Privacy Policy

Jubust ("Jubust," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, store, and protect information when you interact with our websites, products, or services (collectively, the "Services").

The data controller responsible for processing your personal data is:

Manuel Bichler & Dr. Georg Heiler
Piaristengasse 56-58/1/2
1080 Vienna, Austria
Email: privacy@jubust.com

We process personal data only where we have a lawful basis under GDPR Article 6. The specific data we collect depends on how you interact with our Services.

When you visit our marketing website, your requests are routed through Cloudflare (Cloudflare Inc., USA), which acts as a content delivery network and security proxy. Cloudflare processes your IP address, browser information, and request data to deliver the website and protect it against malicious traffic. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

Our web servers additionally collect limited technical data in server logs, including your browser type, IP address, and pages visited. We use this data to maintain the security and functionality of the website.

• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
• Retention: 90 days

You can interact with us on our LinkedIn page and through our YouTube video presence at https://video.jubust.com/ by commenting on our posts, reacting to them, sharing them, or sending them to other users. In this context, we process your interactions, your username, and, where applicable, the personal data of invited third parties.

This data may also be processed by the respective platforms. Where the interaction takes place directly via our profiles on third-party platforms, the respective platform and we act as joint controllers pursuant to Article 26 GDPR. Further information regarding the processing of your data can be found at:

• LinkedIn: https://de.linkedin.com/legal/privacy-policy
• YouTube: https://policies.google.com/privacy

When you contact us or request a sample dataset, we collect your name, email address, company, role, and message content. We use this data to respond to your inquiry and evaluate whether your requested patent slice fits the current Jubust workflow.

• Legal basis: Pre-contractual measures (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR)
• Retention: Until the inquiry is resolved, plus 6 months

Contact form submissions are processed internally only and are not shared with third parties.

When you use the Jubust application, we process your account information, uploaded patent documents, extracted data, and usage data as necessary to provide and improve the Services.

• Legal basis: Contract performance (Art. 6(1)(b) GDPR)
• Retention: Duration of the contract plus applicable statutory retention periods

The Jubust web dashboard uses Sentry (Functional Software Inc., hosted at de.sentry.io in the EU) to monitor application errors and improve stability. Sentry collects error reports, browser and device information, IP addresses, and console logs. Session replays are recorded for 10% of production sessions and 100% of sessions where an error occurs. All text content and media in session replays is masked. Replays capture page layout and user interactions but not readable text or images.

• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) - maintaining application stability and diagnosing errors
• Retention: 90 days

Uploaded documents and images are stored on Hetzner (Hetzner Online GmbH) S3-compatible object storage in the EU (Nuremberg, Germany).

• Legal basis: Contract performance (Art. 6(1)(b) GDPR)
• Retention: Duration of the contract; deleted upon account termination unless statutory retention obligations apply

Patent evidence processing may involve OCR, text extraction, chemical structure recognition, normalization, and AI-assisted analysis performed through cloud provider services (currently AWS, EU region), on-premises GPU servers in Austria, managed infrastructure, Mistral AI (Mistral AI SAS, France), and, where enabled for cross-model validation, OpenAI (OpenAI OpCo, LLC / OpenAI Ireland Ltd., as applicable).

When OpenAI is used for patent metadata validation, the data sent is limited to patent frontmatter text and extracted metadata required for the relevant workflow. OpenAI's API commitments state that API Platform inputs and outputs are not used for model training by default.

• Legal basis: Contract performance (Art. 6(1)(b) GDPR)
• Retention: Duration of the contract plus applicable statutory retention periods

We use strictly necessary technologies for the Services and limited privacy-conscious analytics on the marketing website to understand aggregate page usage, calls to action, and contact-form conversion.

• Marketing website (jubust.com): Product analytics through PostHog Cloud EU. Until you accept optional analytics, or if you reject them, PostHog runs in cookieless mode without analytics cookies or localStorage/sessionStorage identity persistence and without session replay. If you accept optional analytics, persistent analytics and masked session replay may be enabled for the marketing site. Form field values are masked, and we do not send names, email addresses, company names, or free-text contact messages to PostHog in our explicit event payloads. We may store a minimal privacy-choice preference to remember your selection.
• Web dashboard: localStorage for authentication tokens and UI preferences only. These are strictly necessary for the application to function.

We do not use advertising cookies or social media tracking pixels across any of our Services.

We use the following third-party service providers to operate the Services:

• Cloudflare (Cloudflare Inc.) - Content delivery and security proxy (global edge network)
• Sentry (Functional Software Inc.) - Error monitoring and session replay (EU, de.sentry.io)
• Hetzner (Hetzner Online GmbH) - Document storage and hosting (EU, Nuremberg)
• AWS (Amazon Web Services) - Document processing services (EU region)
• MotherDuck (MotherDuck Inc.) - Metadata and analytics database for documents (EU region)
• PostHog (PostHog Inc.) - Consent-gated marketing website analytics and masked session replay (EU cloud hosting)
• Proton Mail (Proton AG) - Email services (Switzerland)
• Resend (Resend Inc.) - Email delivery (EU region)
• Mistral AI (Mistral AI SAS) - AI services (EU, France)
• OpenAI (OpenAI OpCo, LLC / OpenAI Ireland Ltd., as applicable) - AI services for patent metadata extraction validation (region and retention per production API configuration)

We may also disclose personal data to courts, law enforcement, or regulatory authorities where required by applicable law or to protect our legitimate interests.

Some of our sub-processors are US-based companies: Cloudflare, Sentry (Functional Software Inc.), MotherDuck (MotherDuck Inc.), PostHog (PostHog Inc.), and Resend (Resend Inc.). Where enabled, OpenAI services may also involve OpenAI entities or infrastructure outside the EU/EEA. Where data is processed in or accessible from outside the EU/EEA, we rely on the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), and/or the applicable data processing addendum as the legal basis for the transfer. Sentry, MotherDuck, PostHog, and Resend process data in EU regions where configured. Cloudflare routes requests through its global edge network, which may include servers outside the EU/EEA. We use EU-based infrastructure wherever possible.

We implement appropriate administrative, technical, and organizational measures to protect your personal data against unauthorized access, use, alteration, or disclosure. Data is encrypted in transit (TLS). However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

Under the General Data Protection Regulation, you have the following rights:

• Access (Art. 15) - request a copy of your personal data
• Rectification (Art. 16) - correct inaccurate data
• Erasure (Art. 17) - request deletion of your data
• Restriction (Art. 18) - restrict processing of your data
• Portability (Art. 20) - receive your data in a portable format
• Object (Art. 21) - object to processing based on legitimate interest
• Withdraw consent (Art. 7(3)) - where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@jubust.com.

You also have the right to lodge a complaint with the Austrian Data Protection Authority:

Osterreichische Datenschutzbehorde
Barichgasse 40-42, 1030 Vienna
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

Unless a specific retention period is stated above, all personal data is deleted or anonymized once the purpose for which it was collected has been fulfilled and any statutory retention obligations, for example under Austrian commercial or tax law, have expired.

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the Last updated date at the top of this page. For material changes, we will notify affected users directly.

If you have any questions about this Privacy Policy, please contact us at:

Jubust
Email: privacy@jubust.com
Vienna, Austria