1. Data we collect

Account: email address, name, country and language, from sign-in (WorkOS) or what you enter.

Use of the service: the questions you send to JohnCashew.ai on the website or the app, lessons opened, the excerpts served to you, and quota counters.

Saved chats (signed-in users): your Ask JCAI conversations, so you can continue them on the website, in the app and in ChatGPT. Visitors who are not signed in are never saved.

Learning: lessons completed, quiz results and certificates (the certificate shows the name you enter).

Photos: when you choose to ask with a photo (camera or photo library), the photo is sent to answer you. It is kept only when the knowledge base cannot answer yet, so JC's expert can look at it, and is deleted after 30 days (JC may set a shorter period).

Voice (app): when you record a question by voice, the recording is turned into text to answer you and is not stored.

App and notifications: if you allow notifications, the app's notification token, the phone type and the reminders you choose. Lessons you download for offline use stay on your phone. The app uses the camera, photo library and microphone only when you choose to.

In ChatGPT: only what ChatGPT sends to the JohnCashew.ai tools to answer your request (your question as rephrased by ChatGPT, the language, a lesson code, figures for an estimate). We do not receive, request or rebuild your ChatGPT conversation history, and we never receive ChatGPT's final answer.

Quotation requests: only the details you review and agree to share (name, company, country, contact details, capacity, budget, timeline, message), together with a record of your consent.

Payments: handled by Paddle. We receive the subscription status, invoice numbers and amounts — never your card details.

Technical: IP address and browser information in security logs; cookies needed for sign-in, security and your language choice (no advertising cookies).

2. Why we use it

To provide the service and your plan's access; to answer from the knowledge base and improve it (questions the knowledge base cannot answer are reviewed by JC's content team); to prevent abuse and protect content; to process payments; to contact you about a quotation only when you asked and agreed; to meet legal obligations.

Legal bases: performance of our contract with you, our legitimate interests (security, content protection, service improvement), your consent (quotation contact), and legal obligations.

3. Who receives it

JC's team (sales receives quotation requests you agreed to share). Service providers acting on our instructions: VVB Solutions (development and operation), Vultr (servers in Singapore), WorkOS (sign-in), Paddle (payments, as Merchant of Record), Resend (email), OpenAI (AI processing of questions, photos and voice questions on the website and app; data sent through the OpenAI API is not used to train its models by default), Expo, Apple and Google (delivery of app notifications).

When you use the plugin in ChatGPT, OpenAI processes your conversation under its own privacy policy. We do not sell personal data.

4. International transfers

Data is stored in Singapore and processed by providers that may operate in other countries, under contractual safeguards, and in line with Vietnam's Personal Data Protection Law and, for users in the EU, the GDPR.

5. How long we keep it

Account data while your account is active. Question logs used for quality review: up to 90 days, then anonymised. Retrieval records used for content protection: 90 days. Saved chats: archived after 30 days without a new question and deleted 365 days after the last activity (JC may set shorter periods); you can delete them yourself at any time. Photos: see section 1. Quotation requests and consents: until you withdraw consent or for up to 24 months after the last contact. Payment records: as required by tax law. Backups: up to 30 days.

6. Your rights

You can see your data and consents, withdraw consent and delete your account at any time on your JohnCashew.ai account page or in the app (deletion also ends access on all channels; see the Account deletion page). You may also request access, correction, restriction or a copy of your data, or object to processing, by writing to us; you may complain to your data protection authority.

7. Security

Encrypted connections, access by role, audit logs, encrypted storage and tested backups protect your data. If a breach affects you, we will inform you and the authorities as the law requires.

8. Children and changes

The service is intended for professionals and is not directed at children under 16. We do not use advertising, advertising identifiers or tracking across other companies' apps and websites. We will announce material changes to this policy on the website.