Effective Date: October 21, 2026 · Last Updated: October 21, 2026
1. Introduction and Scope
1.1 Who We Are
Jetpack Workflow Inc, a corporation organized under the laws of Delaware, provides a cloud-based software application that helps accounting professionals track work and manage clients (the “Service”). This Privacy Policy (the “Policy”) describes how we collect, use, disclose, store, and protect information in connection with the Service.
1.2 Scope
This Policy applies to the Service, including the Jetpack Workflow website at jetpackworkflow.com and any related features, integrations, and support channels that link to this Policy. This Policy does not apply to third-party products or services that we do not control, including Google services, which are governed by their own privacy policies.
1.3 Our Role
For purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and comparable data protection laws, Jetpack Workflow acts as a data controller with respect to personal data collected and processed for its own business purposes, including account registration, billing, customer support, website analytics, marketing communications, and employee and contractor administration.
Where Jetpack Workflow processes personal data on behalf of a business customer, including information about that customer’s clients, employees, and other contacts stored within the Jetpack Workflow platform, we act as a data processor under the GDPR and UK GDPR, or a service provider where applicable under U.S. state privacy laws. In this capacity, we process such data in accordance with our agreements with customers and their documented instructions, except where otherwise required by applicable law.
1.4 Acceptance
By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you should not use the Service and should not grant Jetpack Workflow access to your Google Account.
2. Information We Collect
2.1 Information You Provide Directly
- Account information: name, email address, password or federated login identifier, organization name, and role.
- Billing information: billing contact, billing address, and payment card or bank details, which are collected and processed by our payment processor, Stripe. We do not store full payment card numbers.
- Support and communications: the contents of messages, attachments, and feedback you send to us, and records of support interactions.
- Optional content: files, documents, settings, and other content you choose to upload to or create within the Service.
2.2 Usage and Device Information
When you use the Service, we automatically collect certain technical information, including: IP address; browser type and version; operating system and device identifiers; application version; referring and exit pages; pages and features viewed; timestamps and duration of sessions; crash reports and diagnostic logs; and approximate location derived from IP address.
2.3 Cookies and Similar Technologies
We and our service providers use cookies, local storage, software development kits, and similar technologies to operate the Service, remember your preferences, authenticate sessions, measure performance, and understand usage. We use the following categories: strictly necessary, functional, analytics, and advertising. Advertising cookies are used only on our public website at jetpackworkflow.com and are not used within the Service application. Where required by applicable law, we obtain consent before setting non-essential cookies, and you may withdraw consent at any time through our cookie banner or your browser settings.
2.4 Information from Third Parties
We may receive information about you from identity providers (including Google Sign-In), our business customers who authorize your use of the Service, and service providers that support fraud prevention, billing, and analytics.
2.5 Information We Do Not Collect
We do not knowingly collect Social Security numbers, government identification numbers, precise geolocation, biometric identifiers, or special categories of personal data under Article 9 of the GDPR. Please do not submit such information to us through the Service.
3. Google User Data
This Section 3 describes, in detail and separately from all other information, the data we access from your Google Account through Google APIs (“Google User Data”). Our access to Google User Data is governed by this Policy and by the Google API Services User Data Policy, including the Limited Use requirements, and, where applicable, by the Google Workspace API user data and developer policy.
3.1 Authorization and Consent
We access Google User Data only after you authenticate through Google OAuth 2.0 and expressly grant Jetpack Workflow the specific permissions (“scopes”) presented to you on Google’s consent screen. We request the narrowest scopes necessary to deliver the features you have asked for, and we request incremental authorization — that is, we request a scope at the time the related feature is first used, rather than requesting all scopes at sign-up. We do not access, and cannot access, any Google data outside the scopes you have approved. Jetpack Workflow stores OAuth access and refresh tokens in encrypted form and uses them solely to perform the operations described below.
3.2 Scopes Requested, Data Accessed, and Purpose
The following table lists each Google API scope that Jetpack Workflow requests, the Google User Data accessed under that scope, and the specific user-facing feature the data supports.
| Google API Scope | Data Accessed | User-Facing Purpose |
|---|---|---|
| https://www.googleapis.com/auth/gmail.readonly (restricted) | Message headers (subject, sender and recipients, date, and message identifiers), plain-text and HTML message bodies, attachments, and labels. Labels are read only to skip drafts, spam, trash, and chats and to recognize sent mail; they are never stored. | To provide Client Emails: emails exchanged with a client are filed under that client and in the firm’s inbox, and their attachments are saved to the client’s files. Only messages to or from the client email domains your firm has defined in Jetpack Workflow, within the import window you choose (none, 30, 90, or 180 days), plus new messages after connection, are imported; all other messages are discarded without being stored. Jetpack Workflow does not request gmail.modify and cannot change or delete anything in your mailbox. |
| https://www.googleapis.com/auth/gmail.send (sensitive) | Permission to send email from the user’s Gmail address. This scope does not grant access to read the mailbox. | To let a member reply to a client email from inside Jetpack Workflow, from their own address, and to send emails from a connected account when triggered by an automation the firm has set up. |
| Basic profile: email, name, and profile picture (non-sensitive), requested through our sign-in provider, Auth0 | Email address, name, profile picture, and Google account identifier. | To create and authenticate the user’s Jetpack Workflow account when signing in with Google and to display the signed-in identity in the interface. |
3.3 Storage of Google User Data
For each email that involves one of your firm’s clients, Jetpack Workflow stores: the subject, snippet, and plain-text and HTML body; the sender, To, Cc, and Reply-To names and addresses; the sent time; Gmail message and thread identifiers and the Message-ID; and attachment filenames, with the attachment files themselves stored as files on the client’s record. For each connected Google account, we store the Gmail address, the scopes granted, a sync position, and the OAuth access and refresh tokens, which are encrypted. For replies written in Jetpack Workflow, we store the reply text and a record of each send. We do not store Bcc recipients, Gmail labels, or any message that does not involve a client, and we do not extract other information from emails. Google User Data is stored in our database, hosted by Heroku in the United States, and attachment files are stored in Amazon S3 in the United States. We retain Google User Data as described in Section 8.
3.4 Who Can See Your Google User Data
Client Emails is a shared feature within your firm. Emails imported from your connected Google account that involve a client are visible to your firm’s administrators, to members an administrator has given access to all Client Emails, and to members assigned to that client. Before you connect your Google account, Jetpack Workflow explains who will be able to see these emails and asks you to confirm your agreement, and we record that consent and the version of the disclosure you saw. Only the member who connected the mailbox can reply from it, archive its threads within Jetpack Workflow, disconnect it, or remove its emails from Jetpack Workflow. Attachments saved to a client’s files follow your firm’s file permissions. Google User Data is not made available to anyone outside your firm.
4. How We Use Information
4.1 Use of Google User Data — Limited Use
We use Google User Data only to provide, maintain, secure, and improve user-facing features that are prominent in the Jetpack Workflow user interface and that you have requested. Google User Data is not used for any purpose that is not visible to, and reasonably expected by, the user.
Jetpack Workflow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, and without limitation, Jetpack Workflow does not:
- transfer Google User Data to any third party, except as necessary to provide or improve user-facing features that are prominent in the Jetpack Workflow user interface, to comply with applicable law, as part of a merger, acquisition, or sale of assets after obtaining the user’s explicit prior consent, or for security purposes such as investigating a potential violation;
- use or transfer Google User Data for serving advertisements of any kind, including retargeting, personalized advertising, or interest-based advertising;
- sell Google User Data, or transfer or license it to data brokers, information resellers, or other information-resale services;
- use or transfer Google User Data to determine creditworthiness or for lending or credit-decisioning purposes; or
- allow humans to read Google User Data, except (i) with the user’s affirmative agreement to view specific messages, files, or records; (ii) for security purposes, including investigating abuse or a suspected violation of our terms; (iii) to comply with applicable law; or (iv) where the data has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.
Where Jetpack Workflow requests scopes governed by the Google Workspace API user data and developer policy, our use and transfer of data received from those APIs also adheres to that policy, including its limited use requirements.
4.2 Use of Other Information
We use information other than Google User Data for the following purposes:
| Purpose | GDPR Legal Basis (where applicable) |
|---|---|
| Providing, operating, and maintaining the Service; authenticating users | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing billing | Performance of a contract; legal obligation (Art. 6(1)(b), (c)) |
| Responding to support requests and communicating about the Service | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Securing the Service, detecting fraud and abuse, and maintaining audit logs | Legitimate interests; legal obligation (Art. 6(1)(f), (c)) |
| Measuring usage and improving features and performance | Legitimate interests; consent where required (Art. 6(1)(f), (a)) |
| Sending marketing communications | Consent, or legitimate interests where permitted (Art. 6(1)(a), (f)) |
| Complying with legal obligations and establishing or defending legal claims | Legal obligation; legitimate interests (Art. 6(1)(c), (f)) |
4.3 Aggregated and De-identified Data
We may create aggregated or de-identified data that cannot reasonably be used to identify you, and may use such data for internal operations, benchmarking, and reporting. We maintain such data in de-identified form and will not attempt to re-identify it, except as permitted by law to test the effectiveness of our de-identification. Aggregation and anonymization of Google User Data is performed only as permitted under Section 4.1.
5. Artificial Intelligence and Machine Learning
We do not use Google Workspace API data obtained through the Service to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Google Workspace APIs are not used to develop, improve, or train any such models, and we do not transfer Google Workspace API data to any third party for that purpose.
Jetpack Workflow does not offer any artificial intelligence or machine learning features and does not send Google User Data or other personal information to any artificial intelligence or model provider.
6. How We Share and Disclose Information
We do not sell personal information. Our public website uses advertising cookies, as described in Section 2.3, which may be considered “sharing” for cross-context behavioral advertising under some U.S. state laws; you can opt out at any time through our cookie banner. We do not use advertising cookies within the Service application, and we never use Google User Data for advertising. We disclose information only as described below.
6.1 Service Providers and Subprocessors
We engage service providers to perform functions on our behalf. Each is bound by a written agreement that limits its use of the information to the services it performs for us, requires appropriate technical and organizational security measures, and prohibits any independent use or disclosure. Where a service provider receives Google User Data, that access is limited to what is necessary to provide or improve user-facing features, consistent with Section 4.1.
| Subprocessor | Service Provided | Data Categories | Processing Location |
|---|---|---|---|
| Heroku and Amazon AWS | Application, database, and file hosting | All categories, including Google User Data | United States |
| Stripe | Payment and subscription processing | Billing and contact data; no Google User Data | United States |
| PostHog, Bugsnag, and Scout APM | Product analytics, session recording, error reporting, and performance monitoring | Usage and device data; no Google User Data (Google User Data is masked in session recordings) | United States |
| Intercom | Customer support and in-app messaging | Contact data and support content; no Google User Data | United States |
| Mailgun | Transactional and notification email | Contact data; notification emails contain no email subject or content | United States |
| Auth0 | Authentication and sign-in | Account and login data; no Google User Data | United States |
| HubSpot | Marketing, website analytics, and advertising (public website only; not used in the Service application) | Contact, usage, and device data; no Google User Data | United States |
| Cookiebot | Cookie consent management | Consent records and device data; no Google User Data | European Union |
| ProfitWell | Subscription analytics | Billing and usage data; no Google User Data | United States |
6.2 Affiliates
We may share information with our corporate affiliates for the purposes described in this Policy, subject to the same restrictions, including those in Section 4.1.
6.3 At Your Direction
We disclose information to third parties when you direct us to do so, including when you connect Jetpack Workflow to another application, share content with another user, or authorize an integration.
6.4 Legal Requirements
We may disclose information if we believe in good faith that disclosure is reasonably necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our terms of service and other agreements; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Jetpack Workflow Inc, our users, or the public. Where permitted by law, we will notify you before disclosing your information in response to legal process, and we will seek to narrow requests that we consider overbroad.
6.5 Business Transfers
If Jetpack Workflow Inc is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy. Google User Data will be transferred in connection with such a transaction only after we obtain your explicit prior consent, as required by Section 4.1.
7. Data Storage and Security
We maintain an information security program designed to protect personal information and Google User Data against unauthorized access, use, disclosure, alteration, and destruction. Our controls are aligned with the Cloud Application Security Assessment (CASA) framework and the OWASP Application Security Verification Standard (ASVS), and include the following.
7.1 Encryption
All data transmitted between your device and the Service, and between the Service and Google APIs, is encrypted in transit using TLS 1.2 or higher, and HTTPS is enforced. Data at rest, including databases, file storage, and backups, is encrypted using AES-256. OAuth access and refresh tokens are additionally encrypted by our application using AES-256-GCM. Encryption keys and application secrets are stored as encrypted configuration variables with our hosting provider and in a password manager with access limited to authorized personnel; they are never stored in source code.
7.2 Access Controls and Least Privilege
Access to production systems and to personal information is restricted to personnel with a documented business need, granted on a least-privilege and role-based basis, reviewed at least quarterly, and revoked promptly upon role change or separation. Changes made through administrative tools are recorded, and administrative access is segregated from ordinary user access.
7.3 Authentication
Personnel accounts with access to production environments, source code repositories, cloud consoles, and administrative tooling are protected with multi-factor authentication, and we are moving to enforce this through organization-wide settings. Credentials and secrets are stored in a password manager or as encrypted configuration variables, never in source code. Where an account must be shared, its credentials are held in the password manager and access is limited to authorized personnel.
7.4 Logging and Monitoring
Our application records changes to core records, each user’s consent to connect a Google account, and each email sent through the Service. Hosting and application monitoring logs are retained for up to 14 days, access to them is restricted to authorized personnel, and we review them when investigating errors or suspected security incidents.
7.5 Secure Development and Vulnerability Management
We follow a secure software development lifecycle that includes peer code review, automated static analysis on every build, automated monitoring and updating of third-party dependencies, and separation of development, staging, and production environments. Identified vulnerabilities are triaged by severity, with critical issues prioritized, and remediated within 90 days.
7.6 Independent Security Assessment
Because Jetpack Workflow requests a restricted Google API scope, we are completing a Cloud Application Security Assessment (CASA) conducted by a Google-authorized assessor, and we will renew this assessment every 12 months as Google requires. We remediate findings in accordance with the timelines above.
7.7 Business Continuity
We maintain encrypted backups of production data with a recovery point objective of near zero, supported by point-in-time recovery covering the preceding four (4) days, and a recovery time objective of approximately three (3) hours, and we test restoration procedures at least annually.
7.8 Incident Response and Breach Notification
We maintain a documented incident response plan that is tested at least every six (6) months and that assigns roles for detection, containment, eradication, recovery, and post-incident review. In the event of a personal data breach, we will notify affected users and applicable regulators without undue delay and, where required, within the periods prescribed by applicable law, including seventy-two (72) hours of becoming aware of a qualifying breach under Article 33 of the GDPR. Where we act as a processor or service provider, we will notify the relevant controller or business without undue delay. Notification will describe, to the extent known, the nature of the incident, the categories of data involved, the likely consequences, and the measures taken.
7.9 No Absolute Security
No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.
8. Data Retention, Deletion, and Revocation
8.1 Retention Periods
We retain information only for as long as necessary for the purposes described in this Policy:
| Data Category | Retention Period | Basis |
|---|---|---|
| Google User Data (imported emails and attachments) | While the firm is a customer, until removed by the user; erased 90 days after the firm’s subscription ends | Necessary to deliver the requested feature |
| OAuth access and refresh tokens | Until the user disconnects Google or is removed from their firm’s Jetpack Workflow account | Necessary to maintain the authorized connection |
| Account and profile information | Life of the account; erased 90 days after the firm’s subscription ends | Performance of the contract |
| Billing and transaction records | 7 years | Tax, accounting, and audit obligations |
| Support communications | Life of the account | Service quality and dispute resolution |
| Security and audit logs | Up to 14 days | Security monitoring and legal compliance |
| Backups | 30 days on a rolling basis (daily, weekly, and monthly snapshots) | Business continuity |
8.2 How to Delete Your Data
You may delete your data at any time by: (a) using “Remove all emails from Jetpack” in Client Emails settings, which deletes every email your connected mailbox brought into the Service and the attachment files those emails added (available to the member who connected the mailbox, including after disconnecting); (b) deleting a client, which deletes that client’s emails, or deleting individual files; or (c) emailing dev@jetpackworkflow.com with the subject line “Data Deletion Request” to ask us to delete your account or your firm’s data. We will verify your identity before acting on a request submitted by email.
8.3 Revoking Google Access
You may disconnect your Google account in Client Emails settings, or revoke Jetpack Workflow’s access at any time, independently of this Policy, through your Google Account permissions page at https://myaccount.google.com/permissions. Disconnecting revokes our access at Google, deletes the stored OAuth tokens, and stops syncing. Revoking access through Google immediately terminates our ability to access new Google User Data, and syncing stops when we next attempt to use the connection, typically within one day. Neither action deletes emails and attachments already imported, which remain with your firm as its record of client correspondence; to delete them, use the controls described in Section 8.2. Revoking access may disable features of the Service that depend on the revoked scopes.
8.4 Deletion Timeline
We will delete, or permanently de-identify, your Google User Data and other personal information within 30 days of a verified deletion request. Emails removed using “Remove all emails from Jetpack” are deleted from our production systems within minutes. When a firm’s subscription ends, we erase that firm’s data, including Google User Data, 90 days later. Residual copies in encrypted backups are purged in the ordinary course of our backup rotation within 30 days of deletion from production systems. The text of replies written in Jetpack Workflow, records of emails sent, and consent records are retained until the firm’s data is erased. We may retain information beyond these periods only where and for so long as retention is required by law or is necessary to establish, exercise, or defend legal claims, in which case the information remains subject to the protections in this Policy.
9. Your Privacy Rights
9.1 Rights Available to All Users
Regardless of where you reside, you may:
- access the personal information we hold about you and request a copy;
- correct inaccurate or incomplete personal information;
- request deletion of your personal information, as described in Section 8;
- obtain a portable copy of information you provided to us in a structured, commonly used, machine-readable format;
- object to or request that we restrict certain processing; and
- withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
To exercise these rights, contact us at dev@jetpackworkflow.com. You may also remove emails imported from your Google account at any time using the controls described in Section 8.2. We will respond within the period required by applicable law and, in all cases, without undue delay. We may need to verify your identity before responding, and we will not discriminate against you for exercising your rights.
9.2 United States State Privacy Rights
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law, you may have the rights described in Section 9.1, as well as the right to confirm whether we process your personal information, the right to opt out of the sale or sharing of personal information and of targeted advertising, the right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects, the right to limit the use of sensitive personal information, and the right to appeal a denial of a request.
We do not sell personal information, as that term is defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Advertising cookies on our public website may constitute “sharing” of personal information for cross-context behavioral advertising under the CCPA; you may opt out of this sharing through our cookie banner. We do not use advertising cookies within the Service application. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA. We have not sold or shared the personal information of consumers under sixteen (16) years of age.
You may submit a request through an authorized agent. Requests may be submitted at dev@jetpackworkflow.com, by phone at 412-543-8571, or through our web form at jetpackworkflow.com. If we deny your request, you may appeal by writing to dev@jetpackworkflow.com; we will respond to an appeal within 45 days and will explain the basis of our decision and how to contact your state attorney general.
Categories of personal information collected, the sources, the business or commercial purposes, and the categories of recipients are described in Sections 2, 3, 4, and 6 of this Policy and are incorporated here by reference.
9.3 European Economic Area, United Kingdom, and Switzerland
9.3.1 Controller and Legal Bases
Jetpack Workflow is the controller of personal data processed through the Service, except where we act as processor for a business customer. The legal bases on which we rely are identified in the table in Section 4.2. Where we rely on legitimate interests, we have conducted a balancing assessment and will provide further information on request.
9.3.2 Your Rights
Subject to applicable law, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection (including objection to processing based on legitimate interests and to direct marketing), and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
9.3.3 International Transfers
We are headquartered in Delaware, United States and may transfer personal data to the United States, which may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on an adequacy decision where one applies and otherwise on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum, together with supplementary technical and organizational measures where appropriate. A copy of the relevant transfer mechanism is available on request at dev@jetpackworkflow.com.
9.3.4 Supervisory Authority
You have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place of the alleged infringement, including the Information Commissioner’s Office in the United Kingdom. We would appreciate the opportunity to address your concerns before you do so.
10. Children’s Privacy
The Service is not directed to children. We do not knowingly collect personal information from children under the age of thirteen (13), or under the age of sixteen (16) where a higher age threshold applies under applicable law, including the GDPR as implemented in the relevant member state. If you are below the applicable age, you may not use the Service or authorize Jetpack Workflow to access your Google Account. If we learn that we have collected personal information from a child below the applicable age without the required parental consent, we will delete that information promptly. A parent or guardian who believes that a child has provided personal information to us may contact us at dev@jetpackworkflow.com.
11. Changes to This Policy
We may update this Policy from time to time. When we do, we will revise the “Last Updated” date at the top of this Policy and post the revised version on our website at jetpackworkflow.com. If the changes are material, we will provide additional notice, which may include email to the address associated with your account or an in-product notice, at least 10 days before the changes take effect.
If we materially change the ways in which we use or disclose Google User Data, we will notify you and obtain your consent before the new use takes effect, including by requesting re-authorization through the Google OAuth consent screen where additional or broader scopes are required. Continued use of the Service after the effective date of a non-material change constitutes acknowledgment of the revised Policy. Prior versions of this Policy are available on request.
12. Contact Information
If you have questions, concerns, or requests regarding this Policy or our privacy practices, contact us:
| Contact | Details |
|---|---|
| Privacy inquiries and rights requests | dev@jetpackworkflow.com |
| Security disclosures | dev@jetpackworkflow.com |
| Mailing address | Jetpack Workflow Inc, Attn: Privacy, 1151 Freeport Road, #131, Pittsburgh, PA 15238 |
| Telephone | 412-543-8571 |
We will acknowledge inquiries within 10 days and will respond substantively within the periods required by applicable law.
