Privacy Policy

1. What Joy stores and where

In your browser: workspace data (clients, matters, settings) and the connection tokens for Google, Microsoft and Dropbox are kept in your browser's local storage.
Joy document storage: files you uploaded or that were created for you (including through Claude or ChatGPT), share links, data rooms and access logs (time, IP address and browser of every opening) are kept on Netlify servers, separated by workspace key. The server keeps only a hash of the workspace key.
Chat connection: when you connect Joy to Claude or ChatGPT, Joy keeps the app name, the connection and usage times and hashed tokens. The chat receives only the results of the tools it runs at your request.
Cloud storage: Google Drive access covers only the files you pick and the files Joy creates for you (section 2); OneDrive/SharePoint and Dropbox access is read-only and covers only the files you pick. Access runs from your browser, and a copy is kept in Joy only if you choose to save it or add it to a booklet.
Cloud backup (optional): if you turn on backup, workspace data is synchronised to Joy's cloud service.

2. Google user data: what Joy accesses

Joy asks Google for a permission only when you click Connect for the feature that needs it, and asks only for that feature's permission. Joy can access:
• Google sign-in (openid, email, profile): your name, e-mail address and profile picture, to create your Joy account and sign you in.
• Google Drive (drive.file): only the files you choose in the Google Picker and the files Joy creates in your Drive at your request — a finished court booklet, or your Joy documents folder if you choose Google Drive as Joy's storage. Joy cannot see any other file in your Drive.
• Google Calendar (calendar.events.owned): events on the Google calendars you own; Joy uses only your primary calendar (title, date, time, location and description). Joy reads them and creates events; it changes or deletes only events that Joy itself created.
• Google Contacts (contacts.readonly): the names, e-mail addresses, phone numbers and organisations of your saved Google contacts, read-only. Joy never changes your contacts.
• Gmail (gmail.send): permission to send e-mail from your Gmail address. With it Joy cannot read, search, change or delete any message in your mailbox.
You can see and remove every permission at any time in Joy (Settings → Connectors → Disconnect) or at myaccount.google.com/permissions.

3. How Joy uses Google user data

Only to provide the feature you turned on, to you, inside Joy:
• Sign-in: to identify your account.
• Drive: to show the files you picked, add them to booklets and documents, save the finished file back to your Drive when you ask, and keep your Joy documents in your Joy folder if you chose Google Drive as storage.
• Calendar: to add the court hearings, deadlines and meetings you create in Joy to your Google Calendar, keep them updated when you change or delete them in Joy, and show your Google events in Joy's calendar so you see your agenda and scheduling conflicts.
• Contacts: to import the contacts you choose into Joy's client list when you click Import, so you do not retype them.
• Gmail: to send, from your own address, the messages you send or schedule in Joy: signature requests, documents, invoices, reminders and reports.
• Joy AI: if you ask Joy's AI assistant about an item that came from Google (for example a hearing or a client), the text of that item is sent to the AI model provider you use, only to answer that request.
Joy does not use Google user data for advertising, does not sell it, does not use it to build profiles of you, and does not use it to develop, improve or train artificial-intelligence or machine-learning models.
Joy Work OS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who Joy shares Google user data with

Joy does not sell, rent or trade Google user data, and shares, transfers or discloses it only:
• With service providers that run Joy for you, under contract and only to provide the feature: Netlify, Inc. (hosting and document storage, United States), Supabase, Inc. (the Joy account database, European Union — Ireland) and, only when you use Joy AI, the AI model provider you use (Anthropic PBC, OpenAI, L.L.C. or Google LLC), whose terms forbid training models on the data.
• With the recipients you choose: an e-mail you send goes to the addresses you enter; a share link reaches whoever you give it to.
• When the law requires it, or to protect you, Joy and others against fraud, abuse or security threats.
• In a merger or sale of the business, with notice to you and under these same commitments.
No person at Joy reads your Google user data unless you ask us to about a specific item (for support), it is needed to investigate security or abuse, or the law requires it.

5. How Joy stores, protects, keeps and deletes Google user data

• Access tokens: short-lived (one hour) and kept in your browser; they are not stored on Joy's servers. Only if you keep Google Drive connected as Joy's storage does Joy's server hold one refresh token for Drive, encrypted (AES-256-GCM) and used only to renew your access. Disconnecting in Joy deletes them all.
• Imported events and contacts: kept in your Joy workspace — your browser and, if you use a Joy cloud account, Joy's database in the European Union — encrypted in transit (TLS) and at rest, with row-level access control so only your office's accounts can read them.
• Drive files: a copy is kept only if you save the file in Joy or add it to a booklet.
• Gmail: Joy never stores the content of your mailbox; for messages Joy sent for you it may keep a record (recipient, subject and time) in the relevant matter.
• Retention and deletion: Google user data is kept until you delete it or close your account. "Delete all data" in Joy, or a request to adir@joyworkos.com, deletes it; backup copies are erased within 30 days. Disconnecting Google stops all further access at once.

6. What Joy does not do

Joy does not sell information, does not use it for advertising and does not use your documents to train models. Google measurement cookies load only with your consent ("Cookies and measurement").

7. Retention and deletion

Data is kept until you delete it. Share links expire on the date you set. In Joy's document screens: "Export data" (right of access) and "Delete all data" (right of erasure) — an irreversible deletion of files, versions, links, data rooms and logs. Disconnecting a chat in Connectors revokes its access immediately.

8. Security

HTTPS only (HSTS), a Content Security Policy, OAuth 2.1 with PKCE, hashed short-lived tokens, password-protected links with an access log.

9. Your rights

Under the Israeli Protection of Privacy Law, 5741-1981, and the GDPR where it applies: access, correction and erasure. Contact us: adir@joyworkos.com.

10. Offices using Joy

For personal data an office processes through Joy about its clients, staff and others, the office is the controller and Joy acts as its processor. The terms: Data Processing Addendum.

11. Cookies and measurement

The website and the app keep your settings in your browser, and your cookie choice in one cookie of ours (joy_consent). Google cookies (Analytics and Ads, through Google Tag Manager) load only after you click "Accept", to measure visits and Joy's own advertising. With the same consent PostHog (product analytics, servers in the European Union) measures how the website is used — pages, clicks and a session replay in which everything typed is masked; in the app it receives only screen names and the events below, never what is on the screen. With that consent the app tells Google only that a trial started, the office began using Joy, or a subscription was paid (amount, currency, plan) — never a name, e-mail address, clients, matters, documents or Google user data. "No, thanks" loads nothing from Google or PostHog. Change your choice at any time: Cookie settings

12. WhatsApp Business (Meta)

When an office connects its own WhatsApp Business number to Joy (in Meta's sign-up window), Joy receives through Meta's WhatsApp Business Platform the messages and files the office's clients send to that number, the sender's phone number and WhatsApp profile name, and the delivery status of the office's messages. Joy uses them only to show the conversation to the office, file it to the right client and matter, and send the replies, documents and reminders the office chooses. The office's WhatsApp access token is kept encrypted (AES-256-GCM) on Joy's servers (Netlify) and never reaches the browser. Joy does not sell this data, does not use it for advertising and does not train AI models on it. Meta processes the messages under its own terms and privacy policy. The office's administrator can disconnect the number at any time (WhatsApp → Disconnect): receiving and sending stop and the stored access token is deleted.
Deleting WhatsApp data: to delete WhatsApp messages and files Joy keeps, the office or the person who sent them writes to adir@joyworkos.com (subject "Delete my WhatsApp data", with the phone number). We delete them within 30 days and confirm by e-mail.

13. Mailing, newsletter and consent records

Joy sends advertising messages (newsletter, product news, the LEXADO NEWS digest, offers, and offers from the Joy ecosystem) only to people who agreed to receive that kind of message, and every sign-up is confirmed with a link sent to the address itself (double opt-in). As evidence of each consent, as section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law requires, Joy keeps: the address, what was agreed to, the exact wording shown, the page, the time, the IP address and browser, the confirmation click, every withdrawal and every message sent on that consent. The records are protected against alteration (a hash chain and a daily seal) and kept for seven years after the last message or withdrawal, then deleted. Every message has a one-click unsubscribe link and links to your preferences and to your own consent record; a withdrawal takes effect at once. Joy never gives your address to partners — ecosystem offers are sent by Joy. An office that sends its own campaigns through Joy decides what it sends and is the controller of its recipients' data; Joy keeps those consent records for it as its processor. Service messages about an account (security, billing) are not advertising and are sent when they are needed to provide the service.