Privacy policy

Last updated: October 7, 2026

Who is responsible for your data

Jaly’s operator, trading as WB DIGITAL, is responsible for the personal data processed through the service. Full publisher identification and contact details are in the Legal notice.

What we collect

We also record verified account creation and paid-subscription invoice outcomes, including plan, billing interval, amount and currency. These operational records do not contain card details or request content. Identified conversion events are sent to PostHog only when optional analytics has been accepted.

Your account can also contain the first and last names, company and contact name, display preferences and company logo you provide. Uploaded company logos are served through public asset URLs and may appear in exported or shared documents; do not upload a confidential image. Saved documents and sharing references contain the information you choose to include.

• Account data: your email address and a password (stored hashed by our authentication provider, Supabase).
• Request content: everything you enter in the builder: goods, addresses, time windows, and contact details (names, phone numbers, emails) of pickup and delivery contacts. You are responsible for having the right to share those third-party contact details.
• Usage events: when a transport request is exported, copied, or saved, we record the action, its outcome, and your plan tier for product statistics.
• Billing data: handled by Stripe; Jaly retains subscription references, status and verified invoice outcomes, never card numbers.

Why we use your data

Account, saved-request and subscription data are used to provide the service you request. Security diagnostics and operational records help us prevent abuse, investigate failures and administer the service. These activities rely, as appropriate, on performance of the contract, legitimate interests or legal obligations. Optional detailed analytics and session recordings rely on your consent.

Browser storage and shared links

The builder can keep drafts and preferences in your browser. Signing out or deleting an account does not necessarily clear browser storage or files you downloaded. On a shared device, clear local drafts and downloaded documents yourself. Anyone who receives a sharing link may be able to access the information it makes available; share links only with intended recipients.

AI Fill and address suggestions

When you use AI Fill, the text or document content you submit is sent to OpenAI to suggest transport fields. Jaly does not retain the original AI submission as a saved request; fields you confirm can become part of your draft or saved request. Provider processing is separate from Jaly’s storage. Mapbox receives the address text you type to return suggestions. Do not submit information you are not entitled to share.

Cookies

Necessary cookies support sign-in and remember your privacy choice. Basic PostHog audience measurement runs before a choice and after refusal, without analytics cookies or browser storage, account identification, recordings, advertising parameters or customer content. PostHog uses a site-specific daily hash of IP address and browser user agent to estimate visitors. Detailed analytics, account-linked activity and masked recordings start only after Allow. Withdrawal stops those in all open tabs; basic cookieless measurement continues. Earlier cookieless activity is not linked to your account. Vercel Web Analytics and Speed Insights measure audience and performance separately. Advertising tracking is disabled. You can change your choice here:

Recordings and operational diagnostics

With optional analytics accepted, PostHog records selected feature actions and masked interface interactions. Entered private fields and sensitive rendered content are masked; interface labels, navigation and checkbox states can remain visible. Recordings are not video access to your desktop or other applications. Server logs and error diagnostics help investigate failures separately from optional analytics; Jaly’s structured server logs use action, status, timing and constrained diagnostic codes rather than request bodies.

Processors

Supabase (database and authentication), Stripe (payments), Mapbox (address search, your typed address queries are sent to Mapbox to return suggestions), Sentry (error monitoring), PostHog (cookieless audience counts; detailed analytics and masked recordings only with consent, EU region), OpenAI (Fill with AI, a Plus feature: the text you paste is sent to OpenAI to read the transport details, and Jaly does not keep it), and Vercel (hosting, Web Analytics, and Speed Insights).

Security, recipients and international processing

Access to account records is restricted through authentication and server-side authorization. Published sharing links provide the access you intentionally enable. Service providers process the information needed for their functions. Depending on the provider and service, processing may occur outside the European Economic Area; information about the applicable provider arrangements can be requested at privacy@jaly.app. No online service can promise absolute security.

Retention

Retention depends on the purpose of each record. Saved account content follows the account lifecycle and deletion controls described below; browser drafts and downloaded copies are under your control. Provider analytics and diagnostics follow their configured retention settings, while billing records may be retained to meet legal obligations. Account deletion does not automatically erase Stripe’s records or copies already downloaded or shared.

Account and request data are kept while your account exists. Deleting your account from the account page permanently removes your profile, saved requests, and export history.

Deleting an account also removes its verification, conversion and privacy-preference records from Jaly. Operational usage rows remain without their account reference. A separate request to erase provider analytics data is queued and remains pending until provider erasure is confirmed.

Your rights (GDPR)

You can access, rectify, export, or erase your data. Deletion is self-service on the account page; for anything else contact privacy@jaly.app. You may also lodge a complaint with the CNIL.

Where applicable, you may also request restriction of processing, portability or object to processing based on legitimate interests. Withdrawing optional analytics consent does not affect earlier lawful processing. We may need proportionate information to verify a data-rights request. These rights also apply to people whose contact details appear in a transport request; contact privacy@jaly.app for assistance.