Privacy Policy

Effective Date: September 28, 2026

Deyra is operated by Five Jars Corp (“Five Jars,” “we,” “our,” or “us”). This Privacy Policy explains our personal-information practices across Deyra’s websites, products, applications, APIs, integrations, and related services (the “Platform”). It applies across the Deyra product family; provisions about AI apply only where the relevant Service uses AI Features. Capitalized terms such as Customer Data, Authorized User, End User, and AI Features have the meanings in our Terms & Conditions.

Whose Information We Process and Our Role

• Website Visitors: People who visit our websites, request information, or contact us. We determine how their information is used for website operation, communications, and managing inquiries.
• Customer Representatives and Administrators: Business contacts, billing contacts, account owners, and administrators. We process their contact, account, and transaction information to manage our business relationship with Customer.
• Authorized Users: Customer staff and other authorized representatives using the Services or administration tools. We process account and operational information for authentication, security, support, and service administration.
• End Users: People interacting with a Customer’s embedded or customer-facing Deyra implementation. Depending on the enabled functions, information may include searches, filter selections, queries, conversations, submitted forms, and interaction or technical data.
• Customer Data Subjects: People whose information appears in Customer’s connected systems, uploaded files, knowledge sources, or other Customer Data, even if they never directly use Deyra.

We generally act as a controller or business for personal information used to operate our website and manage our own business relationships. When processing personal information in Customer Data on Customer’s behalf, we act as a processor or service provider, as applicable, following Customer’s instructions and the applicable agreement, including an executed data processing agreement (DPA). The role depends on the processing purpose, not solely on the person’s category: the same individual may fall into more than one category.

For Customer-directed processing, Customer’s privacy notices explain its purposes, lawful basis, and deployment choices. This Policy does not replace those notices or an executed DPA. Each party remains responsible for the duties imposed on it by applicable law.

Information We Collect

The categories collected depend on the Services and features used:

• Contact and account information: Name, business email, phone number, company, job title, billing contacts, account credentials, authentication information, and permissions.
• Billing and transaction information: Billing details, payment information, invoices, receipts, and transaction records.
• Communications: Inquiries, support requests, feedback, and related correspondence.
• Customer Data: Content and records uploaded, connected, or submitted by or on behalf of Customer, including information in connected systems, files, knowledge sources, forms, searches, and, where applicable, prompts and conversations. This may include personal information about End Users or other Customer Data Subjects.
• Service configuration and usage information: Integration settings, connection parameters, data schemas, feature interactions, API activity, performance metrics, diagnostics, and error or security logs.
• Device and website information: IP address, browser and operating-system details, device identifiers, network information, cookie data, and website interactions.

Information comes from individuals, Customers and their Authorized Users, Customer-authorized connected sources, and the operation of the Services. Connecting a source does not mean every record in that source is collected; the information processed depends on the integration, permissions, and configuration.

How We Use Information

We use information to provide and support the Services selected by Customer, including searching, displaying, organizing, synchronizing, analyzing, or otherwise processing data as configured. AI processing applies only when the relevant AI Features are enabled or used.

We also use information to manage accounts and permissions; process billing; respond to inquiries; send service and security notices; troubleshoot and secure the Platform; detect misuse; comply with legal obligations; and understand and improve Platform operation. Customer Data is processed for Customer-directed service purposes under the Agreement, not under an unrestricted right to reuse its content for our own purposes.

Where data-protection law requires a lawful basis for processing for our own purposes, we rely, as applicable, on performing a contract with the individual, legitimate interests in operating and securing our business and communicating with business contacts, legal obligations, or consent. Where we rely on consent, it may be withdrawn. Customer is responsible for establishing the lawful basis for its instructions to us; this does not remove obligations that apply directly to Five Jars.

AI Processing, Training, and Operational Telemetry

Delivering AI Features: Where AI Features are used, relevant queries, prompts, conversation context, retrieved content, and related Customer Data may be processed to produce outputs and maintain the configured experience. This may involve third-party AI providers acting on our behalf. Retrieval, indexing, creating embeddings, and processing inputs for inference are service-delivery activities and do not themselves mean that Customer Data is used to train a shared model.

Training restrictions: We do not use Customer Data, including End User conversation content, to train shared or general-purpose AI models without Customer’s express authorization and any legally required permissions. We do not authorize our subprocessors to use that content for such training without the same authorization. These restrictions also apply to content derived from Customer Data; de-identifying content does not itself authorize training. Customer-specific training or fine-tuning requires separate express authorization. Merely using the Services, providing a support example, or accepting an updated Privacy Policy is not authorization for training.

Operational improvement: We may use aggregated or de-identified operational telemetry, such as feature counts, latency, error rates, and resource usage, to operate, secure, and improve the Platform. This permission does not extend to reusing Customer content or conversation text for shared model training. De-identified telemetry must not identify Customer or any individual, and we do not attempt to re-identify it.

Access and provider handling: Customer Data is subject to access controls. We do not share Customer’s query or conversation content with other customers. Data disclosed through Customer’s own public-facing configuration remains governed by that configuration. Provider processing and retention depend on the relevant Service, applicable agreements, and configuration; a restriction on training does not mean that providers retain no data for service delivery, security, or legal compliance.

Cookies and Tracking Technologies

Our websites use cookies and similar technologies for essential functions, performance measurement, and, where enabled, marketing. Essential cookies support website operation; performance cookies help us understand site usage; marketing cookies may support advertising. We obtain consent where required by applicable law.

You can control cookies through browser settings and any consent controls made available on the website. Disabling cookies may affect functionality. A Customer’s website may use its own cookies and analytics alongside an embedded Deyra Service; the Customer’s notices and controls apply to those separately managed technologies.

Sharing of Information and Providers

We do not sell, rent, or trade personal information. We disclose information for the following purposes:

• Service providers and subprocessors: Infrastructure, hosting, support, payment, analytics, and other providers help us operate the Platform. AI providers process relevant data only for applicable AI Features. When providers process Customer personal data on our behalf, they act as subprocessors under confidentiality, security, and data-processing obligations appropriate to their work. Processing for our own account or billing purposes may involve service providers acting in other roles under applicable law.
• Customer-directed access and integrations: Information may be made available to Customer, its Authorized Users, and integrations or destinations it authorizes. Customer controls the visibility and publication of information through its deployment.
• Legal and safety purposes: We may disclose information as required by law or valid legal process, or as permitted by law to protect rights, safety, and security or address fraud and abuse.
• Business transfers: Information may be transferred in connection with a merger, acquisition, or sale of assets, subject to applicable data-protection obligations.
• With authorization or consent: Other disclosures may occur at the individual’s or Customer’s direction, subject to applicable law and the Agreement.

Providers vary by Service and configuration; not every Customer’s data is sent to every provider. Information about the providers used for a particular Service, processing purposes, and applicable locations is available at [email protected]. Subprocessor authorization, change notices, objections, and international-transfer arrangements are governed by any executed DPA. We do not replace those protections with provider consumer terms or privacy policies.

Customer-selected services connected under Customer’s own accounts are distinct from providers engaged by Five Jars. Their independent processing is subject to their own terms and privacy notices.

Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest, access controls, security monitoring, and incident-response procedures. Applicable contractual security and breach-notification obligations are governed by the Agreement and any executed DPA. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

Your Rights and Choices

Depending on your location and the applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; and challenge certain solely automated decisions. You may also have the right to complain to a competent data-protection authority. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

For information we process for our own purposes, contact [email protected]. We may need to verify your identity and will respond within the period required by applicable law.

For information processed on a Customer’s behalf, including information in its implementation or connected records, contact that Customer first. If you contact us, we will route or assist with the request as appropriate under the Agreement and applicable law. We do not independently change or delete Customer-controlled records contrary to lawful Customer instructions. Customer administrators can contact support about available data controls and contractual requests.

Data Retention

Retention depends on the category, purpose, service configuration, applicable agreement, and legal requirements:

• Account and business records: Account information is retained while the account is active. Relevant billing, tax, and legal records may be retained for up to seven years after closure where needed for those purposes; this is not a blanket retention period for Customer content or conversations.
• Platform usage and security data: Retained for up to two years for service operation, improvement, and security, unless a shorter contractual period or longer legal requirement applies.
• Customer Data, including conversation content: Retained according to the applicable Order Form, executed DPA, and documented service configuration. Export, return, and deletion on termination follow those arrangements; no indefinite account-reactivation period is promised.
• Backups: Deleted through applicable backup cycles, subject to the Agreement and any executed DPA. Data awaiting backup deletion remains protected and is not used for other purposes.
• Support and communications: Retained for up to three years for support and legal purposes, subject to applicable contractual requirements for any Customer Data included in them.

We may retain information longer where legally required, including for a legal hold, and limit its use to the relevant purpose. Service-specific retention details, including available conversation-log settings and backup cycles, can be requested at [email protected]. The Terms’ data-retention provisions and this Policy do not override an executed DPA.

International Data Transfers

Information may be processed in countries other than the individual’s country of residence. Where required, we use applicable transfer safeguards, such as adequacy decisions or Standard Contractual Clauses. Any agreed data-location or transfer restrictions in an executed DPA apply. Contact [email protected] for information about transfers relevant to your Service.

Children’s Privacy

Deyra business account holders and administrators must be at least 18. Customer-facing Services may be made available to End Users of different ages, and Customer Data may include information about children supplied by Customer or an adult. This does not mean every Deyra Service is designed or approved for children.

Customer must assess whether its deployment is appropriate for minors and implement age-appropriate notices, safeguards, supervision, and any legally required parental consent. A deployment directed to children under 13, or involving knowing online collection of personal information from children under 13, requires Five Jars’ prior written approval and documented data-processing and consent arrangements under the AUP. Where applicable law protects children at a different age, that law also applies. Approval does not replace required notice, verifiable parental consent, or any other legal obligation.

Five Jars remains responsible for any children’s-privacy obligations that apply directly to it; these cannot be transferred away merely by assigning responsibilities to Customer. If you believe a Service has collected a child’s personal information without the required authorization, contact [email protected] and, where relevant, the Customer operating the Service. We will investigate and take appropriate steps, including restricting processing or deleting information as required by applicable law and the relevant agreements.

Changes to This Privacy Policy

We may update this Policy and will communicate material changes by email or platform notification at least 30 days before they take effect, except where law requires an earlier change. We will obtain consent or other authorization where required for a new processing purpose. Continued use alone does not authorize AI training or override an executed DPA. Updates do not retroactively authorize incompatible uses of previously collected information.

Contact Us

Five Jars Corp (dba Deyra)

• Email: [email protected]
• Website: deyra.ai
• Address: 2300 Wilson Blvd, Suite 700, Arlington, VA 22201

For data-protection inquiries or rights requests, use the same email and identify the relevant Customer or Service where possible.