Privacy Policy

Julia AI Inc., a Delaware corporation ("Julia AI," "we," "us," or "our"), operates the Julia AI Platform, an all-in-one business management service for small businesses that includes customer relationship management (CRM), job and field-service management, scheduling, invoicing and payments facilitation, documents and e-signatures, email, SMS, and voice communications, time tracking, and an AI assistant named "Julia" (collectively, the "Services"), available at onjulia.com and app.kliktik.com (the "Sites").

This Privacy Policy explains what personal information we collect, how we use and disclose it, how long we keep it, and the privacy rights available to you under applicable United States law. Please read it together with our Terms of Service and, if you are a business customer, our Data Processing Addendum ("DPA").

If you have questions, contact us at info@onjulia.com or by mail at 19214 Calvert Street, Reseda, California 91335.

1. Scope of This Policy: Our Two Different Roles

This is the most important section of this Policy. The Julia AI Platform involves two distinct populations of data, and our legal role (and the rules that apply) differs fundamentally between them.

1.1 Customer Account Data: where we are the "business" (controller)

"Customer Account Data" is information about our business customers and their personnel: the people who sign up for, administer, pay for, and use the Services. It includes account registration information, login credentials, billing and payment records, usage and log data, support communications, and marketing preferences. For Customer Account Data, Julia AI determines the purposes and means of processing. We are the "controller" of this data (or, in the terminology of the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the "business"). This Privacy Policy governs Customer Account Data.

1.2 Customer Platform Data: where we are a "service provider" (processor)

"Customer Platform Data" (also called "End-User Data") is the data our customers upload to, or generate within, the Services about their own clients, leads, contacts, and business operations. It includes, for example: names, phone numbers, and email addresses of a customer's contacts; notes; email, SMS, and chat messages; call recordings and transcripts; documents and e-signature records; invoices and payment records; job and scheduling records; time-tracking entries; and, where a customer enables location-based workforce features, location data of the customer's own employees and field personnel. For Customer Platform Data, our customer (not Julia AI) decides what data to collect and how it is used. Julia AI processes Customer Platform Data only on the customer's instructions, as a "processor" or "service provider" under applicable law. This Privacy Policy does not govern Customer Platform Data. That data is governed by our written agreement with the customer, including the DPA, and the customer's own privacy policy and practices.

1.3 If your data was uploaded by one of our customers

If you are a client, lead, or contact of a business that uses Julia AI Platform, and you want to access, correct, delete, or otherwise exercise rights over information that business holds about you, please direct your request to that business. It is the controller of your information and is responsible for responding. If we receive a rights request that concerns Customer Platform Data, we will refer the request to the relevant customer and, acting as its service provider, will assist that customer in responding as required by our agreement and applicable law. We do not independently respond to such requests, because we generally have no direct relationship with, and often cannot verify the identity of, individuals whose data was uploaded by a customer. The remainder of this Policy addresses Customer Account Data unless expressly stated otherwise.

2. Personal Information We Collect

We collect personal information from four sources:

— Directly from you: when you register, configure your account, purchase a subscription, contact support, or communicate with us. — Automatically: through cookies, server logs, and device data when you use the Sites and Services (see Section 7). — From your organization's administrator: when an administrator at your company creates or manages your user account, assigns roles, or configures your profile. — From service providers: such as payment processors (e.g., confirmation of payment status), analytics providers, and fraud-prevention services.

We collect only the personal information that is reasonably necessary and proportionate to provide and maintain the Services you or your organization request and for the purposes disclosed in this Policy, consistent with data-minimization requirements under applicable state law (including the Maryland Online Data Privacy Act).

The table below describes the categories of personal information we collect, using the category names defined in the CCPA, along with the sources and purposes for each category.

We do not collect Social Security numbers, driver's license numbers, precise geolocation, biometric identifiers, health information, or other categories of "sensitive personal information" (as defined by applicable state law) as part of Customer Account Data, except that account log-in credentials (username plus password) may qualify as sensitive personal information in some states. We use log-in credentials solely to authenticate your account, a purpose permitted without a separate right to limit under applicable law (see Section 8).

3. How We Use Personal Information

We use Customer Account Data for the following purposes:

— Providing and operating the Services: creating and maintaining accounts, delivering platform functionality, syncing data across devices, and enabling the communications features (email, SMS, voice) you direct the platform to perform. — Account management and authentication: verifying identity at login, managing user roles and permissions set by your organization's administrator, and securing sessions. — Billing: processing subscription payments, generating invoices and receipts, managing renewals, and maintaining tax and accounting records. — Customer support: responding to questions and requests, diagnosing problems, and maintaining records of support interactions (including recorded support calls). — Operating AI features: the Julia assistant processes account data and, on the instructions of your organization, Customer Platform Data, in order to generate responses to your questions and to perform actions you direct (for example, drafting a message, creating a task, or summarizing records). Section 4 describes our AI practices in detail. — Service improvement and analytics: understanding how the Services are used, measuring performance, identifying and fixing bugs, and developing new features. Where practicable, we use aggregated or de-identified data for these purposes, and we commit to maintaining de-identified data in de-identified form and not attempting to re-identify it. — Security and fraud prevention: detecting, investigating, and preventing unauthorized access, abuse, fraud, and other malicious activity; enforcing our Terms of Service. — Legal compliance: complying with applicable law, legal process, and lawful government requests; establishing, exercising, or defending legal claims. — Marketing our own services: sending you information about Julia AI Platform features, updates, and offers. You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by contacting us at info@onjulia.com. We will still send you non-promotional service and transactional messages (e.g., billing notices, security alerts).

We do not use Customer Account Data for purposes that are incompatible with the purposes described above without providing you notice.

4. AI Features and the Julia Assistant

The Services include artificial-intelligence features, most prominently the Julia assistant, which is available in chat and voice modes. We want to be clear about how data is handled when you use these features:

— How Julia works. When you interact with Julia, your prompts, relevant account data, and, subject to your organization's configuration and instructions, relevant Customer Platform Data are processed to generate responses and to perform the actions you direct. — Third-party AI service providers. Interactions with Julia are processed by us and by third-party AI service providers acting on our behalf under written contracts. These providers act as our service providers/processors and may process your interactions only to provide the AI functionality to us. — No training for the benefit of third parties. We do not use our customers' Customer Platform Data to train AI models for the benefit of third parties. Our third-party AI service providers are contractually prohibited from using Customer Platform Data or your Julia interactions to train their own models. — Voice interactions. AI voice interactions may be recorded and transcribed as necessary to deliver the feature: for example, to convert your speech into a request Julia can act on, and to maintain a record of the interaction within your account. — Logging. We log Julia interactions (prompts, responses, and the actions taken) to operate the feature, provide support, ensure quality and safety, and improve the Services.

5. How We Disclose Personal Information

We disclose Customer Account Data to the following categories of recipients, in each case only as needed for the purposes described in this Policy:

— Service providers working on our behalf under written contracts that restrict their use of your information to providing services to us, including: cloud infrastructure and hosting providers; telecommunications carriers; third-party AI service providers; payment processors; analytics providers; customer-support tooling providers; and email delivery providers. — Professional advisors: lawyers, accountants, auditors, and insurers, where necessary in the course of the professional services they provide to us. — Corporate-transaction parties: in connection with, or during negotiations of, a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our business or assets, in which case personal information may be transferred as a business asset subject to this Policy or successor commitments. — Law enforcement and legal process: where we believe disclosure is required by law, subpoena, court order, or other legal process, or is reasonably necessary to protect the rights, property, or safety of Julia AI, our customers, or others. — With your consent or at your direction: for example, when you instruct the platform to send a message or share a document with a third party. — Your organization: if your account was created under a business customer's account, that customer's administrators can access and manage information associated with your user account.

5.1 No sale; no sharing for cross-context behavioral advertising

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising (as "sell" and "share" are defined under the CCPA), and we have not done so in the preceding 12 months. We likewise do not process personal information for "targeted advertising" as defined under Virginia, Colorado, Texas, Maryland, and other state privacy laws.

5.2 Minors and children

We do not sell or share the personal information of any consumer, including consumers we know to be under 16 years of age (or under 18, where applicable state law extends protections to older minors), and we do not process minors' personal information for targeted advertising. The Services are business tools intended for use by adults; they are not directed to individuals under 18, and we do not knowingly permit anyone under 18 to register. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact info@onjulia.com and we will delete it.

6. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, and we determine retention periods using criteria including: the duration of your account and our relationship with your organization; our legal, tax, and accounting obligations; the need to resolve disputes and enforce agreements; and security and fraud-prevention needs. In general:

— Account and profile data: retained for the life of the account, plus a limited period after closure to handle wind-down matters, resolve disputes, and comply with legal obligations, after which it is deleted or de-identified. — Billing and transaction records: retained for the period required by applicable tax, accounting, and financial-reporting law. — Support records: retained for the life of the account plus a limited period, so we can reference prior issues. — Server logs, device data, and analytics data: retained for shorter operational periods appropriate to security monitoring, troubleshooting, and analytics, then deleted or aggregated. — Customer Platform Data: retained in accordance with our agreement with the customer. Following termination of a customer's subscription, the customer has a 60-day window to export its Customer Platform Data, after which we delete or de-identify it within the period specified in the DPA (subject to limited residual copies in backups, which are deleted or overwritten on our standard backup rotation schedule, and any retention required by law).

When retention is no longer necessary, we delete, de-identify, or aggregate the information.

7. Cookies and Tracking Technologies

This section serves as our cookie policy. We and our service providers use cookies and similar technologies (such as local storage and pixels in our own emails) on the Sites and Services. We use the following categories:

— Essential cookies: strictly necessary for the Sites and Services to function: authentication and session management, security (e.g., fraud detection, CSRF protection), and load balancing. These cannot be disabled through our Services, though you can block them in your browser (which may break core functionality such as login). — Functional cookies: remember your choices and settings, such as language, display preferences, and interface state, to provide a more tailored experience. — Analytics cookies: help us understand how visitors and users interact with the Sites and Services (pages visited, features used, errors encountered) so we can improve them. Analytics data is used by us and our analytics service providers acting on our behalf; we do not use analytics cookies for cross-context behavioral advertising.

Your controls:

— Browser settings. Most browsers let you refuse or delete cookies through their settings. Blocking essential cookies may prevent the Services from working. — Global Privacy Control (GPC). We honor Global Privacy Control signals sent by your browser as a valid request to opt out of the sale or sharing of personal information (and of processing for targeted advertising, where applicable law so requires) for the browser or device sending the signal. Because we do not sell or share personal information (see Section 5.1), honoring a GPC signal will not change our current practices, but we treat the signal as a legally effective opt-out in any event. — Do Not Track. Some browsers transmit "Do Not Track" (DNT) signals. Because there is no industry-standard interpretation of DNT signals, we do not respond to them at this time. We do respond to GPC signals as described above.

8. Your Privacy Rights Under U.S. State Laws

Depending on your state of residence (including, for example, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws), you may have some or all of the following rights with respect to Customer Account Data:

— Right to know / access: to confirm whether we process your personal information and to access it, including (for California residents) the categories of personal information collected, the sources, the purposes, and the categories of recipients. — Right to portability: to obtain a copy of the personal information you provided to us in a portable and, to the extent technically feasible, readily usable format. — Right to delete: to request deletion of your personal information, subject to exceptions permitted by law (e.g., completing a transaction, security, legal compliance, internal uses compatible with your expectations). — Right to correct: to request correction of inaccurate personal information. — Right to opt out of sale, sharing, and targeted advertising: as described in Section 5.1, we do not engage in any of these activities today, so there is nothing to opt out of; if that changes, we will update this Policy and provide the required opt-out mechanisms (including recognition of universal opt-out signals such as GPC, which we honor in any event as described in Section 7) first. — Right to limit use of sensitive personal information: California residents may direct a business to limit its use of sensitive personal information to purposes permitted by regulation. We do not use sensitive personal information beyond those permitted purposes (our only arguable sensitive data point, account log-in credentials, is used solely for authentication and security), so this right does not currently require an action mechanism. — Right to non-discrimination: we will not discriminate or retaliate against you for exercising any privacy right, such as by denying Services, charging different prices, or providing a different level of quality. — Right against certain profiling / automated decisions: some state laws provide a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in such profiling with Customer Account Data, and we do not use automated decisionmaking technology to make a "significant decision" about you within the meaning of the CCPA regulations.

8.1 How to exercise your rights

You may exercise your rights by either of two methods: (1) Email: send your request to info@onjulia.com with the subject line "Privacy Rights Request," identifying the right(s) you wish to exercise and your state of residence; or (2) In-account settings: if you have a Julia AI Platform account, use the privacy controls in your account settings at app.kliktik.com. Reminder: if your request concerns data a Julia AI Platform business customer holds about you (Customer Platform Data), please contact that business directly; see Section 1.3.

8.2 Verification

Before acting on a request to know, access, delete, or correct, we must verify your identity to a reasonable degree of certainty. We will match information you provide against information we already hold (for example, verifying control of the email address associated with your account); for requests made through an authenticated account session, the login itself generally suffices. If we cannot verify your identity, we will tell you and explain why we cannot fulfill the request. We will use information submitted for verification only for that purpose.

8.3 Authorized agents

Where permitted by law, you may designate an authorized agent to submit requests on your behalf. We may require the agent to provide proof of your written authorization (or a valid power of attorney) and may require you to verify your own identity directly with us or confirm that you granted the authorization.

8.4 Timing

We will respond to verifiable requests within 45 days of receipt. If reasonably necessary given the complexity or volume of requests, we may extend the response period by an additional 45 days, in which case we will notify you of the extension and the reason within the initial 45-day period. We do not charge a fee to process requests unless they are excessive, repetitive, or manifestly unfounded, in which case we may charge a reasonable fee or decline the request, with an explanation.

8.5 Appeals

If we decline to take action on your request, we will explain our reasons and, where required by your state's law (including Virginia, Colorado, Connecticut, Texas, Maryland, Minnesota, and other states with similar laws), you may appeal our decision: (1) Submit an appeal by replying to the email communicating our decision (or by emailing info@onjulia.com with the subject "Privacy Appeal") within a reasonable period after receiving our decision. (2) Your appeal will be reviewed by personnel not solely responsible for the original decision. We will respond in writing within the period required by your state's law (generally 45 to 60 days), explaining the outcome and the reasons for it. (3) If your appeal is denied, you may contact your state Attorney General to submit a complaint.

8.6 California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request certain information about disclosure of personal information to third parties for those parties' direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.

9. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction, appropriate to the nature of the data. These safeguards include encryption of data in transit and at rest, role-based access controls and least-privilege access practices, authentication requirements, logging and monitoring, and personnel confidentiality obligations.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a breach of security affecting personal information occurs, we will notify affected parties and regulators as required by applicable law and, for Customer Platform Data, will notify the affected customer without undue delay in accordance with our agreement and the DPA so the customer can meet its own notification obligations.

You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly at info@onjulia.com if you suspect unauthorized access to your account.

10. Where We Process Data

We are a U.S. company serving the U.S. market, and we process and store personal information in the United States. Some of our service providers may process data in other jurisdictions; where they do, we require contractual protections consistent with this Policy and applicable law. By using the Services, you understand that your information will be processed in the United States, where privacy laws may differ from those of your state or country of residence.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. If we make material changes, we will provide more prominent notice before the changes take effect: for example, by emailing account administrators, posting an in-product notice, or displaying a banner on the Sites. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of the changes to the extent permitted by law. We encourage you to review this Policy periodically.

12. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, contact us:

Julia AI Inc. Attn: Privacy, 19214 Calvert Street, Reseda, California 91335. Email: info@onjulia.com

If you are a person with a disability and need this Policy in an alternative format, contact us at info@onjulia.com and we will provide it in a form accessible to you.