Privacy Policy
How JetPatch collects, uses, and protects your personal data.
JETPATCH PRIVACY POLICY
Effective Date: April 22, 2026 | Version 4.3
1. INTRODUCTION
This Privacy Policy (“Policy”) describes how Intigua, Inc. and Intigua Israel Ltd., together doing business as JetPatch (collectively, “JetPatch,” “Intigua,” “we,” “us,” or “our”), collect, use, disclose, transfer, and protect personal data in connection with our website, software products, services, evaluations, and business activities (collectively, the “Services”).
We are committed to protecting the privacy and security of personal data we process. This Policy applies globally to individuals who visit our website, use our Services, evaluate our software, engage with us as customers or prospective customers, or otherwise interact with us.
By using our Services, you acknowledge that you have read and understood this Policy. Please read it carefully. If you do not agree with our practices, please do not use our Services.
Children’s Privacy. Our Services are intended for a general business audience and are not directed to children. We do not knowingly collect personal data from children under the age of 16 (or under 13 in the United States, or the applicable age of consent in other jurisdictions). If we learn that we have collected personal data from a child without verifiable parental consent, we will delete that data promptly. If you believe we have collected personal data from a child, please contact us at [email protected].
2. WHO WE ARE AND HOW TO CONTACT US
Controller. For purposes of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and analogous data protection laws, the controller of your personal data is:
Intigua, Inc. (a Delaware corporation)
51 Pleasant Street #1064, Malden, Massachusetts 02148, United States
Intigua Israel Ltd. (an Israeli company)
27 Maskit Street, Herzliya, Israel
Intigua Israel Ltd. operates as a joint controller with Intigua, Inc. for research and development, engineering, and product support activities. Intigua, Inc. operates as the primary controller for commercial, sales, marketing, customer, and evaluation activities globally.
Privacy Contact. For all privacy-related inquiries, including exercise of your rights under applicable law, contact:
Email: [email protected]
Postal: Intigua, Inc., Attn: Privacy, 51 Pleasant Street #1064, Malden, Massachusetts 02148, United States
Data Protection Officer. Our Data Protection Officer can be contacted at [email protected].
EU / UK Representative. For individuals in the European Economic Area and the United Kingdom, our representative under Article 27 of the GDPR and Article 27 of the UK GDPR is identified on our website. Please contact [email protected] for current details.
3. PERSONAL DATA WE COLLECT
“Personal Data” means any information relating to an identified or identifiable natural person. We collect the following categories of Personal Data:
Identity Data: full name, username, job title, employer, professional credentials, and similar identifiers.
Contact Data: business email address, telephone number, postal address, and other contact information.
Account and Profile Data: login credentials, account preferences, account roles, and communication preferences.
Usage and Technical Data: IP address, device type, browser type and version, operating system, screen resolution, language settings, time zone, referring URLs, pages viewed, features used, duration of sessions, error logs, and other technical information.
Evaluation and Support Data: information provided in connection with software evaluations (including approval workflow data, sanctions and compliance screening results, and communications during the evaluation period), technical support requests, configuration information, and communications with our support team. This category may include session recordings from screen-sharing support sessions, remote-access session logs, chat transcripts, and diagnostic files or logs that you submit to us. We process this data solely to review and administer evaluations, provide and improve technical support, diagnose issues, and maintain records of support interactions. You are responsible for ensuring that any logs, screenshots, configuration files, or other materials you submit to our support team do not contain personal data of employees, customers, or other third parties, special categories of personal data (such as health, biometric, or other sensitive personal data), regulated data (such as protected health information or payment card data), or production data of any kind. We recommend that you redact or anonymize such data before submission. Session recordings and remote-access logs are retained only for the duration of the support engagement and a limited post-engagement audit period, consistent with the retention commitments in Section 9.
Marketing and Communications Data: preferences for receiving communications, engagement with our marketing, and communication history.
Transaction and Billing Data: billing contacts and purchase-related information, where applicable. We do not directly collect or store payment card numbers; payment processing is handled by PCI-compliant third-party processors.
Aggregated and De-identified Data. We also generate aggregated, anonymized, or de-identified data (such as statistical and usage analytics) that does not identify any individual. We may use and disclose such data for any lawful purpose. JetPatch has taken reasonable technical and organizational measures to ensure that such data cannot reasonably be associated with any individual or household. JetPatch will not attempt to re-identify any de-identified data, and will not combine de-identified data with other data in a manner that would permit re-identification, except where required by applicable law or to assess or confirm the effectiveness of de-identification measures. JetPatch will contractually require any third-party recipients of de-identified data to comply with equivalent restrictions against re-identification.
Sensitive Data. We do not knowingly collect special categories of personal data (such as health, racial or ethnic origin, political opinions, religious beliefs, or biometric data) in the ordinary course of providing our Services. Please do not provide such information to us through our Services.
Accidental Collection of Sensitive or Regulated Data. JetPatch does not seek and does not require individuals to provide sensitive personal data, special categories of personal data, personal data of third parties, or regulated data (such as protected health information, payment card data, or data subject to sectoral privacy laws) in connection with the Services. If we become aware that we have inadvertently received such data (for example, through submission of support logs, diagnostic files, or screen-sharing sessions), we will delete or securely destroy it promptly and without undue delay, unless we are legally required to retain it (for example, pursuant to a litigation hold, regulatory investigation, or statutory retention obligation). Where practicable, we will notify the individual or organization from whom the data was received so that they may assess any obligations they may have under applicable data protection laws. This commitment does not alter the responsibilities of individuals and organizations submitting data to us, who remain responsible for redacting or omitting such data before submission.
4. HOW WE COLLECT PERSONAL DATA
We collect Personal Data through three primary channels.
Directly from you: when you fill out forms (including contact, demo-request, and evaluation-request forms), subscribe to communications, participate in evaluations, request support, purchase Services, attend our events, or correspond with us.
Automatically through your use of our Services: through cookies and similar technologies, server logs, and analytics tools, as further described in Section 12.
From third parties and public sources: including analytics providers (such as Google Analytics), advertising networks, social media platforms where you engage with our content, business-information providers (such as LinkedIn and ZoomInfo), sanctions-screening and compliance service providers, and publicly available sources.
5. HOW WE USE PERSONAL DATA
We use Personal Data for the following purposes:
to provide, operate, maintain, and improve our Services;
to respond to inquiries, provide customer and technical support, and manage our business relationship with you;
to process software evaluations, including the approval, provisioning, and management of evaluation access;
to process orders, deliver Services, manage subscriptions, and handle billing and related administrative matters;
to send administrative communications (such as service announcements, security alerts, and policy updates);
to send marketing communications about our Services, where permitted by law;
to personalize your experience and deliver content relevant to your interests;
to conduct analytics, research, and product development;
to comply with legal, regulatory, tax, accounting, and contractual obligations, including export control and sanctions-screening obligations;
to detect, prevent, investigate, and respond to fraud, security incidents, misuse, and violations of our agreements;
to establish, exercise, and defend legal claims; and
to comply with lawful requests from governmental authorities, courts, and law enforcement.
6. LEGAL BASES FOR PROCESSING (EU/EEA AND UK)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process Personal Data only where we have a valid legal basis under applicable law. The legal bases we rely on are:
Performance of a Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract (such as providing Services you have requested, processing your evaluation request, or fulfilling your subscription).
Legitimate Interests: where processing is necessary for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests. Our legitimate interests include operating, securing, and improving our Services; conducting business-to-business marketing; protecting against fraud and misuse; conducting sanctions and compliance screening; and establishing or defending legal claims.
Legal Obligation: where processing is necessary to comply with a legal obligation to which we are subject, including tax, accounting, regulatory, export-control, and sanctions obligations.
Consent: where you have given your consent (for example, for certain marketing communications or non-essential cookies). You may withdraw your consent at any time by contacting us at [email protected] or by using the opt-out mechanisms provided.
Vital Interests or Public Interest: in limited circumstances where processing is necessary to protect vital interests or is carried out in the public interest.
7. SHARING AND DISCLOSURE OF PERSONAL DATA
We do not sell your Personal Data. We do not “sell” or “share” Personal Data as those terms are defined under the California Consumer Privacy Act (as amended, the “CCPA/CPRA”) or analogous laws in other U.S. states. We share Personal Data only in the following circumstances:
Affiliates: with our corporate affiliates (including between Intigua, Inc. and Intigua Israel Ltd.) for the purposes described in this Policy, subject to written agreements requiring consistent data protection.
Service Providers and Processors: with third parties that process Personal Data on our behalf to provide hosting, infrastructure, analytics, communications, customer relationship management (CRM), marketing automation, sanctions screening, security, support, and similar services. These providers are bound by written agreements that require them to process Personal Data only on our instructions and to maintain appropriate safeguards.
Business Partners: with channel partners, resellers, or managed service providers that help us deliver Services to you, subject to written agreements.
Legal and Regulatory Disclosures: where required to comply with applicable law, legal process, or lawful governmental request; to enforce our agreements; to protect our rights, property, or safety or those of others; or to address fraud, security, or technical issues. We carefully validate governmental and law-enforcement requests before disclosing Personal Data.
Corporate Transactions: in connection with a merger, acquisition, reorganization, sale of assets, financing, or similar transaction, including during due diligence. We will require recipients to honor this Policy or provide comparable protection.
With Your Consent: in any other circumstance with your consent or at your direction.
8. INTERNATIONAL DATA TRANSFERS
JetPatch is established in the United States and Israel, and our service providers may be located in other jurisdictions. As a result, Personal Data may be transferred to, stored in, and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.
Transfers from the EEA, UK, and Switzerland. Where we transfer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been determined by the relevant authority to provide an adequate level of protection, we implement appropriate safeguards under applicable law, which may include:
the European Commission’s Standard Contractual Clauses (2021 modules) for transfers out of the EEA;
the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, for transfers out of the United Kingdom;
the Swiss-specific adjustments to the Standard Contractual Clauses for transfers out of Switzerland;
the EU-U.S. Data Privacy Framework, the UK Extension to the Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, where we or our service providers are certified; and
reliance on a European Commission, UK, or Swiss adequacy decision for transfers to adequate countries (including, as of the effective date of this Policy, the adequacy decision covering Israel).
You may request a copy of the safeguards we use for international transfers by contacting [email protected].
9. DATA RETENTION
We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including to provide Services, meet legal, accounting, regulatory, and reporting obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of data, the purpose of processing, and legal requirements.
General retention periods are as follows:
Evaluation data: retained for the duration of the evaluation and up to 24 months afterward to support conversion to a paid relationship and internal analysis;
Customer account data: retained for the duration of the customer relationship and up to 7 years afterward for accounting, tax, and legal purposes;
Marketing data: retained until you opt out or for 24 months of inactivity, whichever occurs first;
Website analytics and technical logs: retained for up to 24 months;
Support communications: retained for up to 5 years after the last interaction;
Data required to comply with legal obligations: retained for the period required by applicable law.
In all cases, the periods above are maximums. We may delete or anonymize data earlier than the stated maximum at our discretion, subject to any applicable legal preservation obligations (including litigation holds, regulatory investigations, and statutory record-keeping requirements).
When Personal Data is no longer needed, we securely delete or anonymize it. Anonymized data that can no longer be associated with you may be retained indefinitely for research and statistical purposes.
10. YOUR RIGHTS
Depending on your jurisdiction, you may have the following rights in relation to your Personal Data. We will respond to verified requests within the timeframes required by applicable law.
10.1 Rights Under the GDPR and UK GDPR (EEA, UK, Switzerland)
Right of access: obtain confirmation of whether we process your Personal Data and a copy of that data.
Right to rectification: have inaccurate or incomplete Personal Data corrected.
Right to erasure (“right to be forgotten”): have your Personal Data deleted in certain circumstances.
Right to restrict processing: limit our use of your Personal Data in certain circumstances.
Right to data portability: receive your Personal Data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to object: object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: where processing is based on consent, withdraw that consent at any time.
Right not to be subject to automated decision-making: including profiling that produces legal or similarly significant effects.
Right to lodge a complaint: with your local data protection supervisory authority. We would appreciate the opportunity to address your concerns before you contact the authority.
10.2 Rights Under the CCPA/CPRA and Other U.S. State Laws
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another U.S. state with a comprehensive consumer privacy law, you may have the following rights:
Right to know: request disclosure of the categories and specific pieces of Personal Data we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share the data.
Right to delete: request deletion of Personal Data we have collected from you, subject to exceptions.
Right to correct: request correction of inaccurate Personal Data.
Right to opt out of sale or sharing: we do not sell or share Personal Data as those terms are defined under the CCPA/CPRA, but you may submit a request to confirm this.
Right to limit use of sensitive Personal Data: we do not use sensitive Personal Data for purposes that would trigger this right.
Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.
California residents may also designate an authorized agent to submit requests on their behalf. We will require verification of both your identity and the agent’s authorization.
10.3 Rights Under Brazil’s LGPD
If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados, including rights of access, correction, anonymization, blocking, portability, deletion, information about sharing, and revocation of consent. Contact [email protected] to exercise these rights. You may also contact the Brazilian National Data Protection Authority (ANPD).
10.4 Rights Under UAE, Qatar, and Saudi Data Protection Laws
If you are located in the United Arab Emirates, Qatar, or the Kingdom of Saudi Arabia, you may have rights under applicable local data protection laws, including Federal Decree-Law No. 45 of 2021 (UAE PDPL), Qatar Law No. 13 of 2016, and the Saudi Personal Data Protection Law. These generally include rights of access, correction, erasure, restriction, objection, and withdrawal of consent. Contact [email protected] to exercise these rights.
10.5 Rights Under India’s DPDPA
If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023, including rights to access, correction, erasure, grievance redressal, and nomination. Contact [email protected] to exercise these rights.
10.6 Rights Under Israel’s Privacy Protection Law
If you are located in Israel, you have rights under the Privacy Protection Law, 5741-1981, as amended, including rights of access and correction of Personal Data held in our databases. Contact [email protected] to exercise these rights.
10.7 How to Exercise Your Rights
To exercise any of these rights, contact us at [email protected]. We will verify your identity before responding and may request additional information to do so. We will respond within the timeframes required by applicable law (generally within 30 days for GDPR requests and 45 days for CCPA/CPRA requests, with possible extensions where permitted). There is no fee for exercising these rights in most cases, although we may charge a reasonable fee or refuse manifestly unfounded or excessive requests where permitted by law.
11. DATA SECURITY AND BREACH NOTIFICATION
We implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include access controls, encryption of data in transit and at rest where appropriate, network security, vulnerability management, employee training, and vendor security assessments. We align our security practices with recognized industry frameworks.
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Breach Notification. In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, in accordance with Article 33 of the GDPR and analogous obligations under other applicable laws. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Article 34 of the GDPR and other applicable laws.
12. COOKIES AND SIMILAR TECHNOLOGIES
We and our service providers use cookies, pixel tags, web beacons, device identifiers, local storage, and similar technologies (collectively, “Cookies”) to operate our website and Services, analyze usage, remember your preferences, and deliver relevant content.
We use the following categories of Cookies:
Strictly Necessary Cookies: required for the website and Services to function and cannot be disabled.
Functional Cookies: remember your preferences and settings to enhance your experience.
Analytics Cookies: help us understand how visitors use our website (for example, Google Analytics).
Marketing and Targeting Cookies: deliver advertisements relevant to your interests and measure the effectiveness of our marketing.
Social Media Cookies: enable sharing and engagement with our content on social media platforms.
Managing Cookies. Where required by applicable law (such as the EU ePrivacy Directive), we obtain your consent before setting non-essential Cookies through our cookie banner, which allows you to accept or reject each category. You can also manage Cookies through your browser settings. If you disable Cookies, some features of our Services may not function properly.
13. THIRD-PARTY WEBSITES AND SERVICES
Our website and Services may contain links to or integrations with third-party websites, platforms, and services. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party before providing Personal Data to them.
14. CHANGES TO THIS POLICY
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will post the updated Policy on our website and update the “Effective Date” and version number above. Where required by applicable law, we will provide additional notice or seek your consent. We encourage you to review this Policy periodically.
Prior versions of this Policy are available upon request at [email protected].
15. QUESTIONS AND COMPLAINTS
If you have questions, concerns, or complaints about this Policy or our privacy practices, please contact us first at [email protected]. We will do our best to address your concerns promptly. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.
JETPATCH PRIVACY POLICY — VERSION 4.3 — EFFECTIVE APRIL 22, 2026