Last updated: 6 Oct 2026
This Privacy Policy explains how David Lander, trading as “Jomioz” (“Jomioz,” “we,” “us,” or “our”), collects, uses, and shares personal information when you visit our website (such as jomioz.com), use our marketing pages, join a waitlist, contact us, or use the Jomioz product — including the web app, mobile app, Client Hub, and related services (together, the “Service”). Controller for platform account, billing, security, and marketing-site data: David Lander, trading as “Jomioz”; Tax ID (NIF/NIE): Y8422959M; Address: Calle San Isidro, 2 - La Orotava - Tenerife - Spain; Contact: info@jomioz.com. Jomioz is field-service operations software for service businesses. We serve customers in Europe and the Americas and design our privacy practices to meet applicable laws in those regions, including the EU/UK GDPR and US state privacy laws such as the CCPA/CPRA where they apply. Full imprint details: https://www.jomioz.com/legal. This Policy covers Jomioz as provider of the Service. It does not apply to the privacy practices of Account Owners or of third parties we do not control.
When an Account Owner uses Jomioz to manage its own customers (“End Users”), jobs, estimates, invoices, messages, and related content, that organisation is typically the controller (or “business”) of that Customer Data, and Jomioz acts as a processor (or “service provider”) on the Account Owner’s documented instructions. Jomioz is the controller of account, billing, security, and platform administration data. End Users with privacy requests about data in a customer’s workspace should contact that Account Owner first. B2B customers may review or request a Data Processing Agreement (DPA) at https://www.jomioz.com/dpa or info@jomioz.com.
Depending on features you use, we may process: Account Owner and Employee User data (name, work email, company, role, locale); End User and job content (contacts, properties/addresses, schedules, jobs, estimates, invoices, notes, photos, attachments, e-signatures, Client Hub activity); messaging metadata for email and, where connected, SMS/WhatsApp; map/route-related address data; Stripe payment/billing data (no full card numbers stored on Jomioz for reuse); AI prompts/outputs where assistive features are enabled — we do not use Customer Data or those prompts to train third-party foundation models; technical logs (IP, device, diagnostics, auth); PostHog product analytics; and marketing-site analytics/cookies as described below.
Where the EU/UK GDPR applies, we rely on: (a) performance of a contract — to run your account, workspace, billing, and the features you use; (b) legitimate interests — security, fraud prevention, service communications, and error monitoring that help us keep the Service reliable, balanced against your rights; (c) legal obligation — tax, accounting, and similar duties that apply to us as provider; and (d) consent where required — non-essential cookies and similar technologies on our website and in the product (product analytics, session replay, and advertising measurement) and optional marketing, which you may withdraw at any time. We do not sell personal information for money.
Categories we may collect as a business: identifiers (name, email, account ID, IP); commercial information (plan, billing, trial activity); internet activity (pages, feature-usage events, cookie/device IDs); approximate location from IP; and inferences from that activity. Sources include you, your organisation, cookies after consent, and subprocessors. We do not sell personal information for money. If you accept cookies in our banner and your browser does not send a Global Privacy Control (GPC) signal, we may use Google Analytics, Google Ads, Meta Pixel (Facebook), and Meta’s Conversions API to measure visits, trial clicks, and ad performance. That may constitute “sharing” for cross-context behavioural advertising under the CCPA/CPRA. Global Privacy Control: if your browser sends the GPC signal, we treat it as a request to opt out of sale/sharing and targeted advertising. We then do not load or send data to those advertising tools and we do not store ad-click attribution, even if you accept other cookies. You can also opt out by declining cookies, by changing your choice under “Cookie preferences,” by emailing info@jomioz.com with the subject “Do Not Sell or Share,” or by using Google’s and Meta’s opt-out tools (see also https://www.jomioz.com/privacy#dns). Residents of California and similar US states may have rights to know/access, correct, delete, and obtain a portable copy of certain personal information we hold as a business, to opt out of sale/sharing, and to appeal denials where the law provides, without discrimination. Contact info@jomioz.com for data Jomioz controls. For End User data inside a customer workspace, contact that business first.
We use personal data to provide and operate Jomioz (including jobs, scheduling, documents, Client Hub, payments, and messaging); authenticate users (including optional two-factor authentication); send transactional and security messages; bill subscriptions; detect abuse; meet legal obligations; improve reliability and product quality (including PostHog product-usage analytics); and generate aggregated, anonymised statistics that do not identify individuals.
We use subprocessors under contracts that restrict their use of data (GDPR Art. 28 where applicable). Depending on enabled features, they include: Render (application servers and database); Vercel (web hosting and AI Gateway); Amazon Web Services (file storage and delivery); Stripe (subscription billing and payments); Resend (email); Twilio (SMS, voice and phone numbers) and Zernio with Meta’s WhatsApp platform and Google Business Profile (WhatsApp messaging, and reading and replying to Google reviews), where connected; Retell AI, OpenAI and Anthropic (Jomioz AI Receptionist calls, drafting and transcription), where enabled; Mapbox (maps); Invopop (e-invoicing in supported countries); Xero and Intuit QuickBooks Online (accounting sync, only if you connect them); Google (sign-in and, after consent, Analytics and Ads); Apple (Sign in with Apple); Expo and Firebase (push notifications); Cloudflare Turnstile (bot protection on public forms); Better Auth (sign-in security); Meilisearch (workspace search); PostHog (product analytics, after consent); Sentry (error monitoring); and Meta (Pixel and Conversions API, after consent and not under GPC). We may disclose data if required by law or to protect rights and safety. Current list: https://www.jomioz.com/subprocessors.
Our application servers and database are hosted by Render in Frankfurt, Germany, and other subprocessors operate in the EEA, the UK, the United States, and other countries. For transfers from the EEA/UK to a country without an adequacy decision (for example to a subprocessor in the United States), we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK Addendum or International Data Transfer Agreement, plus supplementary measures where needed. Copies of the safeguards relevant to your workspace, and our DPA, are available on request: info@jomioz.com.
We use strictly necessary cookies and storage for authentication, security, sessions, language, and remembering your cookie choice; these do not need consent. Everything else needs your opt-in, in the product as on our website: PostHog product analytics, session replay for reproducing errors (Sentry), and marketing attribution and advertising measurement (Google, Meta). None of these run before you choose, and declining or later withdrawing stops them. Error reports without session replay (Sentry) are sent to keep the Service secure and reliable. Your choice is stored in your browser and in a first-party cookie shared across jomioz.com subdomains; change it at any time under “Cookie preferences.” If your browser sends Global Privacy Control, advertising and attribution stay off regardless. Full Cookie Policy (vendors, retention, and how to change your choice): https://www.jomioz.com/cookies.
We use TLS in transit, encryption at rest where supported, role-based access, optional two-factor authentication, monitoring, and least-privilege production access. See our Security page. If we become aware of a personal-data breach affecting Customer Data we process for an Account Owner, we will notify that Account Owner without undue delay and provide information reasonably available to help them meet their own obligations. Retention: account and workspace administration data for the life of the account, then typically up to 24 months after closure; Customer Data until the Account Owner deletes it or we complete an instructed deletion/export; billing and accounting records we hold as provider for the period required by tax and accounting law (often six to ten years); support records typically up to 24 months; security logs typically up to 12 months; marketing-site analytics until you withdraw consent or the vendor’s period ends.
Under GDPR you may have rights to access, rectify, erase, restrict, or port data, object to certain processing, and complain to a supervisory authority (in Spain, the AEPD). US state rights, including Do Not Sell or Share, are in section 5. For organisation-controlled workspace data, contact your admin first; otherwise info@jomioz.com. We aim to respond within 30 days (or sooner if law requires). We may verify identity. End Users should contact their Account Owner first for workspace Customer Data.
Jomioz is a business service. You must be of legal age in your jurisdiction. We do not knowingly collect data from children under 16 (or under 13 in the US, or the higher age required locally). Contact info@jomioz.com if you believe we have.
We may update this policy and will post the revised version with an updated date; material changes may also be emailed or shown in-product. Privacy, legal, and security: info@jomioz.com. See also our Terms of Service, Security page, https://www.jomioz.com/legal, https://www.jomioz.com/cookies, https://www.jomioz.com/subprocessors, and https://www.jomioz.com/dpa.