Privacy Policy

Last updated: 7 October 2026

1. Who we are and what this policy covers

Shakewell Agency ("we", "us", "our") runs Jasper: the website at heyjasper.ai, the Jasper web app, the Jasper desktop apps for Mac, Windows and Linux, the Jasper HQ mobile app for iPhone and Android, the Jasper API and the Jasper GitHub App. Jasper is a workspace for teams: chat and calls, mail, calendar, time tracking, leave, clients and projects, code review, a wiki, learning, an API client, deploys and uptime checks.

This policy explains what personal information we collect, what we send to AI services, where it is stored, who else handles it, how long we keep it, and what you can ask us to do. We are based in Australia and handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

When your employer or another organisation gives you access to Jasper, that organisation decides who is in its workspace and sets things like call recording and how long mail and recordings are kept. We handle the content in that workspace to provide Jasper to the organisation. Some requests about that content, such as deleting it, need the organisation's agreement.

2. The short version

We store what you and your organisation put into Jasper so it works: messages, files, mail, calendars, time, leave, call recordings, code reviews and so on.
AI features send content to Anthropic's Claude. A code review sends the pull request's changes, and the AI can also read other files in our copy of your repository.
Your organisation can switch each AI feature off. What each one sends:
- Code review: The pull request title, description and changes, comments on it, and any file in our copy of the repository that the review reads. Also used for chat replies on a pull request.
- Mail AI: The text of the email thread you are working on, plus your sent mail and chat messages when it learns your writing style, for triage, replies, drafts, rewrites and follow-ups.
- Call summaries: The transcript of each recorded call of a minute or more, and the names of the people on it.
- Chat and translation: The message text you translate, and recent messages of a conversation for reply suggestions, thread summaries, topics, meeting notes and catch-up.
- Assistant: Your question, the conversation so far, and the Jasper items (reviews, tasks, wiki pages, messages) it finds to answer from.
- Daily briefing and Today: Titles and short details of your tasks, meetings, mail and channel activity for the day, to write the briefing and the Today summary.
- Weekly client updates: For one client, the hours logged last week by project, the names of tasks finished that are shared with the client, and the retainer hours used. Hours only: no rates, amounts or fees, and no notes from time entries.
Recorded calls are transcribed by Amazon Transcribe in Sydney and summarised by Claude.
Our servers, database and files are in Amazon Web Services' Sydney region. Some services we use are overseas (section 7).
If your organisation switches on activity audit, Jasper records what you do in its apps, in your name, including recordings of your screen on the web and desktop. Your organisation's owners and your manager can see it, and it is kept for 90 days (section 3).
We do not sell personal information, show advertising or use advertising cookies.
Most content is kept while your organisation uses Jasper. Most logs are deleted automatically on the schedules in section 9.

3. Information we collect

Your account

Name, email address, profile picture, timezone, language and the profile details you or your organisation add (for example job title, phone number, city, start date and date of birth).
If you sign in with GitHub: your GitHub username and id, your email address, the organisations you belong to, and whether your GitHub account has two-factor authentication. If you sign in with an email address: your password, stored only as a one-way hash.
Sign-in records: the date, IP address, browser and device of each sign-in, and new-device check codes.

Your organisation

The organisation's name and settings, its members, their roles and permissions, invitations, and any IP address rules.
Billing: if your organisation pays through Stripe, we store Stripe's customer and payment references. Card details go to Stripe and never reach us.

Code and GitHub

When your organisation installs the Jasper GitHub App: repository names and settings, pull requests (title, author, reviewers and changes), commits (author name, email, username and message), and comments.
A copy of each connected repository on our server: the latest version of its default branch, refreshed daily and before a review. We delete this copy when the repository is removed from the GitHub App or the app is uninstalled.
Each code review: the review, its comments, the full instructions sent to the AI (which include the changes) and the AI's full reply. These stay with the review.
Statistics built from this, such as each person's pull requests, commits and review results, shown in team analytics.
If your organisation turns on AI Cadence: details of developers' AI coding sessions sent by our command-line tool (the tool used, counts, file names and branch), and the session itself, encrypted on the developer's computer before it is sent.

Work records

Time entries and timers (description, times, project, client, billable flag, and the device a timer was started from), timesheets, projects, clients, rates and invoices.
A history of changes to time entries, and notes from timesheet checks.
Leave requests, reasons, notes and balances.
The desktop app checks how long your computer has been idle or locked (not what you were doing) to set your status and to ask about idle time while a timer runs.

Messages, files and calls

Chat messages and their edit history, reactions, threads, pins, reminders, drafts, read receipts in direct messages, and your status and when you were last active.
Files you share. Links to them are signed and expire.
Link previews: when a message contains a link, our server visits that page to show a preview.
Calls: the call itself travels directly between participants where possible. Whether calls are recorded is your organisation's setting: off, recorded when everyone agrees, or every call recorded with a visible "this call is recorded" notice. A recording holds every voice and the main picture. Recordings of a minute or longer are transcribed and summarised automatically. People who joined the call and the organisation's owners and admins can see the recording, transcript and notes.
If your organisation turned on the Krisp integration: meetings Krisp sends us, including transcripts, notes and attendee details.
The Feed: what you read, react to, save and dismiss, including how long posts stay on screen, to order the Feed for you.
Reports: if you report a message, your organisation's owners and admins are told by notification and email, with your name, your reason and up to 200 characters of the message, including for direct messages and private channels. We keep the report (your name, the message, your reason and when you reported it) and record it in your organisation's audit trail. The person who wrote the message is not told.

Mail and calendars

If you connect a mailbox (Google with your consent, or another provider with a password or app password), we copy your mail to our servers, including attachments, and keep it in sync. Your organisation can also connect shared inboxes.
The password or Google access you give us is stored encrypted.
Your mail settings, such as VIP senders, senders whose images you load, and rules.
A contact list built from the people you email.
If you connect a calendar (Google or CalDAV): your events, attendees and locations. Events marked private are kept only as busy time. If your organisation sets up Google Meet, we create Meet links through its Google account.

Other connected tools

ClickUp: tasks, comments, people and time entries your organisation syncs, and your ClickUp inbox.
Postman: your Postman API key (stored encrypted) and the collections and environments it syncs. Values that look like secrets are moved into a private, encrypted environment.
API client: your saved requests, environments and request history, including the headers and bodies you send and receive. Variables marked secret are encrypted.
Slack: the incoming webhook address you or your organisation give us, to post announcements.
Deploys: references to secrets kept in your own AWS account. We pass secret values straight to your AWS account and don't keep them.
Uptime checks: the addresses and settings of the sites you monitor, and status page subscribers' email addresses.

Learning and intranet

Course progress, quiz answers and certificates.
Policy acknowledgements, with the time, IP address and browser.
Which intranet pages you view and for how long, and what you search for.

The desktop app

The desktop app keeps a copy of your workspace on your computer so it opens quickly and works offline. Your session and mail passwords on the computer are protected by the operating system's keychain.
We record each install's version, platform and when it was last seen, so we know who needs to update.

The mobile app

The Jasper HQ app keeps a copy of your conversations on your phone so it opens quickly and works offline, and keeps your session in the phone's secure storage. When you sign out, or Jasper ends your session, the app deletes everything it stored for your account (messages, messages not yet sent, sign-in tokens, its notification registration and cached photos) and clears its notifications. Uninstalling the app deletes the same, except that an iPhone keeps the sign-in tokens in its keychain, where other apps can't read them, until the app is installed again and erases them before they are used. The app's data is not included in Android's cloud backup.
For notifications, we store your phone's notification token, whether it is an iPhone or Android phone, the app version, your language, your notification preview setting and when the app was last used, for the organisation you signed in to.
Notifications are delivered by Apple (for iPhones) and Google (for Android phones). Each notification shows the sender, the conversation and the start of the message. If you switch off previews in the app, it shows the sender and "New message" instead of the message. We don't send a notification while you're active in Jasper on a computer.
The app reads only the photos and files you choose to send, and uses the camera only when you take a photo to send.
If you turn on app lock, your phone checks your face or fingerprint. We never receive your face or fingerprint data.

Technical logs

Application logs, which can include your user id, email address and IP address next to an event or error.
Request logs for changes and errors: IP address, session id, request details and response.
An audit trail of sign-ins, security events and API use: who, when, what, IP address and browser.
A copy of each email we send you (recipients, subject and text).
Copies of the notifications GitHub, ClickUp and Krisp send us.
Error reports sent to Sentry. Reports from your browser include your user id, email address and username so we can follow up.

Organisation activity audit and screen recording

An organisation can switch on activity audit, so that it can see what happens in its workspace. It is off unless an owner of the organisation switches it on. While it is on, the Jasper web, desktop and mobile apps record, for each person and tied to their name and account:

The screens, sections, dialogs and settings they open and how long each stays open, with the conversation, mailbox, task or person shown.
What they click or tap, how far they scroll, and the keyboard shortcuts and commands they use.
What they copy, cut and paste: where, and how many characters. For copy and cut, the first 2,000 characters of the text, except from password and secret fields.
The files they download, open, save, upload, drag in and export: name, size, type and where from.
In the desktop app's mail: the emails they open, send, reply to, forward, delete, move and flag, and the attachments they download, with the sender, recipients, subject, folder and account (not the message text).
When the app starts, closes, is focused, goes idle, is locked, goes offline and comes back, when they sign in and out, and the errors they meet.
The app version, a random number identifying the device, the IP address and the browser.
On the web and in the desktop app, a recording of the Jasper screen, including what they type. Password, token and secret fields are hidden in the recording. The mobile app does not record the screen.

The organisation's owners can see everyone's activity, and a manager can see the activity of the people who report to them. Every time someone looks at a person's activity, watches a recording or exports it, that is itself recorded in the organisation's audit trail. Each person can see their own activity in their audit log. The apps tell people when their organisation has activity audit on. Activity and recordings are deleted after 90 days.

We handle this information for the organisation, which decides to collect it and is responsible for telling its people. We don't use it for anything else.

4. How we use AI

Jasper's AI features use Anthropic's Claude models. They run through Anthropic's Claude Code tool on our server, signed in to a Claude subscription account held by Shakewell. Apart from code reviews, which can read files in our copy of the repository, and a Feed search that can look things up on the public web (it is sent no personal information), the AI gets no tools: it cannot run code or reach our other systems.

We do not train AI models on your content. Whether Anthropic keeps or uses content sent from Jasper depends on the terms of the Claude account we use.

What each feature sends, and when:

Code review (automatic when a pull request is opened or updated in a repository with reviews switched on): the pull request title, the repository name, the author's GitHub username and the changes (the diff, without lock files or minified files, up to about 50,000 characters); your organisation's and repository's review instructions; and, unless switched off for the repository, its AGENTS.md or CLAUDE.md file. During the review the AI can also open, search and list any other file in our copy of the repository. The pull request description and commit messages are not sent.
Pull request chat (when someone talks to Jasper in a pull request comment): the pull request description, branches, changes, comments and the code around the comment.
ClickUp (only when your organisation turns on task matching): the pull request title, author and repository, and the names and descriptions of up to 50 open tasks.
Chat (when you use summaries, catch-up, suggested replies, meeting notes or AI search): the messages involved, with sender names and times.
Translation (when you ask): the text. We store the translation, without your name or the message it came from, so the same text isn't translated twice.
Write in my style (on unless you switch it off): your own chat messages from the last 90 days and some of your sent emails, to make a private note on how you write. Turning it off deletes the note.
Mail (when you ask for a draft, rewrite, reply ideas, summary, search, template or ticket): the email conversation (senders, recipients, dates, subject and text, without quoted history) and your instructions, draft and signature.
Shared inboxes (automatic for each new conversation): the subject, the sender's name and address and the first 500 characters, to set a priority and a one-line summary.
Needs reply (when you ask Jasper to check): the sender, subject and first 1,500 characters of the emails being checked.
Morning briefing and Today note (the briefing if you turn it on; otherwise a note made on your first visit to Today each workday): short extracts from your mail, direct messages, tasks, meetings, approvals and busy channels.
Call recordings: the audio goes to Amazon Transcribe in Sydney for a transcript. We have opted out of AWS using it to improve its AI services, and the transcription job is deleted from AWS when it finishes. The transcript and participants' names then go to Claude for a summary.
Wiki (when you ask): the page title, the text you selected, the text around it and your request.
Project assistant (when you ask): the repository's file list, up to 10 files, review summaries, and any connected ClickUp or wiki content.
API client (when you ask): your description of a request, or the request and response you are working on, or a collection and a sample run.
Assistant chat (when you use it, for example from the command line): your messages and whatever you share with it, which can include file contents and command output from your own computer.
Feed: a summary of your Feed activity and interests, to order posts.
AI Cadence (only when your organisation turns it on): the session details listed in section 3, not the session itself, to grade AI coding sessions.
Your own AI app (off unless you switch it on): you can let an AI app you use read your own mailboxes through Jasper. Every read is logged, and what that app does with your mail is governed by its own terms.
Our own operations: error messages and technical details, which can include personal information, to diagnose faults.

Jasper records how much each AI request used. Organisations also have a setting, on by default, to keep a copy of AI requests and replies. Each organisation chooses how long these copies are kept (90 days unless changed), and Jasper deletes them nightly once they are older than that. The usage counts for each request, such as tokens, stay.

5. How we use your information

To run Jasper: show you your workspace, sync your mail, calendars and tools, run code reviews, record and transcribe calls where your organisation has switched that on, and keep the desktop app up to date.
To keep it secure: check sign-ins, send new-device codes, apply your organisation's IP rules, keep audit trails and investigate misuse.
To support you: answer questions and fix problems, using logs and error reports.
To communicate: send notifications you've chosen, security alerts and service messages.
To bill: manage subscriptions and payments.
To improve Jasper: using anonymous daily totals (section 11), not individual activity.

We do not sell personal information or use it for advertising.

6. Who we share it with

People in your organisation see what you share with them. Your organisation's owners and admins can also see audit trails, call recordings where they were not on the call, and member details. Outside your organisation, these services handle personal information for us:

Service	What for	Where
Amazon Web Services	Servers, database, file storage, file delivery (assets.heyjasper.ai), call transcription and email sending	Sydney, Australia
Cloudflare	Domain name service and network protection in front of heyjasper.ai (it sees IP addresses and traffic)	Global
Anthropic	AI features (section 4)	United States
GitHub	Sign-in, repositories, pull requests and profile pictures	United States
Sentry	Error reports	United States
Google	Gmail, Google Calendar and Google Meet if you connect them; Google's servers also help calls connect, which shows them participants' IP addresses. Notifications to Android phones (Firebase Cloud Messaging): the phone's notification token and the notification	United States and other countries
Apple	Notifications to iPhones (Apple Push Notification service): the phone's notification token and the notification	United States and other countries
Stripe	Payments	United States
ClickUp, Slack, Postman, Krisp	Only if your organisation or you connect them	Mostly United States
Open-Meteo	Weather on your dashboard: the city in your profile is sent to look up the forecast	Europe
jsDelivr	Some app pages load charting code from this public network, which sees your IP address	Global

We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a sale or restructure of our business. We will not sell personal information.

7. Where your information is stored

Our database, files, call recordings, mail, repository copies and backups are stored with Amazon Web Services in Sydney (ap-southeast-2). The services in section 6 marked as overseas receive the information described there, mainly in the United States.

8. How we protect it

Connections to Jasper are encrypted (HTTPS).
Passwords are stored as one-way hashes, and API tokens only as hashes. API tokens have scopes and can expire.
Mailbox, calendar and most integration passwords and tokens are encrypted in our database.
Access inside an organisation is controlled by roles and permissions. Organisations can limit access to approved IP addresses.
A sign-in from a new device needs a code sent by email, unless your GitHub account has two-factor authentication. Jasper supports two-factor sign-in with an authenticator app, recovery codes or passkeys, and organisations can require it.
Files are kept in private storage and shared through signed links that expire within 7 to 14 days.
Sign-ins, security events and API use are written to an audit trail that organisation admins can review.
The AI cannot run code or reach our systems. Code reviews get read-only access to the repository copy.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the law requires.

9. How long we keep it

Content in your workspace (messages, files, mail, calendars, time, leave, code reviews and call recordings) is kept while your organisation uses Jasper, unless you or your organisation delete it, or your organisation sets a shorter period. Organisations can set how long mail and call recordings are kept. Without a setting, both are kept indefinitely.

These are deleted automatically:

Application logs and the API log file: 14 days.
Request logs: 30 days.
Copies of emails we sent: 90 days.
Desktop notification receipts: 14 days.
A phone's notification token: when you sign out of the app; when Apple or Google tell us the token no longer works (for example after the app is deleted); after 90 days without the app being opened; or, the next time we would notify you, if you have left your organisation, your account is deactivated or your session on the phone has ended.
Uptime check results: 90 days.
Audit trail: 365 days, or what your organisation sets (30 days to 5 years). Page-activity entries: 90 days. Resolved security alerts: 2 years.
Organisation activity audit (section 3): activity and screen recordings, 90 days.
Anonymous usage totals: 25 months.

These are currently kept with no automatic deletion: the list of sign-in sessions, the record of changes to profiles and settings, deleted chat messages (removed from view but still in our database), translations, the AI request log, copies of notifications from GitHub, ClickUp and Krisp, code reviews with their instructions and replies, message reports, and account deletion requests.

When your organisation removes a repository or uninstalls the GitHub App, we delete our copy of the repository's code. Pull request data and code reviews stay unless deleted. Billing records are kept as long as tax law requires.

10. Your choices and rights

Access and correction: you can see and edit most of your details in your settings, and ask us for a copy of the personal information we hold about you, or to correct it.
Deletion: email us to delete your account, or send a deletion request from the mobile app's settings. A request from the app sends your name, email address, organisation and any note you add to your organisation's owners and to us, and we handle it by hand; the web and desktop apps have no delete button yet. Messages you sent stay in their conversations without your name. To delete an organisation or get an export of its data, an owner of the organisation can email us.
AI and recording: you can switch off Write in my style, and leave off the morning briefing and letting your own AI app read your mail. Call recording and activity audit are your organisation's settings.
Phone notifications: you can switch off message previews in the app, or switch off notifications in your phone's settings.
Usage totals: see section 11.

We will respond within 30 days. If your request is about content your organisation controls, we may need to pass it to your organisation. If you're unhappy with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

11. Cookies and usage statistics

We use essential cookies only: one to keep you signed in during a visit, a "remember me" cookie that keeps you signed in for up to about 13 months (always set when you sign in with GitHub), and one that protects forms from forgery. Your preferences, such as dark mode, are kept in your browser's own storage. We do not use analytics or advertising cookies, and we do not use Google Analytics or any other third-party analytics service.

To understand how Jasper and this website are used, our own servers keep anonymous daily totals: for example visits to each page, the websites and campaigns that referred visitors, country, device type. These totals are not linked to any person, account or IP address. (This is about the anonymous totals only. Organisation activity audit, in section 3, is tied to the person.) To count unique visitors we combine the IP address and browser details with a random value that we delete every day, and keep only the resulting number. If you arrive from a campaign link or another website, we note the campaign or that website's domain in your session so that a sign-up can be counted against it; the note ends when your session ends. We honour your browser's Global Privacy Control and Do Not Track signals. We keep daily totals for 25 months.

12. Children

Jasper is a workplace tool and is not meant for anyone under 16. We do not knowingly collect personal information from children.

13. Changes to this policy

When we change this policy we will update the date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.

14. Contact us

For privacy questions, requests and complaints, email sales@shakewell.agency.

Address: Shakewell Agency, Sydney, NSW, Australia