas Data), together with Law 1266 of 2008 (Financial Habeas Data, as amended by Law 2157 of 2021 and Law 2573 of 2026), which applies to credit, financial, and commercial data such as that used in our underwriting and credit-reporting processes.
    • Regulator: the Superintendencia de Industria y Comercio (“SIC”), through its Delegation for the Protection of Personal Data, and, for financial-sector matters, the Superintendencia Financiera de Colombia.
    • Rights (habeas data): to know, update, and rectify your personal data; to request proof of the authorization you gave Jeeves; to be informed of how your data has been used; to revoke your authorization and/or request deletion, subject to legal or contractual retention requirements; and to file a complaint with the SIC after first raising the matter with Jeeves.
    • AI and fintech-specific guidance: our processing of personal data in AI-enabled features and fintech products, including AI Agent Services, is designed with reference to SIC External Circular 002 of 2024 (personal data in AI systems) and SIC External Circular 001 of 2025 (fintech-sector data processing).
    • Controller entity: Jeeves Technologies Colombia SAS and Jeeves Inc.

    15.5 Canada

    • Governing law: the Personal Information Protection and Electronic Documents Act (“PIPEDA”). If you are based in Quebec, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (“Law 25”) also applies and may provide additional rights, including the right to be informed of the logic behind an automated decision.
    • Regulator: the Office of the Privacy Commissioner of Canada (“OPC”), and, for Quebec residents, the Commission d'accès à l'information.
    • Rights: access to your personal information, correction of inaccuracies, and the right to complain to the OPC (or, in Quebec, the Commission d'accès à l'information) if you believe we have not respected your privacy rights.
    • Controller entities: Jeeves Technologies (Canada) Inc. and Jeeves Inc.

    15.6 United Kingdom

    • Governing law: the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (“DUAA”), which is being implemented in phases through mid-2026.
    • Regulator: the Information Commissioner's Office (“ICO”). The DUAA establishes a new body corporate, the Information Commission, intended eventually to replace the ICO's single-post-holder structure; as of this draft the transition is ongoing and the regulator continues to operate as the ICO.
    • What's changed under the DUAA: from February 5, 2026, we may rely on a new “recognised legitimate interests” lawful basis for a defined set of purposes (e.g., safeguarding, crime prevention) without a separate balancing test; subject access requests are now assessed against a “reasonable and proportionate search” standard; and, if we decline to act on your rights request, you have a right to complain directly to us under section 164A of the Data Protection Act 2018, in addition to your right to complain to the ICO.
    • Controller entities: Jeeves Technologies UK Ltd and Jeeves Inc.

    15.7 European Economic Area

    • Governing law: the EU General Data Protection Regulation (“GDPR”).
    • Regulator: your local supervisory authority, or the lead supervisory authority applicable to JVS Technologies Europe Limited.
    • Controller entities: JVS Technologies Europe Ltd and Jeeves Inc.

    16. Jeeves Entities

    The Jeeves group is made up of different companies. We will identify which Jeeves entity you have a relationship with when you first apply for or use a Jeeves product or service. The following are Jeeves' confirmed active, customer-facing controller entities:

    • Jeeves Inc. — the provider of all services and controller of personal data relating to Jeeves products, accounts, web services, and rewards generally. Registered in the USA; address: 924 N. Magnolia Avenue, Suite 202, PMB 1075, Orlando, FL 32803.
    • United Kingdom — Jeeves Technologies UK Ltd and Jeeves Inc.
    • EEA — JVS Technologies Europe Ltd and Jeeves Inc.
    • Canada — Jeeves Tech (Canada) Inc. and Jeeves Inc.
    • Colombia — Jeeves Tech Colombia SAS and Jeeves Inc.
    • Mexico — JVS Inc. México, S.A. de C.V.; JVS México Soluciones, S.A.P.I. de C.V., SOFOM E.N.R.; and Jeeves Inc.
    • Brazil — Jeeves Brasil Instituição de Pagamento and Jeeves Inc.