Privacy Policy
This policy has two parts: this website (hellojessy.com), and the Jessy app. It is written for India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). The data fiduciary — the company responsible for your data — is SLIXX Origin Private Limited (CIN U62099AP2026PTC127764), 31-90-4-2, Surya Nagar, Kothapeta, Punganur, Annamayya District, Andhra Pradesh 517247, India (“we”).
In short.
- We never see or store your UPI PIN, card number, CVV, OTP or bank details.
- Jessy never places an order without reading it back to you and hearing a clear yes.
- Jessy doesn’t keep recordings of your voice. Our server gets only text.
- Your words go to one AI company, Anthropic, outside India, so Jessy can understand them.
- Our server and database are in India (Bangalore and Mumbai).
- No ads, no trackers, and we never sell your data. You can download or delete everything in the app.
Part 1 · This website
This website collects no personal data. It has no sign-up, no contact forms, no cookies of its own, no analytics, no advertising and no third-party trackers. It loads no fonts, scripts or images from anyone else: everything comes from hellojessy.com and our own media address. The one exception is the optional login below, which you start yourself.
- Hosting. Like any website, the server that sends you these pages sees technical details of each request (your IP address, browser type and the time). Our hosting provider uses them only to deliver the site and keep it secure. We don’t use them to identify you, build profiles or track you.
- Your device. Our hosting network (DigitalOcean, which uses Cloudflare) may set one security cookie,
__cf_bm, to tell people from bots. It lasts about 30 minutes and is not used to track you. The site itself sets no cookies and stores nothing else on your device. The only other thing ever stored is the session cookie described next, and only after you log in. - Emailing us. If you write to us, we use your message and email address only to reply and to keep a record of the conversation.
Logging in on the website (“My Jessy”)
You can log in on this website with the same sign-in as in the app, to view your past orders, saved addresses, linked apps, preferences and consents, and to download a copy of your data. The website cannot place orders or change anything: for that, use the Jessy app. Nothing is sent to our servers until you choose to log in or to open “My Jessy”.
- The session cookie. When you log in, our API (api.hellojessy.com) sets one cookie named
jessy_webon your browser. It is httpOnly (no script on the page can read it), Secure (sent only over HTTPS) and holds only a random session id, never your number, name or a password. It is set only when you log in, never on an ordinary visit, and it lasts 30 days, or until you log out. “Log out everywhere” ends every session at once. - Consent at login. Logging in asks you to agree to the Terms of Use and this Privacy Policy. Your yes is recorded with the version you agreed to and the time, and you can see it under “Consents”.
- Google sign-in. Only if it is offered and you choose “Continue with Google”: Google’s sign-in prompt is loaded from Google at that moment, and Google may set its own cookies under its own policy.
- Download my data. The “Download my data” button asks our API for one file with everything we hold about you and saves it on your device. Nothing is kept on the website.
Part 2 · The Jessy app
Jessy is an assistant you talk to, by voice or by typing, to order food, groceries, clothes, rides and more from apps you link. Today Jessy is in a private test: you join with an invite code, and no ordering app is connected yet, so no real order is placed and nothing is sent to any ordering app. We will update this page before that changes.
Four safety rules built into Jessy
- Secrets and long numbers never get in. If a message names a PIN, an OTP, a CVV, a card number, a password or net banking — typed or said, in any language — Jessy keeps none of that message: it isn’t stored, logged or sent to the AI. Jessy answers with one fixed safety line instead. In every other message, numbers of 3 digits or more are hidden (shown as ••••) before anything stores, logs or sends them to the AI. Only ordering details stay visible: an amount, a quantity, a time, a date, a house or flat number right after its word, and the boxes of a form (such as the postal PIN code and phone number fields).
- Words from others never reach you as written. What an ordering app or our support team writes is never shown or read to you, or given to the AI, as they wrote it. Jessy turns it into its own short, fixed lines. And nothing Jessy shows or says ever asks for or mentions a PIN, OTP, CVV, card number or password.
- No order without a read-back and a clear yes. Before any order, Jessy reads it back — items, app, address, total and how you’ll pay — and orders only after your clear yes to that read-back. Words like “order it anyway” never override an allergy flag; only the button for that item does.
- What we erase stays erased. An ordering app’s or our staff’s words are never written into our logs. Our security log holds no personal data. “Delete my account” removes everything about you (see below).
What we keep, why, and for how long
| Data | Why | How long we keep it |
|---|---|---|
| Your phone number, name, language and settings | Your account, and speaking to you in your language | Until you delete your account |
| Sign-in sessions | Keeping you signed in. We keep only a scrambled copy (a hash) of each session, never the session itself | 30 days, or until you sign out |
| Sign-in steps (an invite code being checked, a sign-in code) | Signing you in. Codes are kept only as a hash | Deleted after 1 day |
| Email address or Google account | Signing in, only if you choose that way. Our server offers sign-in by phone number and invite code, and with Google in the app once Google sign-in is switched on | Until you remove that sign-in method or delete your account |
| Your messages with Jessy, and notifications | The conversation itself, context for your next request, and alerts about your orders. Numbers are hidden and secrets are withheld before a message is kept (see “Four safety rules”) | 180 days, or until you delete your account |
| Addresses (with their map point), family profiles, limits | Delivery, and the rules you set for your family | Until you change or delete them |
| Your cart | Building an order | Until you change it or delete your account |
| Read-backs and orders | Placing and tracking orders, and helping when something goes wrong | 3 years, or until you delete your account |
| Sizes, usuals and tastes | Better suggestions. “Learn my taste & sizes” is off until you say yes: the first time Jessy would remember one, she asks you once, and saves nothing before your yes. If you say “Not now”, she doesn’t ask again unless you turn it on in the Privacy center | Until you remove them in You › Taste & diet, or turn off “Learn my taste & sizes” (then Jessy stops remembering new ones) |
| Food allergies and your food style (diet) | Flagging food you told Jessy you can’t eat — saved when you tell Jessy, without the question above, because it keeps your orders safer | Until you remove them in You › Taste & diet |
| Where your phone is (only with “Location while ordering” on) | “Deliver here”, a ride “from here”, and finding a place you name | Not kept. Only if you save it as an address is it kept, as that address |
| Try-on photos | “Try it on” | Deleted within 24 hours, unless you turn on “Keep try-on photo”. Then until you turn it off or delete the photo |
| Try-on previews | Showing you (and family you share it with) how it could look | A preview you save: until you delete it. Every other preview: deleted within 24 hours |
| Complaint photos | Showing what went wrong with an order | With their order (3 years), or until you delete your account |
| Linked-app access | Ordering in your own account on an app you link. Stored encrypted | Until you unlink the app or delete your account |
| Consents | A record of what you agreed to, which version, and when | Until you delete your account |
| Your nominee (if you add one) | Someone who can use your rights if you can’t | Until you remove them or delete your account |
| Your phone’s confirmation key | Checking it’s really you when you confirm with your fingerprint or phone lock. We keep only the public half; the private half never leaves your phone | Until you sign out on all phones or delete your account |
| Searches that found nothing | Knowing what to add to Jessy next | 180 days, or until you delete your account |
| Security log and AI usage log | Security, disputes and our AI budget. A security-log line says only what happened and how many — never your words, name, address, an amount or your IP address. The AI usage log keeps the size and cost of each request | 180 days. After you delete your account, one line that an account was deleted (with nothing about you) is kept as proof |
| Your voice | Understanding what you say | Not kept by Jessy (see “Your voice”) |
Your voice
Jessy doesn’t keep recordings of your voice, and the app never sends your voice to our servers. Our server receives only the text of what you said.
- When you tap the orb, your phone’s own speech service turns your voice into text — on most Android phones, that is Google’s. Jessy doesn’t choose whether that service works on the phone itself or on its own servers; its own privacy terms apply. Jessy gets only the text.
- When the mic is on. Jessy never listens in the background, and hands-free (the “Hey Jessy” wake word, Always listening, Voice Match) is not in the current app. The mic opens only when you tap the orb or a mic button. After you tap the orb, Jessy listens, answers, and then listens again for your reply, so you can keep talking without tapping. The mic closes by itself after 8 seconds without speech, and also when you tap the mic button, when you say you’re done and nothing is in progress, when a phone call comes in, or when you leave the app. A mic button anywhere else takes one thing you say and then closes. Before any hands-free feature comes, this page will say exactly what it does.
- Jessy speaks to you with your phone’s own voice. No voice company receives anything.
Where your phone is
“Location while ordering” is off until you say yes — Jessy asks the first time a request needs it, and you can turn it off in the Privacy center. When it is on, the app sends your phone’s position with a request only while Jessy is open on your screen, never in the background, and only a recent reading (at most 2 minutes old). If the switch is off, our server throws away any position it receives. Our server doesn’t store your position; only the addresses you add yourself in Addresses are stored.
Try-on photos
Your try-on photo is kept in private storage and opened only through links that expire after 30 minutes. It is deleted within 24 hours, unless you turn on Keep try-on photo. Turn it off and the kept photo is deleted too (a photo taken less than a day ago goes within its 24 hours). Today the preview is made on our own server — no outside try-on company receives your photo. If you share a preview with family to vote on, they see only the preview, through a link that lasts 2 days.
Allergies and diet
When you tell Jessy about an allergy or how you eat (for example vegetarian or Jain), Jessy saves it and flags items that don’t fit before any order. Saying “remove my allergy” never removes one: you remove it yourself, in You › Taste & diet or with the button Jessy shows. Flagging is best-effort: always check with the restaurant or store too. Your saved allergies and diet are part of what the AI receives (below), so it can avoid them.
Who else processes your data
Each one gets only what it needs for its part:
- Anthropic (the Claude AI) — to understand your request: the words of your message (after the safety rules above), the recent conversation, your name and language, a short summary of what Jessy remembers about you (taste, diet, allergies, sizes), and what Jessy looks up to answer you (options, your cart, your saved addresses, your orders). Never your voice or your photos. This is processed outside India.
- DigitalOcean runs our server, in Bangalore, India.
- Supabase holds our database and private photo storage, in Mumbai, India.
- OpenStreetMap’s address service (Nominatim) — when you pick an address on the map, search for one, or ask Jessy to deliver “here”, our server sends it a map point or the words of the address — never your name, number or account. The map pictures also come from OpenStreetMap, through our server.
- Your phone’s speech service (Google’s on most Android phones) — your voice, to turn it into text, under its own terms. It is part of your phone, not a service we choose.
- Google — only if Google sign-in is offered and you choose it: Google confirms who you are, and we keep only Google’s id for you, its verified email and your name (and your Google photo only if you choose).
Not used today: no SMS company, no email company, no voice company, no try-on company and no ordering app receives your data from Jessy. Before any of them does, we will update this page.
Consents and the record of them
When you sign up you agree to the Terms of Use and this Privacy Policy; we record the version and the time. If they change, the app asks you again before anything else; if you say no, you are signed out (you can still sign in to download or delete your data). The Privacy center has three switches — Keep try-on photo, Learn my taste & sizes and Location while ordering — and a fourth, Order updates by SMS, that shows only once Jessy can send SMS (today it can’t, so it isn’t shown). All of them are off until you say yes; Jessy asks the first time she needs location, and once before she would remember a size or a taste. Every answer is recorded with the time you made it.
Deleting your account
In the app: You › Privacy center › Delete everything, type DELETE, and confirm with your phone’s lock. It happens at once: your account and everything in the table above are deleted — profile, sign-in methods, messages, addresses, family, taste and allergies, carts, orders, consents, nominee, linked apps, try-on and complaint photos (from storage too), and every security-log line about you. You are signed out on every phone, and the app erases what it kept on your phone (your unsent message, cart and phone key). If a photo can’t be deleted right then, your account is not deleted yet and the app tells you to try again. What stays: one line saying an account was deleted (with nothing about you), and the AI usage counts and cost, no longer linked to you. No app? See Delete your account.
Your rights under the DPDP Act
- Information about what we process — this page and the app’s Privacy center.
- Access — “Download everything” in the app (or “Download my data” here) gives you one file of all your data.
- Correction — edit your name, addresses, family and taste, or make Jessy forget what it learned.
- Erasure — delete saved photos, or everything.
- Withdraw consent — any switch in the Privacy center, at any time.
- Grievance redressal — write to our Grievance Officer (below); you can then go to the Data Protection Board of India.
- Nominate someone to use your rights if you can’t — in the app, under You › Privacy center › Nominee.
Children and families
Family profiles live inside the account holder’s account and follow their limits and approvals. Children do not get their own accounts or logins. Jessy does no tracking, behavioural monitoring or targeted ads for anyone.
Security and breaches
Everything between the app and our server travels over HTTPS. Linked-app access is encrypted (AES-256), sign-in sessions and codes are stored only as hashes, photos sit in private storage behind short-lived links, and the app turns off Android backups. If a personal data breach happens, we will tell the Data Protection Board and the people affected, as the law requires.
Grievance Officer
Shiva Kommepalli, Grievance Officer: [email protected], +91 95422 24562. We acknowledge within 24 hours and aim to resolve within 15 days. See Contact & Grievance Officer for how to escalate.
Contact
SLIXX Origin Private Limited, 31-90-4-2, Surya Nagar, Kothapeta, Punganur, Annamayya District, Andhra Pradesh 517247, India. Questions: [email protected], phone +91 95422 24562. Partners: [email protected]. We will post changes to this policy here and ask you again in the app before they take effect.