Privacy Policy

When you browse the public website, the website may process technical information needed to deliver pages, protect the service and remember your privacy choice.

When you use the contact form, we process the information you provide: name, email address, optional company, optional interest category and message content.

The contact form also uses a hidden honeypot field and transient technical request information, such as an IP address from request headers, to prevent spam and rate-limit abuse.

We process website technical data to operate, secure and deliver the public website.

We process general contact enquiries so we can respond to visitors who ask about Jetsy, collaboration or the website.

We process pre-contractual enquiries where a visitor contacts Jetsy about a potential business relationship, collaboration or service discussion.

We process the necessary consent cookie only to remember whether a visitor accepted or rejected optional analytics preferences.

Website operation, security and abuse prevention are processed based on Jetsy's legitimate interests in running a secure public business website.

General enquiries are processed based on legitimate interests in responding to B2B communications and managing business relationships.

Pre-contractual enquiries are processed where necessary to take steps requested before entering into a possible contract or collaboration.

Optional analytics, if activated later, will rely on consent. Analytics is disabled by default and is not active in the current production website.

The contact form sends submitted messages to Jetsy through a server-side SMTP email configuration. SMTP credentials are not exposed to the browser.

The form validates required fields, limits message size, uses a honeypot field and applies in-memory rate limiting before sending an email. If required SMTP configuration is missing, the form reports that messaging is unavailable and does not send the message.

Submitted messages are delivered to the configured contact mailbox. The website code does not store contact submissions in a database and does not automatically delete messages after delivery.

Contact messages are retained for up to 12 months after the last relevant communication, unless a longer period is required or justified by contractual, legal or legitimate purposes.

The contact API logs only a delivery failure code if sending fails; it is designed not to log message content, email addresses or SMTP credentials.

Current production state: Google Tag Manager and Google Analytics 4 are implemented in the application boundary but disabled for production unless analytics is explicitly enabled through configuration and a visitor gives analytics consent. The current production website does not actively collect analytics through GTM or GA4.

Future analytics activation: if Jetsy activates analytics later, GTM/GA4 will load only after analytics consent. The consent system is prepared for Google Consent Mode V2. Analytics storage may be granted only after consent, while advertising consent signals remain denied unless a separate approved scope is introduced later.

The current website does not use advertising pixels, remarketing tags or marketing tracking. No Google Ads API data is currently processed through this public website.

This website does not currently request Google account access or process Google user data through OAuth. If Jetsy later introduces OAuth or Google API features, this policy must be updated with the exact scopes, data categories, purposes, retention and recipients before launch.

Production application hosting is provided by Railway. The domain registrar is Websupport.

Contact form messages are delivered through the SMTP provider configured in server-side environment variables.

Railway may process technical website operation data as the hosting provider. Websupport provides domain registration and should not be treated as a website analytics provider based only on its registrar role.

Google will not receive analytics data from this website unless GTM/GA4 is activated and the visitor has provided the required analytics consent.

The jetsy_consent cookie expires after 180 days unless it is updated or removed earlier.

Contact form rate-limiting information is transient and used to protect the form from abuse. It is not sent in the contact email.

Contact messages are retained for up to 12 months after the last relevant communication, unless longer retention is required or justified by contractual, legal or legitimate purposes.

The production mailbox storage and deletion process must support the approved retention policy. The website code itself does not delete mailbox messages automatically.

If GA4 analytics is activated later, the GA4 property is configured for 14-month retention. That technical setting still requires final legal/product approval and disclosure before activation.

Railway and the final SMTP/mailbox provider may process data in locations that depend on their production configuration and service terms.

Do not assume that all data remains in the EEA unless this is confirmed in the production provider configuration and data processing terms.

International transfers may also occur if Google analytics is activated later. Applicable transfer mechanisms and safeguards must be confirmed before final production activation.

You can withdraw or change optional analytics consent at any time through Footer → Cookie settings.

Rejecting optional analytics keeps analytics storage denied. Advertising consent signals remain denied in the current website scope.

You may also clear cookies in your browser. If the consent cookie is removed, expired, invalid or replaced by a new consent version, the website will ask for a new privacy choice.

If GTM/GA4 analytics is activated later, withdrawal stops future application analytics dispatch.

Jetsy uses reasonable technical measures in the website implementation, including server-side handling of SMTP credentials, input validation, request size limits, honeypot spam protection, rate limiting and restrained error logging.

No online service can be guaranteed to be completely secure. Production provider security, data processing terms and mailbox controls should be reviewed before final launch.

This Privacy Policy may be updated as Jetsy develops, as production providers are confirmed, or before optional analytics, GTM, GA4, OAuth or Google API functionality is activated.

Material changes should be reviewed before production publication and reflected on this page.