Privacy Policy

Last updated: September 14, 2026

Who we are

Jackal AI ("we", "us") operates Popov, an AI sales assistant that helps small businesses run outreach and follow-up across email, phone, and WhatsApp. Popov is available at popov.thejackal.ai.

Contact for privacy questions: privacy@thejackal.ai.

Information we collect

Account information

Your name, email address, business name, and the details you provide while setting up Popov (your offering, target customers, and campaign goals).

Google user data

If you choose to connect your Google account, Popov accesses only the data listed in the table below, and only for the purposes stated.

Data	OAuth scope	Why	Stored	Retention
Email address, name	userinfo.email, userinfo.profile, openid	Identify which mailbox is connected and show it in Settings	Yes	Until you disconnect
Messages Popov sends	gmail.send	Send outreach and replies from your own address	Message body kept in the conversation record	90 days after the thread closes
Replies to Popov threads	gmail.readonly	Read the reply so Popov can draft the next response and update lead status	Message body kept in the conversation record	90 days after the thread closes
Read state and labels	gmail.modify	Mark handled replies as read and apply a "Popov" label	No	—
Calendar free/busy	calendar.readonly	Propose meeting times that don't clash with your schedule	No — queried live	—
OAuth tokens	—	Act on your behalf between sessions	Yes, encrypted	Deleted and revoked on disconnect

What Popov does not do with your Google data

Does not read, store, or process email outside threads Popov started or that you assigned to a campaign.
Does not permanently delete any message.
Does not create, edit, or delete calendar events.
Does not sell your data or use it for advertising.
Does not use your Google user data to train generalized AI or machine-learning models.
No person at Jackal AI reads your Google user data except with your explicit consent for support, to investigate a security incident, or where required by law.

Communication data from other channels

Where you enable them, Popov also processes phone call audio and transcripts, and WhatsApp messages associated with your campaigns.

Usage data

Log records of feature use, errors, and security events. Logs never contain passwords, OAuth tokens, or full message bodies.

How we use information

To run the features you ask for: sending outreach, reading replies to those threads, drafting responses, scheduling, and keeping your CRM current.
To authenticate you and keep your account secure.
To diagnose faults and improve reliability.
To contact you about your account.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Google API Services — Limited Use

Popov's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sub-processors

We use the following providers to operate Popov. Each is bound by contract to protect your data and process it only on our instructions.

Provider	Purpose	Region
Amazon Web Services	Hosting, database, encrypted storage	United States
Microsoft Azure (Azure OpenAI, Azure AI Foundry)	Generating drafts and summaries from conversation content; inputs are not used to train the providers' models	United States
Twilio	Phone calls and WhatsApp messaging	United States
ElevenLabs	Voice synthesis for outbound calls	United States

How we protect your data

TLS 1.2 or higher for all data in transit.
AES-256 encryption at rest for the database; OAuth tokens are additionally encrypted at the application layer.
Access limited to the minimum staff who need it, with multi-factor authentication on all administrative accounts.
Each customer's data is isolated by account, and every request is authorised server-side.
Annual independent security assessment under Google's Cloud Application Security Assessment (CASA) programme.

Retention and deletion

Conversation content is deleted 90 days after a thread closes.
Disconnecting Google revokes the token at Google immediately and deletes the stored credential.
Deleting your account removes all associated data within 30 days, except where we must retain records by law.

Your controls and rights

Disconnect Google: Popov → Settings → Gmail → Disconnect.
Revoke from Google: myaccount.google.com/permissions.
Delete your account: Settings → Delete account, or email privacy@thejackal.ai.
Access, correction, portability, objection: email us and we will respond within 30 days. If you are in the EEA or UK, these rights arise under the GDPR; if you are in California, under the CCPA/CPRA.

International transfers

Our infrastructure is hosted in the United States. If you use Popov from outside the United States, your data will be transferred there, protected by Standard Contractual Clauses or an equivalent mechanism where required.

Children

Popov is a business product and is not directed to anyone under 16. We do not knowingly collect data from children.

Changes to this policy

We will update the date above when this policy changes and, for material changes affecting Google user data, notify you by email before the change takes effect.

Contact

Jackal AI — privacy@thejackal.ai