Junglewise Privacy Policy

Effective Date: 13 May 2026 | Version: 1.0

Operated by Releaseworks Ltd (company number 11706057)
Registered office: 20-22 Wenlock Road, London N1 7GU, United Kingdom

1. Introduction and Who We Are

Releaseworks Ltd ("Releaseworks", "we", "us", or "our") operates the Junglewise AI security platform, accessible at junglewise.ai and via associated services and APIs (collectively, the "Platform").

We are the data controller for the personal data we collect and process in connection with the Platform. This means we are responsible for deciding how and why your personal data is used.

This Privacy Policy explains:

• what personal data we collect about you and why;
• the legal basis on which we process it;
• who we share it with;
• how long we keep it; and
• your rights in relation to it.

This policy applies to users of the Platform, visitors to junglewise.ai, and anyone who contacts us. It should be read alongside our Terms & Conditions.

If you have any questions about this policy or how we handle your data, please contact us at privacy@junglewise.ai.

2. Data We Collect and Why

2.1 Account Registration Data

When you create an account on the Platform, we collect:

We do not collect payment card details directly. Payment information is processed by Stripe on our behalf (see Section 5).

2.2 Billing and Transaction Data

When you purchase Credits or a Subscription, we collect:

2.3 Platform Usage Data

When you use the Platform, we automatically collect certain technical and usage data:

This data is collected in anonymised or pseudonymised form where possible and is not used to personally profile you.

2.4 Analytics Data

We use Google Analytics and Lovable Analytics to collect aggregated data about how users interact with the Platform and our website. This may include:

• pages visited and time spent on each;
• navigation paths through the Platform;
• device type, browser, and operating system;
• geographic region (country/city level); and
• referral source (how you arrived at the Platform).

This data is collected via cookies and similar tracking technologies. The legal basis for this processing is your consent, which you provide via our cookie consent banner. You may withdraw consent at any time (see Section 6).

Google Analytics data is subject to Google's own privacy practices. For more information, see Google's Privacy Policy.

2.5 Advertising and Marketing Data

We run advertising campaigns via Google Ads and LinkedIn Ads. To measure the effectiveness of these campaigns and to show you relevant advertising, these platforms may collect data about your interactions with our website via tracking pixels and cookies.

The legal basis for this processing is your consent, provided via our cookie consent banner. If you do not consent to marketing cookies, advertising tracking will not be activated.

You can also manage your advertising preferences directly:

• Google Ads: Google Ad Settings
• LinkedIn Ads: LinkedIn Ad Preferences

2.6 Customer Data You Provide to the Platform

In the course of using the Platform, you may submit or instruct us to ingest data, including via Integrations (such as code repositories, cloud platforms, or internal systems). As described in our Terms & Conditions, you are responsible for ensuring that this data does not contain Personal Data as defined under the GDPR, unless Releaseworks has explicitly requested it.

To the extent that Customer Data you provide inadvertently contains Personal Data, we will process that data solely to provide the Services to you. We will not use it for any other purpose, and you remain the data controller for such data with Releaseworks acting as a data processor in that limited capacity.

2.7 Support and Communications Data

When you contact us — by email, via the Platform, or otherwise — we collect and retain:

• your name and contact details;
• the content of your communications; and
• records of our responses.

This data is used to resolve your query, maintain a record of our interactions, and improve our support services. The legal basis is our legitimate interests in providing effective customer support.

3. Cookies

3.1 What Are Cookies

Cookies are small text files placed on your device by a website. We use cookies on junglewise.ai and on the Platform to make the services work correctly and to help us understand how they are used.

3.2 Types of Cookies We Use

3.3 Managing Your Cookie Preferences

When you first visit the Platform or our website, you will be presented with a cookie consent banner. You can choose to accept or decline non-essential cookies at that point.

You can update your preferences at any time via the cookie settings link in the footer of our website.

You may also control cookies through your browser settings. Note that disabling strictly necessary cookies may impair the functionality of the Platform.

4. Legal Bases for Processing

Under UK GDPR, we must have a legal basis for processing your personal data. The legal bases we rely on are:

• Performance of a contract — processing necessary to provide the Platform and Services you have signed up for.
• Legal obligation — processing required to comply with laws we are subject to, such as financial record-keeping requirements.
• Legitimate interests — processing for our legitimate business interests, such as security monitoring, fraud prevention, and service improvement, where these are not overridden by your rights and interests.
• Consent — processing for analytics and advertising cookies, where you have given your explicit consent via our cookie banner. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

We share personal data with the following categories of third-party service providers ("sub-processors") who process data on our behalf and under our instruction:

All sub-processors are required to handle your data in accordance with applicable data protection law and are bound by appropriate data processing agreements.

We may also disclose your personal data where required to do so by law, court order, or at the request of a competent regulatory authority.

6. International Data Transfers

Some of our sub-processors are located in, or process data in, countries outside the United Kingdom and the European Economic Area (EEA), including the United States.

Where we transfer personal data to countries that do not provide an equivalent level of data protection, we rely on appropriate safeguards to ensure your data remains protected. These safeguards include:

• UK International Data Transfer Agreements (IDTAs) or the EU Standard Contractual Clauses (SCCs) incorporated into our agreements with sub-processors; and
• transfers to organisations that participate in recognised adequacy frameworks, where applicable.

You may request a copy of the relevant transfer mechanism by contacting us at privacy@junglewise.ai.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with our legal obligations. Our standard retention periods are:

Where you request deletion of your data (see Section 8), we will action that request subject to any legal obligations that require us to retain certain records for a defined period (for example, financial records under the Companies Act 2006).

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request that we correct inaccurate or incomplete data.
• Right to erasure — you may request that we delete your personal data, subject to legal retention obligations.
• Right to restriction — you may request that we restrict processing of your data in certain circumstances.
• Right to data portability — you may request that we provide your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making — you have the right not to be subject to decisions made solely by automated means that produce legal or similarly significant effects, where applicable.
• Right to withdraw consent — where processing is based on consent (e.g. analytics and advertising cookies), you may withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, please contact us at support@junglewise.ai. We will respond within one calendar month. In complex cases we may extend this by a further two months, in which case we will notify you.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Telephone: 0303 123 1113

If you are located in the EU, you may also contact your local data protection supervisory authority.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• encryption of data in transit (TLS) and at rest;
• access controls and authentication via Supabase;
• regular security assessments and monitoring; and
• staff and contractor training on data protection obligations.

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you without undue delay.

10. Children

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at privacy@junglewise.ai and we will delete it promptly.

11. Links to Third-Party Sites

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will notify you by email or via a prominent notice on the Platform prior to the change taking effect. The date at the top of this policy indicates when it was last updated. Your continued use of the Platform following notification of changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your data, please contact us:

This Privacy Policy was last updated on 13 May 2026 and is effective immediately.

© Releaseworks Ltd. All rights reserved.