Privacy Policy

• Your account. Your email address and name, how you signed in, your role on the account (owner, member or viewer), and your notification choices.
• Your workspace and sites. The company name, the Webflow sites you connect, their addresses, and your plan.
• Your connected Webflow site. The pages, text, CMS content and structure Jimmy reads to do its work; snapshots from before and after each change; and, when you drop a pin, a screenshot of the part of the page you pointed at.
• What you tell Jimmy. Your chats, your pins and replies, your brand voice and guardrails, and any request you send to the team, with the phone number you add to it.
• Files you upload. The files you add to teach Jimmy (PDF, Word, text and similar), and the passages Jimmy reads from them. Passages that look like secrets, such as keys, passwords or card numbers, are left out and never stored.
• Checks of your site. Results of speed checks, link checks and build checks, and whether your public home page answered each time the uptime monitor read it.
• Billing. Your plan, invoices and payment status. Your card details are held by Stripe, not by Jimmy; we never see or store your full card number.
• Usage logs. What Jimmy did for you and when (each task, its steps and each change), and technical logs our hosting keeps, such as IP addresses, browser type and times of requests.
• Cookies. Only the ones that keep you signed in and finish a sign-in, an invite or a Webflow connection. No advertising or analytics cookies.

• To run Jimmy for you: read your site, propose and make the changes you ask for, check them, undo them, and publish when you click.
• To check your site and watch that it is up, and to tell you what we find.
• To write in your voice, from your brand voice and the files you upload.
• To send sign-in links and the notifications you choose.
• To bill you, and to keep to one trial per company and per Webflow site.
• To answer you, and to pass a request you send to the team to the people who will do it.
• To keep Jimmy secure and reliable, fix problems, and meet our legal obligations.

We do not sell your personal information, we do not use it for advertising, and we do not use your content to train AI models.

Jimmy uses Google user data in two ways, each only with your permission:

• Sign in with Google. If you choose it, Jimmy receives your basic Google profile (your name and email address) to sign you in.
• Google Analytics and Search Console. If you connect Google to a site in Jimmy, Jimmy reads, read-only, your Google Analytics 4 reports (sessions, users and top pages) and your Google Search Console performance data (clicks, impressions, queries and pages) for that site. Jimmy asks for this access only when you choose to connect, and never changes anything in your Google account.

How it is used. Your Google Analytics and Search Console figures are shown on Site health and in the weekly digest for your account, and nowhere else.

What we never do with it. Google user data is not sold, not used for advertising, not shown to other customers, not used to train any AI model, and not sent to the AI model Jimmy uses. People at Ammo do not read it, except with your permission (for example, when you ask us for help with it), when needed for security, or when the law requires it.

How it is kept.The access Google gives Jimmy is stored in an encrypted vault. You can disconnect Google in Jimmy at any time, or remove Jimmy's access from your Google Account's permissions page. Disconnecting deletes the stored access at once, and the stored Google figures within 30 days.

Jimmy's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Jimmy uses Anthropic's AI model to do its work. The model reads your site's content, your chats and pins, and passages from your uploaded files, only to propose and make the changes you ask for. Under Anthropic's API terms, Anthropic does not train its models on this data. Google user data is never sent to the model.

We share data only with the services that help run Jimmy, each for its own part of the work:

• Supabase: the database, sign-in and file storage.
• Vercel: hosts the Jimmy app and these pages.
• Fly.io: runs the worker that carries out Jimmy's tasks, such as reading pages and running checks.
• Inngest: schedules Jimmy's tasks and their steps.
• Anthropic: the AI model, as described above.
• Stripe: payments.
• Resend: sends sign-in and notification emails.
• Webflow: your own site, reached with the access you authorize.
• MarkUp: the pins on your pages, with the name and email of whoever leaves a comment.
• Google: PageSpeed Insights for speed checks (your public address only); sign-in, if you choose it; Analytics and Search Console, if you connect them.
• Ammo's team and its client portal: your account's name, plan and owner, a request you choose to send to the team, and a change Jimmy hands to a person. For clients of a web studio, the portal is also where the account and its people come from. Ammo's team is told about a request in Slack.

We may also share data if the law requires it, to protect people or Jimmy from harm, or as part of a sale or merger of the business, under this policy. Jimmy's database is in the United States, and our providers may process data in other countries.

• Account data is kept while the account is open.
• When an account is closed, its data is deleted within 30 days, unless the law requires us to keep some of it longer.
• Uploaded files are kept until you remove them or the account closes.
• Uptime results are kept for 35 days.
• Google figures are deleted within 30 days of disconnecting Google.
• Backups age out on their own schedule after deletion.

Data travels encrypted between your browser, Jimmy and the services above. Each account sees only its own data, and the database enforces that. The access Webflow and Google give Jimmy is kept in an encrypted vault, never in a page, a log or a message. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

• See and export. The account owner can download the account's data as one file from Settings.
• Correct. Change your details in Jimmy, or ask us to.
• Delete. The owner can ask us to delete the account from Settings or by email. We do it within 30 days. Your Webflow site is not touched.
• Disconnect. Disconnect Webflow or Google at any time; Jimmy then stops using that access.
• Emails. Sign-in emails come only when you ask for one. Choose which notification emails you get in Jimmy, or ask us to stop them.

Depending on where you live, you may have further rights over your personal information, such as to object to how it is used. To use any of them, email help@justtelljimmy.com. We answer within 30 days.

Jimmy is not for anyone under 16, and we do not knowingly collect their information. If you think we have, email us and we will delete it.

We may update this policy. The date at the top says when it last changed. If a change matters, we tell the account owner by email or in Jimmy before it takes effect.

Questions about your data or this policy? Email help@justtelljimmy.com.