Privacy Notice

1. Who is responsible for your information

Jatzo is a trading name of Jatzo Ltd, a company registered in England and Wales with company number 17467782, whose registered office is Portland House, Belmont Business Park, Belmont, Durham, DH1 1TW. Jatzo Ltd is the controller responsible for the personal information described in this notice.

Write to that address, email contact@jatzo.co.uk, or use the contact page, to ask about anything in this notice.

Jatzo Ltd is registered with the Information Commissioner’s Office as a data protection fee payer, under reference ZC254981. You can look that reference up on the ICO’s public register.

2. Information we process

When you create an account, Jatzo processes your name, email address, password credential in hashed form, plan and usage information. It also records which version of the terms and of this notice you were shown, when, and the age you confirmed: 13 or over if you signed up for yourself, and 18 or over if you bought a plan. That record is kept for as long as the account exists. Accounts for yourself are for people aged 13 and over, and buying a plan is for people aged 18 and over. When you analyse an email, the service processes the uploaded .eml file or pasted source so it can produce the requested security analysis.

The current application does not write raw submitted .eml files, email bodies or attachment contents into persistent case history. It processes them to produce the assessment, then releases them from application processing. History retains the email subject (up to 180 characters) as the case title, check date, risk score, verdict, counts, compact finding labels and limited intelligence summaries. Your subject may contain personal or confidential information: case metadata is not anonymous. Full checked URL lists and source IPs are not stored in the case-history record.

If you or your team use an inbox add-in, Jatzo also keeps a correspondent history: a record that a sender has written to your account before, so that a payment request from a stranger can be told apart from one from a supplier you deal with every week. For each sender it holds a keyed one-way fingerprint of the address (HMAC-SHA256), when that sender was first and last seen, and how many of their messages were checked. It also holds whether a check found their mail to be high risk. Only a check adds to it: the add-in does not read a message's headers because the message was opened. No address or domain is stored in any form that can be read back, so it cannot be turned into a list of who you do business with. In a business workspace it is kept on the workspace, so the business shares one history across its staff and it stays with the workspace if the workspace is handed to a new admin; otherwise it is kept on your own account. It is written only from a message an add-in read out of a real mailbox, never from a file uploaded on the website.

If you use the Contact Us form, Jatzo processes the name, email address, company name if supplied, enquiry category and message you provide so the enquiry can be managed and answered. If you ask for a website preview through the web design page, Jatzo processes the name, business name, email address, telephone number if supplied, current website address if supplied and message you provide, so the request can be answered and quoted for. Please avoid including passwords, recovery codes or sensitive third-party content in feedback.

Spoof Check is Jatzo's free check of whether a business's email settings stop other people sending email that looks as if it came from that business. It needs no account. When you check a domain, Jatzo looks up the records that domain already publishes: which service handles its email, and its SPF, DKIM and DMARC settings. The check is not saved against you. Its result is remembered in memory for ten minutes against the domain, so a second check of the same domain is answered at once, and it holds that domain's public records and nothing about who asked.

Spreadsheet cleaner is a demonstration on the white label developer page. It needs no account. When you press Clean it, the CSV you loaded, pasted or picked is sent to Jatzo, and it may hold the names, email addresses, phone numbers, addresses and dates of the people in it. Jatzo cleans it, sends the result back and keeps nothing in it. Nothing in the file is saved, logged or counted. The only thing kept is how many times your connection has used it in the last hour, so it cannot be used without limit. Use the example, or made-up data, rather than a real customer list.

On the white label developer page, Jatzo counts each day how many times the page was opened, which of its demo tabs were opened, and how often an email link on it was pressed, with which tabs had been opened first. The counts hold nothing you typed into a demo, and no address or connection.

If you ask for the Spoof Check fix report, Jatzo keeps a record of the request: the domain, the email address you gave, your name if you gave one, what the check found, whether you opened Spoof Check from a link to somebody's result, any campaign tags in the web address you arrived at, whether the report was sent and when, and whether you asked for the monthly email, with when you asked and which version of that box's wording you saw. The report's private link is kept only as a one-way fingerprint, and your name is not put in any email. If you ticked the box for the monthly email, Jatzo also keeps your address, that consent and when you confirmed it, apart from the request, so the monthly email can carry on after the request is deleted. Jatzo also counts, each day, how many checks were run, reports asked for and sent, and monthly emails confirmed and stopped, and how often a few things were done on the page, such as copying a link, by the verdict and the email provider found. The counts hold no domain, address or connection.

Website Health Check is Jatzo's free check of how a business's website looks from outside. It needs no account. When you check a website, Jatzo's server fetches public pages of that site as any visitor's browser would: its home page and, where the check needs them, its robots.txt file, a contact page the home page links to, up to 20 other pages on the same site that the home page links to, and its icon. It also looks up the domain's published address and email records, and, for .com, .net, .org and .uk addresses, asks the domain's registry when it is due for renewal. The check is not saved against you. Its result is remembered in memory for ten minutes against the domain, so the report can be downloaded as a PDF, and it holds what was found on that website and nothing about who asked. Jatzo counts how many websites are checked each day; the count holds no domain, address or connection.

3. Why we use the information

We use account information to provide and secure your account, enforce plan limits, maintain case history and operate the service. We process submitted email data to perform the analysis you request, investigate abuse and protect the security of Jatzo.

Spoof Check information is used to answer the check, send the fix report you ask for and keep its link working, send the monthly email if you asked for it and confirmed it, stop the tool being used to send email to people who did not ask for it, and see how the tool is used. The address you give for a report is used only for that report and, if you asked for it, the monthly email.

4. Legal basis

Jatzo relies on these lawful bases under UK data protection law.

• Providing the service you asked for (contract): creating and running your account, analysing the emails you submit, keeping your case history, applying your plan and its allowances, training you take, and answering a message you send through Contact.
• Security and abuse prevention (legitimate interests): security audit events, rate limits and sign-in protection, add-in diagnostics, and Jatzo support's records of support actions and notes. The interest is keeping the service and the accounts on it safe; these records hold nothing from the emails you check and are kept only for the periods in section 6.
• Support lookups (legitimate interests): when you contact support, Jatzo support's tool looking up which account your address or your company's proved domain belongs to, and keeping a record of each lookup. The interest is answering your request correctly, for the plan and team you are actually on, answering about a team only to somebody who belongs to it, and noticing if the tool is misused. It changes nothing, sees only the account details listed under Support lookups in section 6, and keeps each lookup as a keyed fingerprint for 12 months.
• Correspondent history and remembered link reputation answers (legitimate interests): telling a sender who has never written to you apart from one you know, and not paying twice to look up the same link. The interest is detecting fraud aimed at the people Jatzo checks mail for; the history holds fingerprints that cannot be read back as addresses, and a remembered answer holds no link.
• People named in the emails you check (legitimate interests): senders, recipients and anybody in a subject line. The interest is producing the security analysis you asked for; Jatzo keeps only the subject line, the findings and keyed fingerprints of the domains and subject pattern, for up to 90 days, and never the message. Where an inbox add-in reports that the message was in a shared mailbox, the address of that mailbox is kept with the check as well, so the record says which inbox it came from and not only who ran it. Fingerprints can be kept up to 90 days after a check is deleted, as section 6 explains.
• Spoof Check (legitimate interests): checking the domain you type, sending the fix report you ask for and keeping its link working, limiting how often reports can be sent, counting how the tool is used, and knowing which pages and campaigns bring people to it. The interest is helping a business find out whether others can send email in its name and how to stop it, keeping the tool from being used to send email to people who did not ask for it, and knowing where it is found. The request record holds only what you gave for the report, where you came from and the domain's public settings, and is deleted after 90 days.
• Spreadsheet cleaner (legitimate interests): cleaning the file you send and sending it back, and limiting how often it can be used. The interest is showing the kind of data work on offer to the agencies the page is for, and keeping the tool from being overloaded. Nothing in the file is kept.
• Website Health Check (legitimate interests): checking the website you type, limiting how often checks can be run, and counting how the tool is used. The interest is helping a business see how its website looks from outside and what is worth fixing, and keeping the tool from being used to make Jatzo's server fetch other people's websites at volume. Nothing about who asked is kept with a result, which is deleted from memory after ten minutes.
• Sales contacts (legitimate interests): following up a conversation you chose to have with Jatzo, at an event or in a reply, as section 12 sets out.
• The monthly Spoof Check email (consent): sent only if you ticked its box and then confirmed from the report email. You can withdraw your consent at any time with the unsubscribe link in every one, which deletes your subscription.
• Legal obligations: keeping or disclosing a record where the law requires it, and answering a request you make about your information. This is the basis for keeping invoices and credit notes after an account is deleted, described in section 6.

Where an organisation gives its staff Jatzo through a business workspace, the organisation decides that its people use it and Jatzo handles the workspace's information on its behalf. The organisation's own privacy notice explains the lawful basis it relies on.

Special category and criminal offence information

We do not ask for information about health, ethnicity, religion, sexuality, political opinions, trade union membership, biometrics, genetics, or criminal offences. It can still turn up in the subject line of an email somebody checks. Where we are the controller of it, we rely on the condition in the Data Protection Act 2018 for processing that is necessary to prevent or detect unlawful acts, and we keep an appropriate policy document explaining how we handle it.

5. Threat intelligence and service providers

On plans that include live threat intelligence, selected URLs extracted from a submitted email may be sent to Google Web Risk for reputation checking. URLs can themselves contain personal information or tokens. You can switch that check off: a team's admin does it for everybody on the Team administration settings tab, and an account with no team does it on its account page. It is on unless you change it, and with it off no link from your checks is sent to Google, no answer about one is read back from the remembered answers described below, and none is written there. The rest of each check runs, and every affected result says that live link reputation did not run. DNS and source-IP lookups can also disclose queried domains or IP addresses to the configured lookup services. On the same plans, the registration date of up to three linked domains is looked up from that domain's registry through its public RDAP service, which receives the domain name only. On Business Pro, Domain watch looks up the published email records (SPF, DKIM and DMARC) of the domains a team lists, through the configured lookup services, and reads new entries from public Certificate Transparency logs, which receive nothing about any team. When a newly certified domain resembles a listed one, its registration date is asked of its registry through RDAP in the same way, and nothing is fetched from that domain. Spoof Check looks up the domain a visitor types through the same configured lookup services, which receive that domain and the names of the records Jatzo asks for, and never anybody's email address. The Website Health Check looks up the website a visitor types through the same lookup services, fetches that website's own public pages from Jatzo's server, which the website's owner can see in their own logs like any visit, and asks the domain's registry for its renewal date through its public RDAP service, which receives the domain name only. A live reputation answer is remembered for up to six hours, or until the provider's own expiry for a known threat, against a keyed fingerprint of the link rather than the link itself, so a link checked again soon, by anybody, is answered without a second lookup. Optional RIPEstat lookups send the selected public IP, and derived network prefix and origin ASN, to RIPE NCC for registry, routing and published abuse-contact information. They do not send the email body or attachments. QR decoding of supported image attachments, of the first pages of PDF attachments and of the pictures inside Office documents, runs locally in isolation; recovered web URLs can be included in the selected reputation queries. Jatzo does not need to send the complete email to Google Web Risk for this feature. Jatzo's service, its database and the backups kept on the server are hosted with a European hosting provider in Germany. A copy of those backups is kept off the server, in that provider's storage in Finland, encrypted on Jatzo's server before it leaves with a key the provider does not hold. The provider is named, with every other recipient, in the document pack sent to customers on request. Nothing is hosted outside the European Economic Area. Transfers from the United Kingdom to Germany and Finland rely on the United Kingdom's adequacy regulations for the EEA, so no standard contractual clauses or international data transfer agreement are needed for hosting. The categories of recipient of personal information are: that hosting provider; Stripe, which takes every payment and receives what you enter at its checkout; Google Web Risk, for link reputation on plans that include it; RIPE NCC, for registry, routing and abuse contact information about a public IP address; and domain registries through RDAP, which receive a domain name only. Google processes outside the United Kingdom and the EEA for part of its service, and that transfer is covered by the standard contractual clauses in their United Kingdom form. Stripe processes in several countries including the United States, under its own data processing agreement. The full list of recipients, with the basis for each transfer, is given to customers on request.

Separately from the service, Jatzo keeps the people it is talking to about buying Jatzo in HubSpot, a customer relationship tool. Jatzo's contract is with HubSpot UK Holdings Limited. Nothing from the service, and nothing from any email you check, is put into it. It is hosted in HubSpot's data centre in Frankfurt, Germany. HubSpot, Inc. and its sub-processors may process it in the United States, under HubSpot's certification to the UK Extension of the EU-US Data Privacy Framework and, behind that, the standard contractual clauses with the United Kingdom's addendum. Section 12 says what it holds.

6. Retention and deletion

Raw submitted email content is processed for analysis and is not saved to case history. Your browser holds the source and current results while the page is in use; downloaded reports are copies under your control. Temporary upload handling and operating-system memory are not a secure-erasure facility.

• Spreadsheet cleaner: a file sent to the spreadsheet cleaner is used only while it is cleaned and is discarded once the answer is sent. Nothing in it is saved to Jatzo's records or logs.
• Invoices and credit notes: kept for at least 6 years from the end of the financial year they fall in, which is the period United Kingdom tax law requires business records to be kept for. This is a legal obligation rather than something you can ask us to stop, and it outlasts your account: see Deleting your account below for what is erased from a document when an account goes. A document holds the number, the dates, what was charged and what tax was in it, and nothing from any email you checked. Jatzo keeps a document until it is removed deliberately: automatic removal once that period has passed is not built, and it is listed under Still to complete, below.
• Paying for Jatzo: payments are taken by Stripe, which is the only party that handles a card. Jatzo never receives, holds or sees a card number. Stripe is given the amount, the currency, your email address, the invoice number as the payment's reference, and a description that is the invoice number, and Stripe collects your billing address from you on its own page. What Jatzo keeps of a payment is the invoice itself, the country you said you were buying from, Stripe's own reference for the subscription, and the date the payment went through. Those are kept with the invoice, under the first item above, because they are what makes a document answerable years later. Stripe keeps its own records under its own terms, and the data processing agreement Jatzo gives business customers names it and sets out what it receives.
• Support actions on your account: when Jatzo support changes your plan, resets your allowance, signs you out, disables the account or grants training, the action, the reason given and the time are kept for 12 months. Nothing from the emails you check is part of it, and the record stops naming you if you delete your account.
• Changes of team seats Jatzo asks an admin to agree: the number of seats before and after, whether the admin agreed and when, and who at Jatzo asked, for 12 months. The link in the email is kept only as a one-way fingerprint.
• Notes about your account: Jatzo support may note a call with you or something promised to you. Only Jatzo support sees them. They are kept for 12 months, deleted with your account, and given to you if you ask through Contact.
• Support lookups: when you contact Jatzo support, Jatzo support's tool, which runs on Jatzo's own computer, may look up which account an email address or a proved domain belongs to, to see the account's name and address, when it was made and whether it is active, its plan, its team, the person's role and the team's seats, and any IT company looking after it. For an IT company that looks after Jatzo customers, it may also see the name and address of the person who signed for it, its clients with their plans and seats, and what its month's invoice would be. It changes nothing. Each lookup is kept for 12 months as a keyed fingerprint of what was asked, never the address or domain itself, and lookups of your current address are deleted with your account.
• Add-in diagnostics: which Outlook or Gmail app and version a connection uses, how far the add-in got when it started, and whether its recent requests to Jatzo worked. At most ten entries for each connection, kept for 30 days and deleted with your account. Nothing about any email.
• Team invitations: the address a team invited, when and by whom, each new link made for it and whether it was used, cancelled or left to expire. Jatzo does not send the invitation itself; the team passes the link on. When the invited person opens it, Jatzo emails their address a link to choose a password, which works once and for an hour. Kept while the invitation is waiting and for 90 days after it ends, and removed with the invited address's account.
• Failure references: when a check, a report or a page fails for a reason that is not yours, you are shown a reference to quote if you contact us, and Jatzo keeps it with what failed, where in Jatzo it failed and a short technical note, never anything from an email. Kept for 90 days. If your account is deleted sooner, the reference stays until then without your account attached.
• Cases you send to Jatzo support: only when you press Send to support on a case. Support sees its case reference, the date, the score and grade, your plan, where the check was made and the rules that fired with their points. Never the subject, the message, addresses, links or attachments. It is kept for 30 days unless you withdraw it sooner, and deleting the case or your account withdraws it. Separately, Jatzo counts how often each rule fires across the service each day, with no account or case attached, for 35 days.
• Deletion receipts: when you delete your account you are given a receipt reference. The receipt holds counts of what was removed and what stays, and dates, with nothing that names you, and is kept for 12 months.
• Team activity: if you belong to a business workspace, Jatzo records a log of invitations, people joining, leaving and being removed, role changes, handing the workspace over, add-in sign-outs and mailboxes allowed again, security settings, deployment files, the staff domains an inbox rollout will enrol, and the IT email, reports sent to IT, who is reviewing a reported case and how it was resolved, exports of cases and people, changes of team seats, watched domains added, changed and removed and a watched domain's protection getting weaker, senders put forward for the team's allow and block list and what was decided about them, the groups a team divides itself into and who is in each of them, training assigned to somebody and withdrawn from them, password reset links a manager asked us to email somebody, cases sent to Jatzo support and taken back, cases the admin deleted, and, where an IT partner looks after the workspace, the days each of their people opened it, with the name and email of the person involved, for 12 months. It is recorded for every business workspace whatever its plan. Reading it is a Business Pro feature: on Business Pro and above the workspace's admin and moderators see it on their own Activity tab, and an IT support company looking after the workspace sees the account changes in it from the day it engaged them, whatever the workspace's plan. A deleted case is listed by its case reference, never its subject, and what was written in its notes and resolution is deleted with it. If you delete your account the log stops naming you.
• Domain watch: on Business Pro, the domains a team's admin lists, with any DKIM selectors they add, the latest check of each domain's published email records and what last got weaker, are kept until the admin stops watching the domain or the team is deleted. Domains found in certificate logs that resemble a listed one are kept for 12 months from when they were found, and deleted sooner when the listed domain is no longer watched. They are domain names and dates only.
• Spoof Check report requests: 90 days from the request, and then deleted, when the report's private link stops working. Deleted sooner when an account with the same email address is deleted, and included in that account's Download my data once its address is confirmed. Sending a report also leaves the record described under Emails Jatzo sends.
• The monthly Spoof Check email: your address, your consent with when you gave it and which version of the wording you saw, and when you confirmed it. Kept until you unsubscribe, which deletes it straight away, or until an account with the same address is deleted. One never confirmed is deleted 90 days after the box was last ticked. Unsubscribing leaves a keyed deletion marker with no readable address for up to 35 days, so a backup restored in that time cannot sign you up again.
• Spoof Check counts: 25 months. Each is a day, what happened, a verdict and an email provider, with nothing about any domain, address or connection.
• The team's allow and block list: on Business and above, the addresses and domains somebody in a team put forward for its list, any note they added, who put each one forward, who agreed to it and when, and whether it is waiting or in use. It has no time limit, because it records a decision the team made and meant to keep, and it is deleted when the entry is taken off or the team is deleted. It is not deleted with the account of the person who put it forward, for the same reason: it is the team's decision rather than theirs. The whole list is in the admin's Download my data, and what you yourself put forward or agreed to is in yours.
• Removed inbox mailboxes: when a team admin removes somebody whose mailbox an inbox rollout set up, that mailbox's email address is kept on the team's block list, so the add-in cannot set itself up for it again. Kept for twelve months from the removal, or from the last time Jatzo was asked to set that address up for the team if that is later, and deleted sooner if the admin allows the mailbox again or the team is deleted. Once a mailbox is closed it is normally no longer asked for, and its address then goes within the year. It is not deleted with the person's own account, because it records the team's decision.
• Emails Jatzo sends: a record of each one, the address it went to, what kind of email it was, when, and whether Microsoft accepted it for delivery. Never its subject, its words or an attachment. Kept 90 days, so we can answer whether an email reached you, deleted sooner with the account it was sent to, and included in Download my data.
• Notifications: the notices beside your account menu when your plan is about to end, when Jatzo support answers a message you sent, when your allowance is nearly used, when signing in to your account was refused after too many wrong passwords from several locations and, for a team's admin and moderators, when its people, seats or Outlook deployment change. Each holds the kind of notice, numbers, dates and whether you have read it. Never anything from the emails you check, and never who joined or left. Kept for 90 days from when it was last raised, and deleted with your account.
• Live link lookup counts: how many paid link reputation lookups an account used in each month and on each day, kept for about three months so a question about a recent month can be answered, and deleted with the account.
• Inbox add-in connections: the name you gave a connection, when it was made and last used, and a one-way fingerprint of its code. A connection nobody uses for 90 days ends by itself, and every use renews it; otherwise it lasts until you revoke it, a team admin signs it out, or the account is deleted.
• Saved cases, related fingerprints and case feedback: up to 90 days, or less when your plan's history limit is reached. When a plan with an end date ends, the cases saved under it are kept 7 more days and then deleted. Their fingerprints go with them. Limits are Free 3, Personal 60, Business 500, Business Pro 1000, Enterprise 1000 cases. You can delete an individual case, or clear the checks you made, sooner. Deleting history does not refund check allowance.
• Fingerprints of deleted checks: when you delete a case or clear your history you choose whether to keep the checks' fingerprints or delete them too. Fingerprints you keep, and the fingerprints of checks removed because your history reached its limit, are kept for 90 days from that deletion, with any outcome confirmed on those checks, and then deleted. They are no longer linked to a check or to the person who made it; in a business workspace they stay with the workspace. Deleting your account or a workspace deletes them straight away.
• Check usage: 62 days, to enforce current monthly allowances.
• Security audit events: 30 days. Abuse-rate counters expire after two days; shared counters are not retained as your account profile.
• Contact messages: 90 days from submission, or sooner when the associated account email is deleted. If you were signed in when you wrote, the message also records the plan you were on. Messages sent using another email address require a separate request. A copy of each message is also emailed to Jatzo's enquiries mailbox in Microsoft 365 so it can be answered, or, for a website preview request, to the mailbox that handles that work, and is kept there under that mailbox's own retention rather than this one. Each message is given a reference for you to quote if you write again, and a reply support sends you from its console is kept with your message and removed with it.
• Account details, avatar, course access, progress and completion records: until you delete the account or the service closes. Assessment-attempt records expire after 90 days; completion records remain available while the account exists.
• Invitation and recovery tokens, and changes of email address: until used or their configured expiry. A change of email address waits at most one hour for the link sent to the new address, and only a one-way fingerprint of that link is kept. Expired processing reservations are removed. Unused pending course orders expire after seven days; opaque payment replay records expire after 90 days.
• Temporary intelligence caches: URL exports have a 30-minute access expiry. Optional registry observations are kept for up to 30 minutes against a keyed fingerprint of the IP address, never the address itself, with shorter caching for failures. DNS answers for a domain are remembered for five minutes. A Spoof Check result is remembered for ten minutes against the domain checked, and holds only that domain's public records. A Website Health Check result is remembered for ten minutes against the domain checked, and holds only what was found on that website and in its public records. The registration date of a linked domain, looked up from its registry through RDAP, is remembered for up to 24 hours. These caches, and a working copy of each remembered link reputation answer below, are in application memory. Each entry is deleted from memory as soon as it expires; deletion does not overwrite the memory it used.
• Remembered link reputation answers: stored in the Jatzo database, not only in memory, so they survive a restart and are included in the managed backups. Each answer is kept against a keyed fingerprint of the link (HMAC-SHA256), never the link itself, and holds only whether the provider listed the link and until when. Answers are shared across customers, so a link anybody checked recently is answered without a second lookup. Each is kept for up to six hours, or less when the provider's own expiry is sooner, and maintenance deletes expired answers.
• Correspondent history: a sender not seen for 13 months is deleted. The whole history is deleted with the account it belongs to, and a business workspace's history is deleted with the workspace.

Automatic maintenance runs on the first request after startup and then on a request at least an hour after the previous run. Scheduled maintenance also runs every hour, so expiry is enforced while the site is idle. Expired records are removed on the next maintenance run; closed local installations are cleaned when next used.

Deleting your account

In Account, expand Delete my account, enter your current password and type DELETE. After confirmation, your account details, avatar, personal cases and history, fingerprints, feedback, usage, account-linked audit events, course records and locally held training order records are permanently removed from the active Jatzo service. Invoices and credit notes are not. A company has to keep its financial records, and a numbered sequence of documents cannot have entries taken out of the middle of it and still be a record of anything, so each document stays with its number, dates, amounts and what it was for. The name and email address it was addressed to are erased and its link to your account is removed, so what is left says what was charged and not who you are. Retention and the lawful basis for it are in the list above. Cases you made in a business workspace are not removed either: they stay with the workspace, no longer linked to you, as Business workspaces below explains. Nor is a mailbox address a team admin removed from their inbox rollout: it stays on that team's block list, as the retention list above explains. Contact messages linked to your account or using your current account email, and invitation/recovery records using that email, are removed too. So are Spoof Check report requests and a monthly email sign-up under your account's email address. All sessions cease to provide account access. Your account and its history cannot be recovered through Jatzo.

Every backup, on the server and off it, expires within 30 days. We keep a separate keyed deletion marker for up to 35 days so a permitted backup restore cannot reintroduce deleted accounts or cases. This marker contains no readable email address, name, subject or message content; it is still handled as restricted deletion-management data. Backups are held beyond ordinary use during that period, and deletion markers are applied before a restored service is opened.

Deletion cannot remove reports you downloaded, screenshots, emails you separately sent to support, or copies held outside this installation. Production host logs, off-site backups and any external processors must follow the published retention and erasure policy. We do not promise forensic erasure from storage hardware, memory or every third-party system. If a legal duty requires other records to be kept, this notice will be updated to name them and how long they are kept.

7. Your rights

Depending on the circumstances, UK data protection law may give you rights over your personal information, including rights of access, correction, erasure, restriction, objection and data portability. You can download your own data from Account, under Privacy, and email contact@jatzo.co.uk or use Contact to request help with anything else about your information. If you used Spoof Check without an account, or a Spoof Check report reached you that you did not ask for, email us from that address to ask what is kept under it, which we send to that address only, or to have it deleted. We may need to verify your identity before acting. You can also complain to the Information Commissioner’s Office. How to complain and how long each step takes is set out in the complaints procedure: we acknowledge within 5 working days, and answer without undue delay.

Your right to object

Where processing relies on legitimate interests, you can object on grounds relating to your situation. The monthly Spoof Check email is sent only with your consent, and you can stop it at any time with the link in every one. If any other direct marketing is introduced, you can object to it at any time. Contact us to exercise these rights; they are not waived by using the service.

8. Cookies and local storage

Jatzo uses a signed session cookie to keep users signed in and protect requests. When you sign in with your password, Jatzo also sets a signed cookie that remembers that this browser has signed in to your account, for 180 days. It holds a random reference for the browser and a keyed digest of your account and password, not your address, and it is only sent to the sign-in and password recovery pages. It lets you sign in, or recover your account, from this browser while somebody elsewhere is making failed attempts on your address, and it stops working when you change your password. The Spoof Check page uses the same cookie to protect its forms and stores nothing else of its own on your device. It also tells Jatzo when a few things happen on the page, such as the report form coming into view or a link being copied. Those requests carry the same cookie, which protects them as it protects the forms, and each is limited through a keyed digest of your connection that expires after two days. What Jatzo counts from them, as section 2 describes, holds nothing about who you are. The white label developer page also stores nothing of its own on your device. It tells Jatzo which of its demo tabs you open and when you first press an email link on it, with the same cookie, limited in the same way. The application session lifetime is configured to eight hours; signing out invalidates your Jatzo sessions. Your browser stores your selected colour theme locally. If you connect an inbox add-in with a code, the add-in keeps that connection code in its own browser storage on that device, so you do not have to enter it again, until you disconnect it there or revoke it from your account page. It also saves a reference to that connection in your mailbox, using the setting store Outlook provides for add-ins, so your other Outlook apps can connect without you entering the code again. That reference is not your connection code and cannot check an email or read anything on its own. Disconnecting in the add-in removes it from your mailbox and ends the connection everywhere; revoking the code from your account page ends it as well. This build does not include advertising or analytics trackers. If optional analytics, advertising or other non-essential cookies are introduced, Jatzo will provide the notices and choices required before using them.

Report exports and email delivery

On PDF-capable plans, a bounded in-memory snapshot of the detailed evidence from a check is held so a PDF report can be produced: extracted URLs, IP addresses and other network evidence, header details, attachment metadata, QR destinations, provider results, and short extracts of the message and its attachments. The extracts are phrases of up to 80 characters showing what the message asks for, the first 600 characters of a text attachment, and the subject and sender of an attached email. It is held for up to 30 minutes and then deleted, and it never contains the whole email or an attachment file. Restarts and capacity limits can clear it earlier. Case ownership is rechecked before access; deleting a case or account removes access to its report evidence.

If you request email delivery, the generated PDF, account email address and case reference are sent through the configured Microsoft 365 delivery service. Jatzo has to turn delivery on first. When a plan has an end date, Jatzo also emails the account address through the same service a week before it, to say when access ends and when the cases saved under it are deleted. A Spoof Check fix report goes to the address given for it, and the monthly Spoof Check email to the people who confirmed they want it, through the same service. When delivery is off, or Microsoft does not accept a report, the page gives the report's private link instead and no email is delivered. In a business team, Report this to IT in an inbox add-in sends a PDF of the check to the IT email address the workspace admin set, not to the person who pressed it. That PDF names the original sender and the subject line, so it concerns two people: the member who reported the email and the person who sent it. A business team can also list up to 10 addresses, at domains the team has proved it controls, to be emailed its monthly report on the 1st of each month. The report counts the team's checks, the people who made them and its reported cases, and names no message, subject line or person. The addresses are kept on the workspace until the team changes the list or the workspace is deleted, and an empty list means no report is sent. For a team looked after by an IT company, that company's principal contacts are sent a copy. A business team can also list up to 10 addresses, at domains the team has proved it controls, to be emailed a High risk alert when somebody in the team checks a message that scores High risk or above. An alert gives the score, who checked the message, when, and the case reference, and repeats nothing from the message. A keyed digest of the subject line, not the subject line itself, is kept for seven days so the same message is not alerted on twice. We request no sent-item copy, but Microsoft and recipient mail systems may retain transport records or message copies under their own policies. Downloaded or emailed copies are outside Jatzo's case deletion and retention controls. Do not request delivery if your mailbox is not appropriate for the report's contents.

Free-plan ad space currently displays a Jatzo training promotion. No third-party ad requests, profiling or advertising cookies are included. Paid plans are ad-free. Any future advertising provider needs a separate privacy and consent review before activation.

9. Changes

This notice will be reviewed as Jatzo develops. Material changes to how personal information is used will be reflected in an updated notice before the new processing begins.

Threat Memory and Campaign Intelligence

Jatzo may create keyed, privacy-preserving fingerprints from technical email observables such as registered domains and normalised subject patterns. These fingerprints help recognise related reports and confirmed threat infrastructure without retaining the raw email, full URL or source IP in case history. Campaign Intelligence compares those fingerprints only within your own account or, for a business account, within its workspace's shared history. It never compares one customer's messages with another's. Fingerprints kept after their checks were deleted (section 6) are still compared in the same way, and an outcome confirmed on those checks still counts, until they are deleted.

Training and purchases

Training stores account-linked lesson progress, assessment scores and attempt times, completion references and the course version. Individual answers are used to grade the assessment and are not stored. Stripe receives the purchase information needed for hosted payment; Jatzo stores order, session and payment identifiers, amount, currency and access status. Card details are entered with Stripe and are not collected by Jatzo. Learning records follow section 6. A training order record is removed with the account. An invoice or credit note for a plan is not, and section 6 explains what is erased from it and what stays.

Isolation, browser copies and security

Restricted workers process supported uploads, and the website handles transport, validated results and account records. The controls reduce risk but do not guarantee immunity from malicious content, unauthorised access or data loss. Data shown in your browser and any downloaded report remain accessible to you and anyone with access to that device. Do not assume closing a result securely erases every copy.

If you add a profile picture, Jatzo processes the uploaded image in the worker and stores a re-encoded avatar for your account. Security and operational records may include account identifiers, event times, request information and abuse-control fingerprints. Production proxy and host logging must be configured consistently with this notice.

Automated analysis and AI

The current email engine uses programmed checks and scoring; it does not send your email to a generative-AI model for analysis. Its score supports your decision and does not automatically decide whether you should pay, trust a sender or take another action.

Information needed to provide the service

An email address and password are needed for an account. Email source is needed for the requested check. Contact-form fields marked required are needed to manage your enquiry; other information is optional. If you choose not to provide required information, the relevant feature may be unavailable.

Invoice Fraud Checker

Invoice Fraud Checker, which was sold as Inbox Extract until 25 September 2026 and as Invoice Fraud Analyser until 11 October 2026, is a separate program you buy as a yearly licence and install on your own computer. It reads your statements and invoices on that computer, and neither the documents nor anything taken out of them is sent to Jatzo or to anybody else. A bookkeeper who keeps registers for several clients keeps each apart on that computer, in a folder of its own with keys of its own, and nothing about any of those clients is sent to us either: the installation count below counts the computer once, however many clients it keeps.

Buying one, and counting the installations a licence is used on, are the only parts that involve us. Stripe takes the payment and collects your email address, your billing address and, if you choose to give one, a name to make the licence out to. Jatzo keeps the licence itself: its number, the plan, the name and email address it was issued to, when it was issued, and whether it has been cancelled. The licence key we send you carries the number, the plan, its dates and the name it is made out to, if you gave one, and anybody you show the key to can read them. New keys do not carry your email address; older keys, and the renewals of those licences, do. There is no account, so those records are held against the purchase rather than against a person, and they are kept for as long as the licence is valid, which is indefinitely: a licence that does not expire cannot be reissued or cancelled from a record that has been deleted.

Counting installations. Each licence covers so many installations, and the program tells us when it is used on one. When you activate a licence or a renewal key, it sends us three things: the licence number, a random install ID it made on that computer, and that it is activating. Removing a licence sends the licence number and the install ID again, so that computer is no longer counted. It sends nothing else: not your documents, your suppliers or their bank details, your name, your email address, the program's version or anything about the computer, and nothing at any other time. We keep, for each licence, the install IDs it was activated with, when each was first and last seen, and whether it was released. The install ID is a record about your licence: it says nothing about the computer, but held beside the licence number it is information about you. We use it only to count installations against what the licence covers. Our basis is legitimate interests: a licence is sold for a stated number of people or computers, and this is the least that shows whether it is used within it. A record is deleted 90 days after it was released, or two years after it was last seen. The request comes from your computer's internet address; we do not keep it with the record, and the rate limit that protects the service keeps a keyed digest of it, never the address itself, for at most two days. Nothing we answer can stop the program working.

To have your keys sent to you again, use the resend page. To ask what is held about a purchase, or to have it deleted, email contact@jatzo.co.uk from the address you bought with.

Still to complete

Automatic removal of an invoice once its retention period has passed is not built: the documents are kept, and removing one is a deliberate act until it is. The deployed schedule, external logs and processor arrangements are checked as part of each release.

Business workspaces

Business workspace records: cases checked inside a business workspace belong to that workspace. Its admin and moderators can see all of them, and members can open their own. Where an IT support company looks after the workspace, that company's engineers can see them too, subject lines included, because the workspace has engaged them to manage it; every day one of their people opens the workspace is recorded in the workspace's own activity log. Leaving the team or deleting your account removes your membership and personal details but does not delete business cases: your contributor reference is removed and those cases remain subject to the workspace retention limit. Shared usage charges remain with the subscription admin. Delete your own business cases first if appropriate. An admin must hand over or delete their workspace before deleting their account. Downloaded or emailed copies cannot be recalled.

Invitations expire after 7 days. Workspace history is retained for up to 90 days, subject to the shared plan cap. Removed members lose future workspace access, and previously downloaded reports remain outside Jatzo's control. What a workspace admin and its moderators must do about authorised access and telling staff is set out in the Terms of Service.

10. If Jatzo wrote to you and you are not a customer

Jatzo writes to a small number of UK companies about a fault in their own email settings, such as a domain that publishes no DMARC record and can therefore be spoofed by anybody. If you received such an email, this is the section that applies to you. It is here because anybody who obtains information about you from somewhere other than you has to tell you these things.

Who holds it. Jatzo Ltd, registered in England and Wales, number 17467782, registered office Portland House, Belmont Business Park, Belmont, Durham, DH1 1TW. Jatzo Ltd is the controller, and is registered with the Information Commissioner under reference ZC254981.

What is held. The company's name, number and registered office as published by Companies House; the email address written to and the page of the company's own website it was published on; what a check of the company's public DNS found; and a record of what was sent, when, and any reply. Nothing is bought from a list, no address is guessed, and no address is used that the company does not publish itself.

Where it came from. The public register at Companies House, the company's public DNS records, and the company's own website.

Why, and on what basis. Legitimate interests: telling a business that its email can be impersonated, and to some trades offering one of Jatzo's products. Every email gives the fix away, and it costs nothing. Where there is a product, it is for a related risk rather than for the setting the email found: Invoice Fraud Checker to wholesalers and accountancy practices, and Email Threat Analyser to law firms and IT companies. The assessment behind that is written down and is available on request. Only limited companies and limited liability partnerships are written to, never sole traders or ordinary partnerships.

How long. The record is kept while it is needed to avoid writing to the same company again and to answer a question about what was sent. If you ask not to be contacted, the entry that stops it is kept indefinitely, because that is the only way to be sure the request is honoured.

How to stop it. Reply with the word stop. That suppresses the whole company and not only the address written to, and it is never undone. You can also write to contact@jatzo.co.uk. At most one follow-up is ever sent, and none once you have asked to stop.

If you reply. If your reply turns into a conversation about Jatzo, your name, your address and what we discuss are kept as a sales contact, and section 12 applies from then on.

Your rights. You have the rights in section 7, including the right to object to processing that relies on legitimate interests, and the right to ask for a copy of what is held about you or to have it deleted. You can complain to the Information Commissioner at ico.org.uk.

11. The Gmail add-on and Google user data

When you press Check in the Gmail add-on, Google gives Jatzo permission to read that one message, and Jatzo reads it. The permission covers the message you pressed the button on and nothing else: not the rest of the thread, not your other messages, and not your mailbox. It lasts for that one check and Jatzo does not keep it.

What Jatzo reads is the original message as Gmail holds it, which is every header Google added on delivery and the attachments, so that it reads the same evidence it would read from a file uploaded on the website. Where the message is too large for that, the headers and the body are read without the attachments and the result says so.

The add-on reads nothing until you press Check. It does not read a message because you opened it, and it never reads the rest of the thread or any of your other messages.

The message is analysed and not kept, exactly as on the website. What Jatzo keeps from the check is the case record described in section 2, kept for the periods in section 6.

The add-on asks Google for your email address and the basic profile Google includes with signing in, for permission to act on the message you have open, and for permission to call Jatzo. It asks for nothing else, and it has no access to your mailbox, your contacts, your files or anything else in your Google account. Jatzo uses the email address, to know whose account the check belongs to and for the two checks that compare a message against the person receiving it. It makes no use of the rest of the profile. What it receives is used to produce the analysis you asked for and for nothing else: it is not used for advertising, it is not sold, and it is not given to anybody other than the service providers named in section 5. HubSpot, which section 5 names for sales contacts, is not one of them: HubSpot receives no Google user data.

No artificial intelligence. Jatzo does not use artificial intelligence or machine learning models, its own or anybody else's. The analysis is a fixed set of written rules, run on Jatzo's own server. No Google user data is sent to any artificial intelligence or machine learning service, and none of it, whether raw, aggregated, anonymised or derived, is used to create, train or improve any artificial intelligence or machine learning model.

Jatzo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements, as set out in the Google Workspace API User Data and Developer Policy.

The add-on is listed in the Google Workspace Marketplace as Jatzo Email Security, which is the only way it can reach a Google account. Removing it from your account withdraws every permission above, and Jatzo keeps nothing further from it; the case records already made are kept and deleted as sections 2 and 6 describe, the same as a check made on the website.

12. If you met Jatzo or are talking to us about the product

If you met Jatzo at an event, gave us your details, or replied to one of our emails and a conversation started, this section applies to you.

Who holds it. Jatzo Ltd, as section 1 describes, is the controller.

What is held. Your name, company and job title, your work email address and phone number, where and when we met or first spoke, notes of what we discussed and agreed, and where any purchase stands. The notes record what was asked and agreed, not opinions about you.

Where it came from. From you: what you told us, handed over or wrote in a reply.

Why, and on what basis. Legitimate interests: following up a conversation you chose to have, so the next email or call is the one you expect. If you are a sole trader, we send you marketing email only if you agreed to it when we exchanged details.

Who receives it. HubSpot, the customer relationship tool it is kept in, as section 5 describes: hosted in Germany, with HubSpot, Inc. able to process it in the United States under the safeguards set out there. It is entered by hand, and nothing from the Jatzo service or any email you check goes into it.

How long. Two years after we were last in touch, or, if you become a customer, two years after your plan ends. If you ask us not to contact you, a note saying so is kept, because that is the only way to be sure the request is honoured.

How to stop. Tell us, by replying to any email or by writing to contact@jatzo.co.uk. We stop contacting you, and do not start again.

Your rights. You have the rights in section 7, including the right to object, and the right to ask for a copy of what is held about you or to have it deleted. You can complain to the Information Commissioner at ico.org.uk.

If you are under 18

Here is the short version. When you check an email, Jatzo reads it and gives you a score. It keeps the subject line, the score and what it found, for up to 90 days, and never keeps the email itself. On the Free plan, nothing from the email is sent to anybody else. You can download everything Jatzo holds about you, or delete your account, from your account page at any time. You need to be 18 to buy a paid plan. If anything here worries you, talk to a parent, carer or teacher, or contact us.