What we collect, who else sees it, and how to get it back or deleted.
Last updated 6 October 2026
Diese Seite gibt es nur auf Englisch. Sie ist die maßgebliche Fassung, und wir können dir auf Deutsch antworten — schreib uns über die Kontaktseite.
joris runs scheduled routines on your behalf and saves each result. To do that we hold your account details and the content of your routines. This page says exactly what that means.
joris is run by Hugo Miguel Bento Queimadelos, a sole trader (autónomo) based in Pontevedra, Spain, who is the data controller (NIF ES34876033Y). Questions, or any request below: support@jorisloop.com.
Email address, and a display name if you choose to set one — we never ask for it. Time zone, time format and reading size, because they change how deliveries are scheduled and shown. Your plan, trial dates and Stripe identifiers. If you use a passkey, the credential's public key — never a biometric, which stays on your device.
We record the IP address and country you signed up from. That exists to catch bulk fake signups, not to profile you.
We also record how you arrived: the page you landed on, the site that linked you (if any), and any campaign tag on the link you followed. That tells us which of the places we write about joris actually reaches people. It is first-party — it never leaves our server, it is not shared with an analytics company, and there is no identifier that follows you to any other site.
The direction you write, the memory attached to a routine, its schedule, and every delivery it has produced — including the feedback you leave and what you tick, save or dismiss inside a delivery.
This is the part worth thinking about. A routine's direction is free text you write, and people put real details in it: a budget, a neighbourhood, an injury, a salary expectation. It is sent to the AI model that runs the routine, and — for web-enabled routines — shapes the searches we run. Don't put anything in a direction you wouldn't want processed by the providers listed below.
Support tickets and their messages. Error reports when something breaks, which include the request that failed, your IP address and your account id. Our server's logs and timing records, with request parameters, email addresses and IP addresses removed. Monthly counts of how many runs you've used, for your plan's limits.
We do not sell your data, we do not run advertising, and we do not use your routine content to train AI models of our own.
Running a scheduled AI assistant means sending parts of your data to other companies. These are the categories, with the specific providers named where it helps you judge them:
| Who | What reaches them | Why |
|---|---|---|
| An AI model provider | Your routine's direction and memory, recent delivery history, and any web content gathered for that run | Generating the delivery |
| A web-search & page-extraction provider | Search queries derived from your direction — not your identity | Live web research for web-enabled routines |
| Stripe | Email, billing address, VAT number if you give one, payment details (which go to Stripe directly, never through us) | Subscriptions, invoices and tax |
| Your email address, and the contents of any email we send you | Email delivery | |
| Cloudflare | A bot-check token and your IP at sign-in | Blocking automated signups |
| PostHog (EU) | When something breaks: what failed, where, and your account id. No cookie, and nothing about it depends on the analytics choice below | Finding and fixing faults |
| PostHog (EU) | What your account does here: a routine created, a delivery run, a subscription started. The fact and its type, never its content — a routine's name and direction never leave. No cookie, and like faults above it does not depend on the analytics choice. Your IP rides along when the action came from a page rather than a background job | Knowing whether the product works |
| PostHog (EU) | For each AI call a routine makes: which model, how many tokens, how long it took, whether it failed, and your account id. Never the prompt and never the answer. Does not depend on the analytics choice | Knowing what a run costs and where it fails |
| PostHog (EU) | Our server's own logs and timing records: which page or job ran, how long each step took, what failed. Request parameters, job inputs, the part of a web address after the “?”, email addresses and IP addresses are removed before they leave. Does not depend on the analytics choice | Keeping joris fast and working |
| PostHog (EU) | Only if you allow it: pages you open and things you click, with your account id if you are signed in. Never what you type, and never the contents of a delivery | Seeing which parts of joris are actually used |
| PostHog (EU) | Only if you separately allow it, and then only for some sessions: a recording of your screen as you move around joris — with the contents of every delivery, every routine and every form field blanked out before it leaves your browser | Watching where people get stuck |
| PostHog (EU) | If you say no: that a page was viewed — which page, the site that linked you, what kind of browser. No tracking cookie, and nothing kept on your device except a note that you said no; no account id, no clicks and no recording. PostHog tells one visit from another by a code it works out on its own servers from your IP address and browser, mixed with a value that changes every day — so it cannot follow you from one day to the next, or to any other site | Knowing how many people arrived |
| Hetzner | Everything, at rest — they host the servers | Hosting |
Analytics are opt-in. Until you answer, nothing loads at all. If you say no, the only thing your browser sends is the count in the table above — a page was viewed, with no tracking cookie, no account id and nothing that can follow you — because a site that cannot tell how many people arrived cannot tell whether anything it writes is working. If you do allow analytics, PostHog receives the pages you open and the things you click, on their EU servers — never what you type, never the contents of a delivery, and never anything sold on or used for advertising. You can change your mind at any time, and you do not have to go looking for a cookie to do it: Cookie preferences, at the bottom of every page, reopens the same panel the banner offered and shows you what is currently on.
Screen recording is its own switch, and you can see it before you agree to it. "Accept all" includes it — we would rather say that plainly than hide it behind a word like "all" and hope nobody checks. "Manage options", beside it on the banner, opens the panel where recording is a switch of its own with this same description attached, so you can allow analytics and refuse recording in one click. Refusing is the default: it is off until you turn it on, and it was off for everyone who answered before it existed.
Here is exactly what a recording is and is not. It captures how you move through joris: the pages you open, where you click, what you scroll past, how long a screen takes. It does not capture what is written on those screens. The contents of every delivery, the names and directions of your routines, and everything you type into any field are blanked out by the recorder in your browser, before anything is sent — so the text never reaches PostHog rather than reaching them and being hidden. What stays readable is the furniture: the navigation, the buttons, which screen you are on. That is deliberate, and it is the reason the recording is worth anything.
We do this because joris holds things a recording has no business carrying — an injury in a trainer plan, a budget in a house hunt, a salary in a job hunt. Folding that silently into a general "analytics" tick would not be a real choice, which is why it has a switch of its own and a paragraph of its own.
Two more limits, for completeness. Only a fraction of allowed sessions are recorded at all — it is a sample, not a camera, and we keep it small on purpose. And nobody administering joris is ever recorded, including when support is looking at an account on your behalf: those sessions load no analytics and no recorder whatsoever.
Turning something off takes effect immediately, on the page you are standing on — not at the next click or the next visit. Switch recording off mid-session and the recorder stops there; switch analytics off and nothing further is sent. What was already collected before you changed your mind falls under “How long we keep it” and “Your rights” below.
Some things are not opt-in, and we would rather say so than be clever about it. Whatever you chose, our own server reports to PostHog: when something breaks — what broke, where, and your account id, so we can tell whether it hit one person or everyone; when your account does something structural — a routine created, a delivery run, a subscription started; each AI call a routine makes — which model, how many tokens, how long it took, whether it failed; and its own logs and timings — which page or background job ran and how long each step took. An app that cannot see its own failures leaves them unfixed, and one that cannot count its own deliveries cannot tell you why yours did not arrive.
None of these sets a cookie or follows you anywhere, and none is built to carry what you wrote or what joris delivered: a prompt, an AI's answer, a routine's name, a direction and a search query are never sent. Before logs and timings leave, we remove request parameters, the inputs of background jobs, the part of a web address after the “?”, email addresses and IP addresses. The one thing we cannot fully promise is an error's own message: it travels with the error report, and now and then an AI provider's error quotes back a fragment of what it was sent. When one of these is triggered by something you did on a page rather than by a background job, your IP address reaches PostHog with it.
There is no advertising and no cross-site tracking here, allowed or not.
We name the AI and search providers by category rather than brand because the specific vendors are commercially sensitive. If you need the exact list — for your own compliance, say — email us and we'll share it.
Some of these providers operate outside the EEA. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
Your routines and deliveries are kept for as long as your account exists — that's the point of the product, since a routine gets better by remembering what came before. Support tickets are kept while your account exists. Invoices are kept as long as tax law requires, which is currently several years and applies even after you leave.
Closing your account deletes it. Settings → Profile → Close account removes your routines, every delivery, your tickets and your passkeys immediately and permanently. There is no recovery window and no export — once it's gone it's gone, so copy anything you want to keep before you close the account. Our nightly database backups are the one exception, and only for a while: a closed account persists in them until the backup it sits in expires, which is at most two months. We never restore a backup to bring an account back.
Three things outlive a closed account, and this is all of them.
Invoices, as above, because tax law says so.
A one-way hash of your email address — not the address itself, and not reversible into it — recording only that a free trial was once taken, so the same person can't reopen an account to start another one. We keep it on the legitimate-interest ground of preventing abuse of the trial, and we delete it six months after the trial started. It holds nothing else about you and is never used to contact you or to build a profile.
A record that the account was closed: the date, which plan it was on, how old it was, how many routines and deliveries it had, and the reason you gave for leaving if you gave one. That record is attached to the same kind of one-way hash, which we remove after six months — after which what's left describes nobody. If the account was suspended when it closed, we also keep the email address itself for twelve months, on the ground of establishing and defending legal claims, so that a suspension can be explained if it is challenged and so that a suspended account can't be reopened by closing it and signing up again. After twelve months that address is deleted too, and the suspension stops being enforced.
Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Email support@jorisloop.com and we'll respond within one month.
If you think we've handled your data badly, you can complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es) or to the authority where you live.
Everything travels over TLS. Credentials and tokens are encrypted at rest. Sign-in is passwordless — a one-time emailed link, or a passkey — so there is no password of yours for us to lose.
If we change this page in a way that materially affects you, we'll email you before it takes effect. The date at the top always reflects the current version.