Privacy Policy

This Privacy Policy describes how Catbears, a sole proprietorship (עוסק מורשה) registered in Israel and the operator of Jim Generate ("Jim", "we", "us" or "our"), collects, uses, shares and protects personal data in connection with our websites, applications and services (the "Service"). For the purposes of applicable data protection laws, Catbears is the controller of the personal data processed about you as a user of the Service.

By using Jim Generate, you acknowledge the practices described in this policy. If you do not agree, please do not use the Service. This policy should be read together with our Terms of Service.

1. Scope

This policy applies to individuals who visit our websites, use our mobile applications, create an account, or otherwise use Jim Generate. Our mobile applications include voice assistants that record and process speech; where a feature of this policy applies specifically to them, we say so. It does not apply to third-party websites, products or services that we do not control, even if they are linked from or integrated with the Service. "Personal data" means any information relating to an identified or identifiable natural person.

2. Personal data we collect

We collect personal data in the following ways:

Data you provide to us. This includes the information you give us when you register (such as your name and email address), account settings and preferences, and any correspondence you send us, such as support requests. It also includes the prompts, text, files and other materials you submit to generate content ("Input") and the results the Service produces for you ("Output").

Players you add. In GrowlMaster you can add players who play at your table without an account of their own, such as your children. For each one we keep the name you give them, the picture, background colour and dice bag colour chosen for them, whether they are in the game, and their math streaks, flames and gifts. This is part of your account (see "Children" below). Math streaks at a table are kept with that table, in the account of the adult who runs it; when you play without signing in, they stay in your browser.

Payment data. When you subscribe, payments are processed by our third-party payment provider. We receive limited information such as the fact and amount of a transaction and your subscription status, but we do not collect or store your full payment card details; those are handled directly by the payment provider under its own privacy practices.

Data collected automatically. When you use the Service, we and our providers may automatically collect technical and usage data, such as your device and browser type, IP address, operating system, referring pages, the pages and features you use, timestamps, and diagnostic information. Some of this is collected using cookies and similar technologies (see the Cookies section below).

Voice and audio data. Our voice assistant applications record audio from your device's microphone while you have the voice feature switched on, and only then. That audio, and the text transcript produced from it, are Input: they are relayed through our servers to an AI model provider so the assistant can understand you and reply, and the assistant's spoken replies are generated the same way. We do not retain recordings of your voice after a conversation turn has been processed. Transcripts of the conversation are kept on your own device so you can read back what was said; see "Data retention" below. Your device will ask for microphone permission before any of this happens, and you can withdraw it at any time in your device settings.

Data from third parties. If you sign in through a third-party login provider or interact with us on third-party platforms, we may receive information from those providers in accordance with their terms and your settings. We may also receive information from analytics, security and infrastructure providers.

Accounts. For your account we store your name, your email address and, when you sign in with Google, your Google sign-in. You can delete your account and everything kept with it at any time from Settings, Advanced, Delete all my data.

Google sign-in. When you sign in with Google, we receive only your name, email address and profile picture. We use them only to sign you in. They are never sold and never used for ads.

Jim Generate's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connected accounts and calendar data. If you choose to connect a third-party account such as Google, we receive an access credential for that account together with the data you have authorized us to reach. Where you connect Google Calendar, this includes reading your calendar events and creating, changing or deleting events at your request. We use this data only to carry out the actions you ask the assistant for, and we store the credential in encrypted form. Connecting is optional, the Service works without it, and you can disconnect at any time from the application's settings, which revokes the credential. You can also remove our access from your Google account's own security settings.

3. How we use personal data

We use personal data for the following purposes:

• to create and manage your account and provide the Service;
• to process your Input, generate Output and deliver the features you request;
• to manage subscriptions, credits, billing and payments;
• to provide customer support and respond to your requests, including fixing generation issues you report;
• to operate, maintain, secure, monitor and improve the Service, including troubleshooting, testing and developing new features;
• to detect, prevent and address fraud, abuse, security incidents and violations of our Terms;
• to communicate with you about the Service, including service-related notices and, where permitted, marketing messages you can opt out of;
• to comply with legal obligations and to establish, exercise or defend legal claims.

4. Legal bases for processing

Where data protection laws such as the GDPR apply, we rely on the following legal bases: the performance of our contract with you (to provide the Service you request); our legitimate interests (such as securing and improving the Service and preventing abuse), balanced against your rights; your consent (for example, for certain cookies or marketing, which you may withdraw at any time); and compliance with legal obligations. Where we rely on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

5. AI processing and model providers

To generate Output, your Input may be processed by artificial intelligence models, some of which are operated by third-party providers on our behalf. We share with those providers only what is needed to generate your requested Output, and we seek to work with providers that offer appropriate protections. The way these providers handle data is governed by their own terms and privacy practices. Generative AI is probabilistic and may produce inaccurate results; we describe the limitations of Output in our Terms of Service.

Safety checks. To keep the Service safe, Input and Output may be screened automatically for harmful content, and a conversation may be interrupted as a result. Where content is flagged, we may log the fact and the category of the flag. If you report something the assistant said, the report reaches us together with the part of the conversation you are reporting and an anonymous installation identifier, so that a person can review it.

6. How we share personal data

We do not sell your personal data. We share personal data only as described below:

• Service providers: vendors who help us operate the Service, such as cloud hosting, AI model providers, payment processing, analytics, communications and customer support providers, who are permitted to use the data only to provide services to us;
• Legal and safety: where we believe disclosure is required to comply with a law, regulation, legal process or governmental request, or to protect the rights, property or safety of Catbears, our users or others, or to enforce our Terms;
• Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, in which case personal data may be transferred as part of the transaction, subject to this policy;
• With your direction: when you choose to share content or otherwise direct us to disclose information.

7. International data transfers

We operate from Israel, and our service providers may be located in the United States and other countries. As a result, your personal data may be transferred to, stored in, and processed in countries other than the one in which you reside, which may have different data protection laws. Where required, we take steps to ensure that such transfers are subject to appropriate safeguards, such as standard contractual clauses or reliance on adequacy decisions. Israel is recognized by the European Commission as providing an adequate level of data protection.

8. Data retention

We retain personal data for as long as necessary to provide the Service, maintain your account, comply with our legal obligations, resolve disputes and enforce our agreements. Retention periods vary depending on the type of data and the purpose for which it is processed. When personal data is no longer needed, we will delete it or anonymize it. We may retain certain data for longer where required by law (for example, tax and accounting records) or as part of routine backups. Players you add in GrowlMaster, and their streaks and gifts, are kept until you delete them or your account; deleting your account deletes them.

Conversation transcripts in our voice assistant applications are stored on your own device rather than on our servers, and are removed when you delete the application. Reports you submit about something the assistant said are retained so we can review and act on them.

9. Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for using the Service in a secure manner.

10. Your rights

Depending on where you live, you may have rights regarding your personal data, including the right to access the data we hold about you, to request correction of inaccurate data, to request deletion, to object to or restrict certain processing, to data portability, and to withdraw consent where processing is based on consent. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

If you are a resident of a U.S. state with applicable privacy laws (such as California), you may have additional rights, including the right to know what personal data we collect and how we use it, the right to request deletion, and the right to opt out of the "sale" or "sharing" of personal data as those terms are defined by law. We do not sell personal data. To exercise any of these rights, contact us using the details below. We will respond as required by applicable law and will not discriminate against you for exercising your rights.

11. Cookies and similar technologies

We and our providers use cookies and similar technologies to operate the Service, remember your preferences, keep you signed in, measure and analyze usage, and improve the Service. Some cookies are strictly necessary for the Service to function; others are used for analytics or, where applicable, marketing. You can manage cookies through your browser settings, though disabling some cookies may affect how the Service works. Where required, we will ask for your consent before setting non-essential cookies.

12. Children

Accounts on Jim Generate are for adults: you must be at least 18 years old to create one and sign in. Some products, such as GrowlMaster, are designed for parents and other adults who play together with their children: the adult adds the children as players under their own account. A child never has an account of their own and never signs in.

For each player an adult adds, we keep only what the game needs, as part of the adult's account: the name the adult gives them, the picture, background colour and dice bag colour chosen for them, whether they are in the game right now, and their math streaks, flames and gifts. We suggest a first name or a nickname rather than a full name. The adult can change or delete any player at any time from the Account window, and deleting a player deletes what we keep for them. We do not ask children for any other information.

If you believe a child has created an account or given us personal data on their own, contact us and we will delete it.

13. Third-party links and services

The Service may contain links to, or integrations with, third-party websites and services. We are not responsible for the privacy practices of those third parties, and this policy does not apply to them. We encourage you to review the privacy policies of any third-party services you use.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as by posting the updated policy with a new "last updated" date or by contacting you. Your continued use of the Service after the changes take effect indicates your acknowledgement of the updated policy.

15. Contact us

Jim Generate is operated by Catbears (עוסק מורשה), Israel. If you have questions about this policy or wish to exercise your rights, contact us at hello@jimgenerate.com.