Privacy policy

This policy describes how JARVA Labs ("we", "us") collects, uses, and protects your data. We aim for the shortest version of this document that still satisfies the GDPR. If you find something unclear, email hello@jarvalabs.io.

Who we are

JARVA Labs operates between Dubai (DIFC, UAE) and Amsterdam (Netherlands). For EU data subjects, the data controller is the Amsterdam entity. KvK number and DIFC licence number are listed in the site footer.

What we collect

We collect three categories of data, deliberately limited:

• Anonymous analytics — page views, referrers, browser type, country (not IP). Collected via Plausible Analytics (EU-hosted, cookieless).
• Form submissions — when you fill in our contact form, lead magnet form, or newsletter signup, we receive the fields you submitted (name, email, company, message). These are stored in our email inbox (Google Workspace EU) and our newsletter provider (Kit / ConvertKit).
• Booking data — when you book a call, Cal.com captures your name, email, and the answers to four intake questions. This data is stored at Cal.com (EU regions where supported).

What we don't collect

• No cookies for analytics, advertising, or tracking. Plausible is cookieless.
• No third-party advertising pixels (no Meta, Google Ads, LinkedIn Insight Tag).
• No session recording or heatmaps (we considered Microsoft Clarity and decided against it).

Why we collect it

• Analytics — to understand which content is read and which pages convert. Legal basis: legitimate interest (running a business website).
• Forms — to respond to your inquiry, deliver the lead magnet, or send the newsletter you opted into. Legal basis: contract (responding to your request) or consent (newsletter).
• Booking — to schedule and prepare the call. Legal basis: contract.

Where it's stored

EU-hosted infrastructure where the provider supports it: Plausible (Germany), Vercel (Frankfurt for EU traffic), Supabase (EU region), Hetzner (Falkenstein). Some providers operate globally with EU contracts in place: Google Workspace (DPA), Resend (DPA), Kit/ConvertKit (DPA). None of these vendors use your data to train AI models.

Who we share it with

The providers above. Not sold, not shared with advertisers, not used for purposes other than what you submitted it for. If we ever change this, we'll update this page and email anyone affected before it takes effect.

How long we keep it

• Analytics — 24 months (Plausible default), then aggregated only.
• Form submissions — until the conversation is closed plus 12 months for tax/admin reasons, or until you ask us to delete.
• Newsletter — until you unsubscribe.

Your rights

Under the GDPR you have the right to access, correct, delete, and port your data. To exercise any of these, email hello@jarvalabs.io with the subject "GDPR request". We respond within 30 days, usually within 3 business days.

You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

AI and your data

This is the part most clients ask about. The summary:

• If you become a client, your project data (documents, code, conversations) is processed by the AI services we use (Anthropic Claude, sometimes OpenAI). Both companies have explicit contractual terms that say API data is not used to train their models.
• For sensitive workloads, we offer locally-hosted alternatives (Llama 3.x on our infrastructure) where possible.
• We sign DPAs with all clients before processing personal data.

Updates

If this policy changes materially, we'll update the "last updated" date and notify subscribers. Trivial typo fixes won't generate a notification.