Privacy Policy
Effective 2026-10-19. This policy explains what personal data Jepela processes, why, where, for how long, and your rights. It covers the website jepela.com, the console app.jepela.com, the demos, and the Jepela API.
Who we are
The controller for the personal data described here is Jepela Sverige AB, c/o ICA Roslagstull, Birger Jarlsgatan 122, 114 20 Stockholm, registration number 559584-8077. Contact for privacy questions: info@jepela.com.
Jepela is a service for business customers. When a customer sends data about its own users, clients or other people to the API (in a state, a question, or a memory line), the customer is the controller of that data and Jepela processes it on the customer's behalf under the Data Processing Agreement. This policy covers the data Jepela controls itself.
What we process and why
| Data | Whose | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Name, work email, company, region, what you want to decide, password (stored only as a salted hash) | People who register an account | Creating and running the account, approving it, security | Contract (art. 6(1)(b)); legitimate interest in preventing abuse (art. 6(1)(f)) |
| The time, IP address and version of the terms accepted at sign-up | People who register | Proof of acceptance | Legitimate interest (art. 6(1)(f)) and legal claims |
| API keys (stored only as hashes), usage records: time, route, counts (characters, tokens, answers, memory lines written), cost, key id, the subject id the request named, and for a decision its model, decision id, engine time and whether it came from the cache | Customers (a subject id is chosen by the customer and can refer to one of its own users or clients) | Metering, billing, showing usage | Contract (art. 6(1)(b)) |
| Credit and top-up requests, invoices | Customers | Billing and bookkeeping | Contract; legal obligation to keep accounts (art. 6(1)(c)) |
| For card payments: name, email, billing address, VAT number and the payment's amount and status, and any refund or dispute of it (its amount, status and the dispute's reason code) (the card details go only to the payment provider, never to Jepela) | Customers who pay by card | Taking the payment, VAT, receipts and invoices | Contract (art. 6(1)(b)); legal obligation to keep accounts (art. 6(1)(c)) |
| Emails you send us and our replies | Anyone who writes to us | Answering you | Legitimate interest (art. 6(1)(f)) |
| IP address and request data needed to deliver a page or an API answer | Visitors and customers | Delivering the service and keeping it secure | Legitimate interest (art. 6(1)(f)) |
| What you type into the public demos | Demo visitors | Showing the demo answer | Legitimate interest (art. 6(1)(f)) |
We do not use analytics, advertising, tracking pixels or third-party fonts, and we do not build profiles of visitors. We do not sell or share personal data for advertising. We do not make decisions about account holders by automated means that have legal or similarly significant effects. An account is approved by a person, or automatically when an account whose email address is confirmed pays by card; declining an account is always done by a person.
Cookies and similar storage
Only strictly necessary storage is used: a login cookie in the console (jepela_console, for up to 7 days), a login cookie in the staff dashboard, and a demo session identifier kept in your browser tab's session storage so the demos can keep your test data apart from other visitors'. None of these is used for tracking, so no consent banner is needed. See the Cookie Notice.
Who receives the data
Our service providers (subprocessors) host and run Jepela for us, bound by data processing terms: a hosting provider and an engine computing provider in the United States, a domain provider in Sweden, and an email provider in the United States (see Subprocessors; customers get their names with their agreement and on request). Card payments are made on a payment provider's checkout page; the provider resells the credit to you, handles the card details, VAT, receipts and invoices, and is responsible for that data itself. We also disclose data where the law requires it. Nothing else.
Where the data is processed
Your account data is held on our servers in the United States. The API data of a customer stays in the region the customer chose; today the only open region is the United States, where the engine runs too. A Europe region is planned. We transfer personal data from the EU or EEA to the US only under the European Commission's Standard Contractual Clauses, or another transfer mechanism the GDPR allows, together with the security measures described in the DPA.
How long we keep it
| Data | Kept |
|---|---|
| Account data | While the account exists; deleted within 30 days of a deletion request or of our closing the account |
| Subject memories sent by a customer | Until the customer deletes them, or the account is deleted |
| Decision records (for quality reports) | 30 days, then deleted automatically |
| Batches sent by a customer (the uploaded requests and their results) | 30 days from the upload, then deleted automatically; sooner when the customer deletes its batches or the account, and a subject's requests and results when the customer deletes that subject |
| Usage records (with the subject ids they name), credit and invoices | As long as bookkeeping law requires (in Sweden, 7 years); deleting a subject, or the account, does not remove the subject id from the usage records |
| Demo inputs | Deleted when the demo session has been idle, and when the demo restarts |
| Request contents in server logs | Not logged |
Your rights
You can ask for access to your data, a copy in a portable format (the console's "Download my data" gives you one), correction, deletion (the console's "Delete account"), restriction, and you can object to processing based on legitimate interest. Write to info@jepela.com; we answer within one month. You may also complain to a data protection authority, in Sweden the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live or work.
If your data reached Jepela because a Jepela customer sent it to the API, please contact that customer first; we help them answer you.
Security
Connections use TLS. Passwords and API keys are stored only as salted or cryptographic hashes. Each customer's data is kept apart from other customers'. Only Jepela's operator can log in to the servers. The engine only answers requests from Jepela's own API.
United States residents
We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use tracking technologies, so Global Privacy Control and "Do Not Track" signals require nothing further from us. Residents of US states with privacy laws may ask to know, correct or delete their personal information by writing to info@jepela.com; we will not treat you differently for asking.
Children
Jepela is a service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Changes
We will post changes here with a new effective date, and tell account holders by email before material changes take effect.