Privacy Policy

Introduction

This privacy policy explains how TemplateJet collects, uses, and protects your personal data when you use our website and Chrome extension. We act as the data controller under the EU General Data Protection Regulation (GDPR).

Data Controller

Information We Collect

Account Data

• Name and email address from your Google account when you sign in
• Message templates and categories you create
• Usage events tied to your account (which templates you open or copy), used to power your personal analytics

Technical Data

• IP address (retained in short-lived security and web-server logs only)
• Browser type and version, included in request logs
• A first-party session cookie that keeps you signed in

How We Use Your Information

• To operate the service: authenticate you, store your templates, and show your usage analytics
• To debug, maintain, and improve reliability
• To respond to support requests you send us
• To detect and prevent abuse, fraud, and security incidents
• To comply with legal obligations

Legal Basis for Processing

We process your personal data on the following GDPR Article 6 grounds:

• Performance of a contract (Art. 6(1)(b)) — creating and maintaining your account, storing your templates, and providing the Chrome extension
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and debugging errors
• Legal obligation (Art. 6(1)(c)) — responding to lawful requests from authorities

AI-Assisted Template Generation

When you use AI features to generate or improve a message template, the text of your prompt and template is sent to our AI sub-processors (Google Gemini as the primary provider, with Groq as a fallback) for processing. No account data, email, IP address, or other identifiers are shared with these providers — only the template content you submit. Please avoid entering personal data of third parties into AI prompts unless you have a lawful basis to do so.

Chrome Extension

Our Chrome extension runs only on LinkedIn, Telegram Web, and WhatsApp Web. It reads minimal data from the current page to personalize the template you choose to insert, and communicates only with our own backend at templatejet.app. It does not read your messages, contacts, or browsing history, and does not send any data to third parties.

• Locally (in the extension's storage): an authentication token issued after you sign in, used to call our API on your behalf. Removed on sign-out or when the token is rejected.
• Read from the page at the moment you insert a template: the recipient's first name, taken from the visible profile or chat header, used to replace the {first_name} placeholder. The first name stays on your device unless it contains Cyrillic characters, in which case it is sent to our backend for transliteration to Latin script and is not stored beyond short-lived request logs.
• Sent to our backend: requests to fetch your own templates, and a usage event (template ID and platform — LinkedIn, Telegram, or WhatsApp) each time you insert a template, used for your personal analytics.
• We do not collect the text of your messages, conversations, contact lists, or any browsing activity outside the three supported platforms.

Data Sharing and Sub-processors

We do not sell or rent your personal data. We share the minimum data necessary with the following sub-processors, each under a Data Processing Agreement:

• Hetzner Online GmbH (Germany, EU) — hosting of the application, database, and logs
• Google LLC — Gemini API, used only to process the text you submit to AI template features
• Groq, Inc. — fallback AI provider, used only to process the text you submit to AI template features when Gemini is unavailable
• Functional Software, Inc. (Sentry) — error tracking and performance monitoring. Events are stored in the European Union (Frankfurt, Germany) and may include error stack traces, request metadata (URL, user agent, IP address), and performance traces.
• We may also disclose data when required by law or to protect our legal rights

International Data Transfers

Your account data is stored in the European Union (Hetzner, Germany). The AI sub-processors named above (Google, Groq) are located in the United States. When template content is sent to these providers, transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as applicable. Sentry, our error monitoring sub-processor, is a US-incorporated company; we use its EU data region so event data is stored in the European Union, while occasional administrative access by US-based Sentry personnel is covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.

Data Retention

• Account data (name, email) and your templates: kept for as long as your account is active. Deleted on request or when you delete your account.
• Web-server and security logs (including IP address): up to 30 days.
• Error and performance monitoring events (Sentry): up to 30 days.
• AI usage records (prompt text, model response, tokens, and model metadata): up to 12 months for quality monitoring, billing reconciliation, and abuse prevention.
• Encrypted backups are rotated and overwritten within 30 days.

Your Rights Under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

• Right of Access - Request a copy of the personal data we hold about you
• Right to Rectification - Request correction of inaccurate or incomplete data
• Right to Erasure - Request deletion of your account and associated data
• Right to Data Portability - Receive your data in a structured, machine-readable format
• Right to Object - Object to processing based on our legitimate interests
• Right to Restriction - Ask us to limit processing while a dispute is resolved
• Right to Lodge a Complaint - File a complaint with your local supervisory authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO, uodo.gov.pl)

To exercise any of these rights, email us at [email protected]. We will respond within one month.

Data Security

We use TLS encryption in transit, role-based access controls, isolated database credentials, and keep our dependencies and host OS up to date. Our infrastructure provider (Hetzner) is ISO 27001 and BSI C5 Type 2 certified and operates physically secured EU data centers. No system is perfectly secure, but we apply measures proportionate to the sensitivity of the data we hold.

Cookies

We only use strictly necessary first-party cookies, which are exempt from consent under ePrivacy rules. We do not use analytics, advertising, or third-party tracking cookies, so no cookie banner is required. The cookies we set are:

• A session cookie (HttpOnly, Secure, SameSite=Lax) used to keep you signed in, plus a CSRF token cookie used to protect forms from cross-site request forgery

Children

TemplateJet is a professional productivity tool and is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it.

Changes to This Privacy Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated 'last updated' date. We encourage you to review it periodically.

Contact

For any question about this policy or to exercise your rights, contact the data controller: