Junglewise Privacy Policy

Effective Date: 9 October 2026 | Version: 1.3

Operated by Releaseworks Ltd (company number 11706057)
Registered office: 20-22 Wenlock Road, London N1 7GU, United Kingdom

1. Introduction and Who We Are

Releaseworks Ltd ("Releaseworks", "we", "us", or "our") operates the Junglewise security platform, accessible at junglewise.ai and via associated services and APIs (collectively, the "Platform").

We are the data controller for the personal data we collect and process in connection with the Platform. This means we are responsible for deciding how and why your personal data is used.

This Privacy Policy explains:

• what personal data we collect about you and why;
• the legal basis on which we process it;
• who we share it with;
• how long we keep it; and
• your rights in relation to it.

This policy applies to users of the Platform, visitors to junglewise.ai, and anyone who contacts us. It should be read alongside our Terms & Conditions.

If you have any questions about this policy or how we handle your data, please contact us at privacy@junglewise.ai.

2. Data We Collect and Why

2.1 Account Registration Data

There are no passwords on the Platform. You sign in with a one-time code sent to your email address, a passkey held by your own device, or a Google account. When you create an account we collect:

We do not collect payment card details directly. Payment information is processed by Stripe on our behalf (see Section 5).

2.1a Sign-up Funnel Data

To understand where the sign-up journey works and where it does not, we record which of its steps you reach: a scan started, its result viewed, an account created, a source connected, a card added, and a trial converted or ended. Before you sign in these events are keyed by a random identifier held in your browser, which also lets us attach a scan you ran before signing in to the workspace you then create. These records are held only by us, are not shared with any advertising or analytics provider, and are necessary to operate the sign-up journey, so they are processed on the basis of our legitimate interests rather than consent.

2.2 Billing and Transaction Data

When you purchase Credits or a Subscription, we collect:

2.3 Platform Usage Data

When you use the Platform, we automatically collect certain technical and usage data:

This data is collected in anonymized or pseudonymized form where possible and is not used to personally profile you.

2.4 Analytics Data

We count visits to our website without cookies: the address and browser of each visit are hashed with a key that is discarded daily, so a visit cannot be tied to a person or matched across days. This is processed on the basis of our legitimate interests.

Where we use Google Analytics to collect aggregated data about how users interact with the Platform and our website, this may include:

• pages visited and time spent on each;
• navigation paths through the Platform;
• device type, browser, and operating system;
• geographic region (country/city level); and
• referral source (how you arrived at the Platform).

This data is collected via cookies and similar tracking technologies. If you are in the United Kingdom, the European Economic Area or Switzerland, the legal basis for this processing is your consent, which you provide via our cookie consent banner, and nothing is collected until you give it. Elsewhere, these cookies are on from your first visit, the banner tells you so, and we rely on our legitimate interests in understanding how our website is used; you can switch them off at any time (see Section 3.3). You may withdraw consent at any time (see Section 6).

Google Analytics data is subject to Google's own privacy practices. For more information, see Google's Privacy Policy.

2.5 Advertising and Marketing Data

We run advertising campaigns via Google Ads, LinkedIn Ads, Meta (Facebook and Instagram) and Reddit Ads. To measure the effectiveness of these campaigns and to show you relevant advertising on those platforms, including adverts for Junglewise after you have visited our website (retargeting), these platforms may collect data about your interactions with our website via tracking pixels and cookies:

• the Meta Pixel, the Reddit Pixel and the LinkedIn Insight Tag record the pages you visit on our public website, together with your IP address, browser information and a cookie that identifies your browser, and send them to Meta, Reddit and LinkedIn respectively; the Meta Pixel also records when you start a scan, together with the address of the page you started it from, which can include the domain you entered;
• Google Ads receives a conversion when an account is created or a card is added.

Advertising pixels and cookies are used on our public website and sign-up pages only. They are never active inside the signed-in Platform.

If you are in the United Kingdom, the European Economic Area or Switzerland, the legal basis for this processing is your consent, provided via our cookie consent banner: no pixel loads and no conversion is reported until you have accepted marketing cookies. Elsewhere, the pixels run from your first visit, the banner tells you so, and we rely on our legitimate interests in promoting our services; you can switch marketing cookies off at any time (see Section 3.3), after which the pixels stop collecting.

You can also manage your advertising preferences directly:

• Google Ads: Google Ad Settings
• LinkedIn Ads: LinkedIn Ad Preferences
• Meta: Meta Ad Preferences
• Reddit: Reddit Privacy Settings

2.6 Customer Data You Provide to the Platform

In the course of using the Platform, you may submit or instruct us to ingest data, including via Integrations (such as code repositories, cloud platforms, or internal systems). As described in our Terms & Conditions, you are responsible for ensuring that this data does not contain Personal Data as defined under the GDPR, unless Releaseworks has explicitly requested it.

To the extent that Customer Data you provide inadvertently contains Personal Data, we will process that data solely to provide the Services to you. We will not use it for any other purpose, and you remain the data controller for such data with Releaseworks acting as a data processor in that limited capacity.

2.7 Support and Communications Data

When you contact us — by email, via the Platform, or otherwise — we collect and retain:

• your name and contact details;
• the content of your communications; and
• records of our responses.

This data is used to resolve your query, maintain a record of our interactions, and improve our support services. The legal basis is our legitimate interests in providing effective customer support.

3. Cookies

3.1 What Are Cookies

Cookies are small text files placed on your device by a website. We use cookies on junglewise.ai and on the Platform to make the services work correctly and to help us understand how they are used.

3.2 Types of Cookies We Use

3.3 Managing Your Cookie Preferences

What happens before you have made a choice depends on where you are, which we read from the country your connection comes from:

• United Kingdom, European Economic Area and Switzerland: when you first visit our website, a cookie banner asks you to choose. No analytics or advertising cookie is set, and no pixel loads, until you accept. You can accept all, reject all non-essential cookies, or choose by category.
• Everywhere else: analytics and advertising cookies are on from your first visit. The banner tells you so and lets you manage them, and you can switch either category off at any time.
• Where we cannot tell where you are, we treat you as if you were in the United Kingdom.

Once you have made a choice it applies wherever you are, until you change it. You can update your preferences at any time via the cookie settings link in the footer of our website. Advertising cookies and pixels are never active inside the signed-in Platform, whatever your choice.

You may also control cookies through your browser settings. Note that disabling strictly necessary cookies may impair the functionality of the Platform.

4. Legal Bases for Processing

Under UK GDPR, we must have a legal basis for processing your personal data. The legal bases we rely on are:

• Performance of a contract — processing necessary to provide the Platform and Services you have signed up for.
• Legal obligation — processing required to comply with laws we are subject to, such as financial record-keeping requirements.
• Legitimate interests — processing for our legitimate business interests, such as security monitoring, fraud prevention, and service improvement, where these are not overridden by your rights and interests.
• Consent — processing for analytics and advertising cookies for visitors in the United Kingdom, the European Economic Area and Switzerland, where you have given your explicit consent via our cookie banner. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. For visitors elsewhere we rely on our legitimate interests for these cookies, with the ability to switch them off at any time (see Section 3.3).

5. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

We share personal data with the following categories of third-party service providers ("sub-processors") who process data on our behalf and under our instruction:

All sub-processors are required to handle your data in accordance with applicable data protection law and are bound by appropriate data processing agreements.

We may also disclose your personal data where required to do so by law, court order, or at the request of a competent regulatory authority.

6. International Data Transfers

Some of our sub-processors are located in, or process data in, countries outside the United Kingdom and the European Economic Area (EEA), including the United States.

Where we transfer personal data to countries that do not provide an equivalent level of data protection, we rely on appropriate safeguards to ensure your data remains protected. These safeguards include:

• UK International Data Transfer Agreements (IDTAs) or the EU Standard Contractual Clauses (SCCs) incorporated into our agreements with sub-processors; and
• transfers to organizations that participate in recognized adequacy frameworks, where applicable.

You may request a copy of the relevant transfer mechanism by contacting us at privacy@junglewise.ai.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with our legal obligations. Our standard retention periods are:

Where you request deletion of your data (see Section 8), we will action that request subject to any legal obligations that require us to retain certain records for a defined period (for example, financial records under the Companies Act 2006).

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request that we correct inaccurate or incomplete data.
• Right to erasure — you may request that we delete your personal data, subject to legal retention obligations.
• Right to restriction — you may request that we restrict processing of your data in certain circumstances.
• Right to data portability — you may request that we provide your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making — you have the right not to be subject to decisions made solely by automated means that produce legal or similarly significant effects, where applicable.
• Right to withdraw consent — where processing is based on consent (e.g. analytics and advertising cookies), you may withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, please contact us at support@junglewise.ai. We will respond within one calendar month. In complex cases we may extend this by a further two months, in which case we will notify you.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Telephone: 0303 123 1113

If you are located in the EU, you may also contact your local data protection supervisory authority.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include:

• encryption of data in transit (TLS) and at rest;
• access controls and authentication via Supabase;
• regular security assessments and monitoring; and
• staff and contractor training on data protection obligations.

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you without undue delay.

10. Children

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at privacy@junglewise.ai and we will delete it promptly.

11. Links to Third-Party Sites

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will show a prominent notice on the Platform, and where the change affects how we use the data of account holders we will email the owners of each workspace, before the change takes effect. The date at the top of this policy indicates when it was last updated. Your continued use of the Platform following notification of changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your data, please contact us:

This Privacy Policy was last updated on 8 October 2026 and is effective immediately.

© Releaseworks Ltd. All rights reserved.