1) Who we are
This Privacy Policy explains how CodeFlow ("we", "us", "our") processes personal data when you use JabaSupport (the "Service").
Controller: CodeFlow. For privacy requests, data deletion, or questions about this Policy, contact us at support@jabasupport.com or through your Service account dashboard, where available.
2) What personal data we collect
We process the following categories of data:
• Account and profile data: name, email address, company name, credentials, and API keys.
• Service and communications data: messages, files, chat metadata (e.g. timestamps), and customer identifiers submitted through the widget.
• Technical and usage data: IP address, browser type, approximate location, security logs, and performance metrics.
• Billing data: payments and credit top-ups are processed by Paddle, our Merchant of Record. We receive limited transaction information (such as status and amount) and do not see or store your full credit card details on our systems.
• Support interactions: information you provide when contacting our team.
Note for widget users: when you embed our widget, you are the controller of your customers' personal data. We process that data as a processor on your instructions, as described in our Terms of Service and, where applicable, a Data Processing Agreement (DPA).
3) Purposes and legal bases
We process data to:
• Provide and maintain the Service (contractual necessity).
• Ensure security and prevent fraud (legitimate interests).
• Communicate updates and support (contractual necessity / legitimate interests).
• Comply with legal, tax, and accounting obligations (legal obligation).
4) Cookies and local storage
We use essential cookies and local storage for authentication and to keep the chat widget and Service functional. You can manage these via your browser settings; however, the Service may not function correctly without them.
5) Third parties and subprocessors
We share data with trusted providers only as necessary:
• Infrastructure: cloud hosting providers (for example AWS or Hetzner, depending on our setup).
• AI features: OpenAI (only when AI features are enabled; content may be sent to generate responses). Data sent to the OpenAI API is not used to train OpenAI's models.
• Payments: Paddle (as our Merchant of Record).
• Communication: email delivery services (for example Postmark or SendGrid, depending on our setup).
6) International transfers
Data may be processed in Serbia, the EEA, or the United States. Where the GDPR applies to transfers outside the EEA, we ensure appropriate safeguards (such as Standard Contractual Clauses) are in place with our providers, where required by law.
7) Retention
We keep your data while your account is active. After account closure, we may retain certain data for up to 30 days for backup and operational purposes, or longer where required by Serbian tax, accounting, or other applicable laws.
8) Your rights
Under the GDPR and local laws (where applicable), you may have the right to:
• Access your data.
• Rectify incorrect information.
• Erase your data ("right to be forgotten"), subject to legal exceptions.
• Object to or restrict certain processing.
• Data portability.
To exercise these rights, email us at support@jabasupport.com. We may need to verify your identity before responding.
9) Data Processing Agreement (DPA)
If your organization requires a formal DPA under the GDPR, you may request our standard template by contacting support@jabasupport.com.
10) Security
We use industry-standard encryption (such as SSL/TLS) and organizational measures to protect your data. However, no transmission over the Internet is completely secure.
11) Children
The Service is a B2B tool and is not intended for children under 16.
12) Changes to this policy
We may update this Privacy Policy from time to time. Significant changes will be notified via email or a dashboard notification where appropriate.
13) Links
Our Terms of Service are available on this website under /tos.
