Privacy Policy

This policy explains what information Mojo Systems LLC collects when you use our software, why we collect it, and the choices you have. We've tried to write it in plain language. If anything is unclear, email [email protected].

1. Who we are

Mojo Systems LLC ("Mojo Systems," "we," "us," or "our") is a Pennsylvania limited liability company that provides software for lead capture, customer relationship management (CRM), field operations check-in, and related business workflows ("Services").

Our customers ("Account Holders") use the Services to run their own businesses. When an Account Holder's customer or employee interacts with the Services — for example, by submitting a lead form or checking in to a job site — that data belongs to the Account Holder and is processed by us on their behalf. This policy describes both our practices as a service provider to our Account Holders and our direct relationship with anyone who visits our website or uses the Services.

2. Information we collect

Information you give us

• Account information. When you sign up, we collect your name, email address, and a hashed password. If you upload contact details (your "vCard"), we collect job title, phone number, company name, website, and address.
• Payment information. If you subscribe to a paid plan, our payment processor collects your billing information directly. We do not store full credit card numbers.
• Communications. If you contact us by email, we keep that correspondence so we can respond and improve our service.

Information collected through the Services

• Lead and contact data. When end users submit a lead form created by an Account Holder, the form fields (typically name, email, phone, company, message) are stored under that Account Holder's data.
• Third-party sign-in (optional fast-fill). An Account Holder's capture page may offer the option to fill the form using a third-party identity provider (Apple, Google, or LinkedIn). If an end user chooses one of these buttons, the provider sends us a limited set of profile information — typically name, email address, profile picture URL, and (for LinkedIn) a public profile URL — based on the consent the end user gives in the provider's authorization screen. We use this information solely to pre-fill the capture form and pass the resulting submission to the Account Holder. We do not store the provider's access token after the form is submitted, and we do not write any information back to the provider.
• Field check-in data. If the Account Holder uses our check-in product, we collect the check-in time, approximate geolocation (when the device permits), the user's identity, and any photo or note they attach. SMS messages sent through the dispatch flow are stored.
• Inbox sync. If an Account Holder connects an email inbox, we periodically read messages relevant to leads (subject, sender, body, timestamps) so the conversation history can be displayed in the CRM.

Information collected automatically

• Log and device data. IP address, browser type, operating system, request paths, timestamps, referring URL.
• Cookies. A session cookie keeps you logged in. See cookies below.

3. How we use information

• To provide, maintain, and improve the Services.
• To authenticate users and protect against fraud and abuse.
• To communicate with you about your account, including transactional notifications, security alerts, and product updates.
• To respond to support requests.
• To comply with legal obligations.

We do not sell your personal information. We do not use your account data, lead data, or message content to train artificial intelligence models.

4. SMS & phone numbers

Our field check-in product uses SMS to coordinate dispatch and check-in workflows on behalf of Account Holders.

Consent and opt-in

An Account Holder collects opt-in consent from each individual before sending them SMS through the platform. We rely on the Account Holder's representation that they have obtained appropriate consent. Recipients can stop receiving messages at any time by replying STOP. Replying HELP returns contact information for support.

Frequency and cost

Message frequency varies based on operational activity. Standard message and data rates may apply per the recipient's wireless carrier. Mojo Systems is not responsible for carrier charges.

Carriers and delivery

Wireless carriers (including AT&T, T-Mobile, Verizon, and US Cellular) are not liable for delayed or undelivered messages. SMS service availability depends on carrier coverage and recipient device capability.

5. How we share information

We share information only as follows:

• With service providers ("subprocessors") who help us operate the Services. All Customer Data is stored in the United States. Current subprocessors, with where they process data, include:
  • DigitalOcean — cloud hosting and infrastructure (United States).
  • Twilio — SMS and voice messaging (United States).
  • SendGrid (Twilio) — transactional email delivery (United States).
  • Stripe — payment processing for paid plans, kit orders, and payments businesses take through Jex Pay on their own Stripe accounts (United States, and Stripe's regional entities).
  • Cloudflare — content delivery, security, and the Turnstile bot check on public capture forms, which looks at technical signals from the visitor's browser (such as IP address and browser details) to tell people from automated traffic (global network; United States).
  • Anthropic — the AI model behind Ask Jex and AI-drafted content. Not used to train models (United States).
  • Sentry — error monitoring; personal data is scrubbed from reports before they are sent (United States).
  • Expo — delivering push notifications to the Jex phone app (United States).
  • Printful — print and fulfillment for physical Deployment Kits (receives shipping address only; United States).
  • Apple, Google, and LinkedIn — third-party identity providers used only when an end user chooses to fast-fill a capture form via one of those providers. We receive identity information from the provider; we do not send Customer Data to them.
  Each subprocessor is contractually obligated to handle information only as necessary to provide their service to us.
• With your Account Holder if you interacted with the Services as an Account Holder's customer, employee, or contact.
• To comply with law — for example, in response to a valid subpoena, court order, or legal process, or to protect the rights, property, or safety of Mojo Systems, our users, or others.
• In a business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We do not sell or rent your personal information to third parties.

Note on third-party sign-in. When an end user chooses to fast-fill a capture form using Apple, Google, or LinkedIn, the data shared from that provider flows to the Account Holder whose capture page was scanned. Mojo Systems handles that data on the Account Holder's behalf for the purpose of completing the submission. Mojo Systems does not use third-party-sign-in data for its own marketing, advertising, or model-training purposes. End users can decline a fast-fill option at any time and complete the form manually instead.

Note on AI connectors (using Jex from Claude, ChatGPT and other AI apps). On any plan, including Free, an Account Holder may connect their account to a third-party AI application (for example, Claude or ChatGPT) and use it to read and work with their own account. The Account Holder authorizes each connection through a secure sign-in (OAuth), chooses its access level, and can change that level or disconnect at any time in Settings → Connected AI. Private: the AI sees only totals and counts, never who the leads are. Assistant: the AI can also read lead details and update notes, statuses, tags and tasks. Trusted: the AI can also build and publish forms, Smart Links and Tap Pages. At every level, pointing a Smart Link, Tap Page or form at an outside website waits for the Account Holder's approval. Every change an AI makes is recorded with the connection that made it, and most changes can be undone. A connection is scoped to its own account: it can never reach another customer's data, and it can only do what the person who connected it is allowed to do. When an Account Holder uses a connected AI application, the data that application requests (which, at the Assistant and Trusted levels, can include the names, contact details and messages of people who submitted the Account Holder's forms) is sent to that AI provider at the Account Holder's direction and under the Account Holder's own agreement with that provider, whose terms and privacy policy govern it. Mojo Systems does not use data accessed through connectors for its own marketing, advertising, or model-training purposes. Jex can prepare follow-up emails for a connected AI. Jex itself never sends email: follow-ups go out from the Account Holder's own email account. If the Account Holder also uses Sona, our email assistant, and approves an automatic follow-up rule, Jex passes each follow-up it prepared from the Account Holder's own templates (the recipient's name and email address, the subject and the message) to Sona, which saves it as a draft or sends it from the inbox the Account Holder picked, as that inbox's own setting in Sona allows. Only people who submitted the Account Holder's forms are emailed, once per rule. Sona tells Jex only whether each follow-up was sent or saved as a draft. Every prepared email includes the Account Holder's business name, postal address and a link that lets the recipient stop further emails; we record that choice and exclude that address from future follow-ups.

6. Cookies and analytics

We use a small number of first-party cookies that are necessary for the Services to function, primarily a session cookie that keeps you signed in. Basic server-side request logs are retained for a limited period for security and debugging purposes.

Advertising pixels

On our own marketing pages, our sign-up flow, and capture points that we operate for our own business, we use standard advertising and analytics pixels — including the Meta Pixel. These may set third-party cookies and send limited event information (such as page views and form submissions, together with technical identifiers like your IP address and browser) to advertising partners such as Meta, so that we can measure and improve our own advertising. We do not place these advertising pixels on capture pages that other businesses operate on our platform, and we do not run them for visitors located in the European Union, EEA, United Kingdom, or Switzerland.

You can limit this: we automatically honor the Global Privacy Control (GPC) browser signal; you can also adjust your browser's cookie settings, opt out of interest-based advertising through Meta's ad settings, and use our Do Not Sell or Share My Personal Information page to opt out on this browser. See also Section 9 (Your rights and choices).

7. Data retention

We retain account information for as long as the account is active. Lead, contact, and check-in data is retained for the life of the Account Holder's account, plus a short grace period after cancellation during which the Account Holder can export their data. After that, data is deleted from our active systems and from routine backups within ninety (90) days. Server logs are retained for up to thirty (30) days. Signed contracts and receipts made with Jex Contracts, and their signing records (names, email addresses, IP addresses, devices, and a hand-drawn signature where one was used), are kept for seven (7) years from signing, including after the account is closed or deleted, so that both parties to the contract can prove what was agreed and for legal claims. They are then deleted. We may retain certain information longer if required by law.

8. Security

We use industry-standard security measures: data is transmitted over TLS, passwords are hashed with bcrypt, and per-tenant data is isolated at the database level. No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you in accordance with applicable law.

9. Your rights and choices

Depending on where you live, you may have rights over your personal information. To exercise any of them, email us at [email protected] with the subject "Privacy Request." We will verify and respond within the timeframe required by applicable law, and you may use an authorized agent. We will not discriminate against you for exercising your rights.

We do not sell your personal information for money. However, our use of advertising pixels on our own surfaces (see Section 6) may be considered "sharing" of personal information for cross-context behavioral advertising under California and some other state privacy laws. If you are a California resident, you can opt out through our Do Not Sell or Share My Personal Information page. We do not sell or share the leads and contacts that Account Holders capture through the Services, and we do not run advertising pixels on other businesses' capture pages.

U.S. state privacy rights (California, Virginia, Colorado, Connecticut, Texas, Oregon, and others)

If you are a resident of a state with a comprehensive privacy law, you may have the right to: (a) know and access the personal information we hold about you, including categories of sources, purposes, and recipients; (b) correct inaccurate information; (c) delete your information; (d) obtain a portable copy; (e) opt out of the sale of personal information, sharing for targeted advertising, and certain profiling (we do not engage in any of these); and (f) not be discriminated against for exercising your rights. If we deny your request you may appeal by replying to our decision, and where your state provides (for example, Virginia and Colorado), you may contact your state Attorney General.

Europe, the UK, and other regions (GDPR)

Where the EU or UK GDPR (or a similar law) applies, our legal bases for processing are: performance of a contract (to provide the Services), our legitimate interests (to secure, maintain, and improve the Services), your consent (where we request it, such as certain SMS or marketing), and compliance with legal obligations. You may have the right to access, correct, delete, restrict, or object to processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your supervisory authority. Where we transfer personal information internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Data stored in the United States. We are based in the United States and store information there. If you use the Services from the EU, the UK, Switzerland, Canada, Australia, or elsewhere, your information is transferred to and processed in the United States. For the EU, UK and Switzerland we rely on the Standard Contractual Clauses (with the UK Addendum and Swiss amendments). Businesses using Jex can rely on our Data Processing Agreement, which applies automatically and incorporates those clauses.

Canada, Australia and other countries. Residents of Canada (PIPEDA and provincial laws), Australia (the Privacy Act), and other countries with privacy laws have similar rights to access and correct their information, and to complain to their privacy regulator. Email [email protected] to use them. Visitors outside the US are asked to opt in before a business's automatic follow-up emails, which Canada's anti-spam law and the EU's ePrivacy rules require.

Leads and other end users

If you interacted with us as an end user of an Account Holder's workflow (for example, you submitted a lead form to, or were scanned at a booth by, one of our customers), that Account Holder is the controller of your information and we act as their service provider/processor. Please direct access, correction, or deletion requests to that Account Holder. You may also contact us and we will route your request to the appropriate Account Holder or act on their documented instructions.

10. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, if the changes are significant, notify Account Holders by email. Continued use of the Services after the effective date of an updated policy constitutes acceptance of the changes.

12. Contact us

Questions, requests, or complaints about this policy can be sent to: