Privacy Policy

Last updated: 21 October 2026 Effective date: 21 October 2026

This Privacy Policy explains how Jaja, trading as Jajasoft ("Maseju", "we", "us", "our"), collects, uses, shares, and protects your personal data when you use the Maseju application and website (the "Service"). We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR).

1. Who we are

Maseju is run by Jaja, an individual based in the Netherlands, under the trading name Jajasoft. Jajasoft is not yet registered with the Dutch Chamber of Commerce (KVK); we will update this policy when it is.

• Privacy contact: privacy@maseju.com

You can contact us at any time using the details above for any question about this policy or your personal data.

2. What this policy covers

This policy covers the Maseju web application, the installable app version, the emails we send, and the maseju.com website, including the beta waitlist. It does not cover third-party services we link to (for example, articles we recommend, which open in your browser), which are governed by their own policies.

3. The data we collect

We collect only what we need to provide your briefings.

a) Waitlist data (if you request a beta invite on our website)

• Your email address and which calendar you use (Google, Outlook, or other).

b) Account and identity data (from Google or Microsoft when you sign in)

• Your name, email address, and account identifier.
• A profile picture, if your account provides one.

c) Google Calendar data (only with your consent)

• Event titles, descriptions, dates and times, locations, and meeting links.
• Attendee names and email addresses contained in your events.
• The names of the calendars the events belong to.

We request two calendar scopes:

• https://www.googleapis.com/auth/calendar.readonly to read your events.
• https://www.googleapis.com/auth/calendar.events to create focus blocks in your calendar. We only create a focus block when you ask for it, and we only ever change or delete focus blocks that Maseju created. We never change or delete your other events.

d) Gmail data (read-only, only with your consent)

• Unread messages in your Primary inbox from the last 30 days, including sender, subject, date, and message body.
• We request the https://www.googleapis.com/auth/gmail.readonly scope. Access is read-only: we never send, modify, label, or delete your email.
• Email bodies are processed on our servers by the AI to surface action items. Raw message bodies are never stored in our database and are never sent to your browser. Only the AI-distilled action items (suggested next step, drafted reply) are saved alongside your briefing.

e) Microsoft Outlook data (read-only, only if you connect a Microsoft account)

• Calendar events and unread email, of the same kinds as described for Google in (c) and (d).
• We request the Microsoft Graph permissions User.Read, Calendars.Read, Mail.Read, and offline_access. Access is read-only: we never create, change, or delete Outlook events or email.
• The same rule applies as for Gmail: raw email bodies are never stored.

f) Data you create in the Service

• Generated briefings and their archive.
• Your goals and priorities, action items, focus blocks, event preferences (for example priority and location overrides), and feedback you give to tune your results.

g) Usage and analytics data

• Pages you visit, buttons you click, and when you leave a page, together with your browser and device type and approximate location derived from your IP address.
• No analytics cookies: we do not store analytics identifiers on your device. A random identifier is kept in memory only while the page is open and is gone when you close the tab. We never record your screen.
• After you sign in, this usage data is linked to your internal account identifier (not your name or email address) so we can understand how the Service is used and improve it.

h) Technical and diagnostic data

• Crash and error reports, which may include an error message, the app screen involved, your browser or device type (user agent), and a technical component trace. These may be collected even before you sign in, to help us fix faults.

We do not intentionally collect special categories of data (health, religion, and so on). Because briefings are generated from your calendar and inbox, please be aware that any such information in your events or emails will be processed as part of the Service.

4. How we use your data and our legal basis

You may withdraw your consent to calendar or email access at any time (see Section 9), without affecting processing that already took place.

5. AI processing: important disclosure

To generate your briefings and suggestions, we send the content of your upcoming calendar events (titles, descriptions, times, locations, and attendee names and emails) and, for the daily brief, the sender, subject, date, and body of unread inbox messages from the last 30 days to a large language model: Claude, by Anthropic.

This happens when you generate a briefing yourself, and automatically early each morning for your daily brief (and on Sunday for your weekly review), so the brief is ready when you start your day.

• The model uses your event and email data to produce that briefing and nothing else.
• Raw email bodies are never stored in our database. Only the AI-distilled action items (suggested next step, drafted reply) are saved alongside the briefing. Raw email content is also never sent to your browser.
• We do not use your data to train AI models. Anthropic does not use content sent through its commercial API to train its models.
• The generated briefing is stored in your private archive in our database until you delete it.
• Meeting-prep lookups: when preparing your brief we may look up the company (and, if you opt in from Settings, the person) tied to a meeting attendee's work email in public web sources, using Anthropic's web search tool. Only the distilled context (company name, one-line description, optional recent news, person role) is cached, never raw pages. Company lookups are always on; person lookups are off by default.

6. Google API Services: Limited Use disclosure

Maseju's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We only use Google Calendar data (calendar.readonly and calendar.events scopes) and Gmail data (gmail.readonly scope) to provide and improve the user-facing features of Maseju: generating your briefings, surfacing email action items, and creating the focus blocks you ask for.
• We do not transfer or sell this data to third parties for advertising, marketing, or any other purpose.
• We do not use this data for advertising.
• We do not use Gmail or Calendar data to train AI or machine-learning models, and we do not permit our AI provider to do so.
• We do not allow humans to read this data, except: (a) with your explicit consent, (b) for security purposes (for example investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised.

7. Who we share data with (sub-processors)

We do not sell your personal data. We share it only with the service providers that power Maseju, acting as our processors:

When you connect them, we also exchange data with Google (sign-in, Google Calendar, and Gmail) and Microsoft (sign-in, Outlook calendar, and mail). They are the source of your data and act under their own terms and privacy policies.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service.

8. International data transfers

Some of our providers process data outside the European Economic Area (EEA), including in the United States (see the table in Section 7). Where this happens, we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses (SCCs). You can request a copy of the relevant safeguards using the contact details in Section 1.

9. Your rights, and how to exercise them

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time.

You can exercise the main rights directly in the app:

• Export your data: Settings, then "Export my data" (downloads your briefings and related data as a file).
• Delete your account and all associated data: Settings, then "Delete my account".
• Stop briefing emails: use the unsubscribe link in any briefing email, or switch them off in Settings.
• Revoke Maseju's Google access (Calendar and Gmail) at any time at myaccount.google.com/permissions.
• Revoke Maseju's Microsoft access at any time at myapps.microsoft.com (work or school accounts) or account.live.com/consent/Manage (personal accounts), or disconnect Microsoft in Settings.

For any other request, including removal from the waitlist, contact us at privacy@maseju.com. We will respond within one month. You also have the right to lodge a complaint with your local supervisory authority. In the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

10. How long we keep your data

• Briefings and data you create: kept until you delete them or close your account.
• Account data: kept while your account is active; deleted when you delete your account.
• Waitlist data: kept until you are invited or ask us to remove it.
• Crash and diagnostic logs: kept for a maximum of 30 days, then automatically deleted.
• Analytics data: kept by PostHog in line with our retention settings, and deleted on request.

When you delete your account, we permanently delete your personal data from our active systems, except where we must retain limited information to comply with a legal obligation.

11. Security

We protect your data with industry-standard measures, including encryption in transit (HTTPS/TLS), a Content Security Policy that limits which scripts can run on our pages, row-level access controls that isolate each user's data, and storing sensitive credentials (such as Google and Microsoft refresh tokens) only on our servers, never in your browser. No system is perfectly secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

12. Automated decision-making

Maseju uses AI to generate informational briefings. These briefings are advisory only. We do not make decisions that produce legal or similarly significant effects about you solely by automated means (GDPR Art. 22). You are always responsible for any actions you take based on a briefing.

13. Children

Maseju is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the "Last updated" date. If the changes are significant, we will notify you in the app.

15. Contact

Questions or requests about your data: privacy@maseju.com Jaja, trading as Jajasoft, the Netherlands.