Privacy Policy

Last updated 30 October 2026. This is the full version. Nothing important is hidden in small print.

1. Who is responsible

The service at hellojames.io is owned and operated by Golan Europe S.L. ("we"), the data controller for the purposes of the EU General Data Protection Regulation (GDPR).

The software is built and maintained for us by Protremix Technology Limited, who act as our processor, on our written instructions only. More company details are on the imprint page.

For anything about your data, write to legal@hellojames.io.

Contact for anything on this page: privacy@hellojames.io. For legal notices: legal@hellojames.io.

2. Who the data is about

Two different people are usually involved, and they have different rights.

• The account holder. Often an adult child, a spouse, a carer or a social worker who sets the service up and pays for it.
• The person who talks to James. Sometimes the same person, often not. Everything in this policy applies to them as a data subject in their own right, regardless of who is paying.

If you are setting James up for someone else, you are telling us that you have the standing to do so and that you will tell them. James also tells them himself: in the first conversation he says that he is an artificial intelligence, who set him up, and asks whether it is alright to talk. If they say no, he stops. Their refusal overrides the account holder's wishes.

3. What we collect

What we do not collect

• No audio recordings. Speech is processed live and never written to a file on our systems.
• No voiceprint or biometric identification of the person talking to a companion.
• No payment card numbers. Payments are handled by Stripe on Stripe's own checkout page. The card number goes straight to Stripe and never reaches our servers.
• No advertising identifiers, no tracking pixels, no third-party analytics, no social network buttons.
• No requests to Google Fonts or any other font service. Our fonts are stored on our own server.

How we count visits without tracking anyone

We want to know whether the site is helping people, for example how many people tried the demo today. We do this with a simple counter on our own server. When one of these steps happens, a daily total goes up by one: the home page was opened, "try now" was pressed, a demo started, a demo lasted two minutes or more, a sign-in link was sent, someone signed in, a companion was created, a subscription was paid.

That is all it stores: the date, the step, and a number. It stores no IP address, no cookie, no device fingerprint and no identifier of any kind, so it cannot tell who you are or link one step to another. Nothing is sent to any outside analytics company.

4. Cookies

We use one cookie, and only to keep you signed in. It is called "js", it is strictly necessary, and it is deleted when you sign out or after 7 days. We also keep a few small settings in your browser's local storage, such as the language you picked and the fact that you have seen our cookie notice. These never leave your device.

We use no tracking cookies, no analytics cookies and no advertising cookies. Because the one cookie we use is strictly necessary, the law does not require us to ask for consent. Our short notice simply tells you about it.

If you arrive through a friend's invite link, a second cookie, "jref", keeps their short invite code for 30 days so the invite can be counted when you create an account. It holds nothing about you. The friend who invited you sees only that a friend joined or paid, with your e-mail address shortened, never your name or anything you told James.

When you pay, you are taken to Stripe's checkout page on checkout.stripe.com. Stripe sets its own cookies there, for security and fraud prevention, under Stripe's own cookie policy. They are set on Stripe's website, not ours.

The full list, with every name and how long each is kept, is on the cookies page.

5. Health and crisis data, Article 9

Conversations like these unavoidably touch on health, mental state, and sometimes thoughts of dying. Under GDPR Article 9 this is special category data and needs stronger grounds than ordinary personal data.

We process it only on the basis of separate explicit consent, which you give during setup on a screen that says what it is for. It is not buried in a general acceptance of terms. You can withdraw it at any time, and withdrawing it means we delete those notes.

What we do with it: adjust how James speaks, and let him decide whether to contact the family member you named. What we never do with it: sell it, share it with insurers or employers, or use it to build profiles for anything other than this conversation.

6. Legal grounds

The visit counter described in section 3 stores no personal data, so it needs no legal ground under GDPR. To count a visit the server reads the request for a moment and then forgets it; for that moment the legal ground is our legitimate interest in knowing how many people use the site (Article 6(1)(f) GDPR).

7. Where your data is, and who else touches it

Conversation text, memory, profiles and notes are stored on our own server in Helsinki, Finland, inside the European Union. It is a dedicated machine, not shared hosting, provided by Hetzner Online GmbH as our infrastructure processor. For storage, this data does not leave the EU.

Processors we use

These are the only third parties that receive any of your data, each for one narrow purpose, each under a data processing agreement.

Stripe is also responsible in its own right for some of what it does with payment data, for example fraud prevention and meeting financial laws. That part is described in Stripe's own privacy policy at stripe.com/privacy.

Public sources James reads from

When James looks something up in the real world, he queries open public services. These receive only the query, never who is asking, and never anything from the conversation beyond the search term itself.

• OpenStreetMap (Nominatim and Overpass), for finding a clinic, pharmacy or library nearby. Receives an approximate area, not an identity.
• Open Library and Wikisource, for books and poems.
• TheMealDB, for recipes.
• Brave Search and DuckDuckGo (web search), Wikipedia and Wikidata, public news feeds, the openFDA medication database and Open Food Facts, for questions about the world. They receive only the search words.

We use these deliberately instead of letting a language model invent an answer. An invented clinic address given to someone who needs a doctor is not a minor error.

8. How long we keep it

• Conversations and memory: for as long as the account is active. Memory is the product; deleting it after thirty days would mean James forgets the person, which is the one thing he must not do.
• After you cancel: 30 days, then permanent deletion. The window exists so a cancellation by mistake, or a family dispute, does not destroy years of memory irreversibly.
• On a deletion request: we delete without waiting, normally within 72 hours.
• Technical logs: 90 days.
• Billing records: as long as Spanish tax and accounting law requires, which is generally up to six years.
• Visit counter: daily totals only, with nothing personal in them, so there is nothing to delete about you.
• At OpenAI: under their standard API terms, content may be retained up to 30 days for abuse monitoring and then deleted.

9. Your rights

Under GDPR you can ask us to:

• Show you everything we hold, in a readable file (Articles 15 and 20)
• Correct anything wrong (Article 16). James has this built in too: the person can tell him he has a memory wrong, and he removes it. Being confidently wrong about someone's own life is harmful, not just inaccurate
• Delete everything (Article 17)
• Restrict or object to processing (Articles 18 and 21)
• Withdraw consent for health and crisis notes at any time (Article 7(3))

Write to privacy@hellojames.io. We answer within 30 days and usually much faster. There is no charge.

If you think we have handled your data badly, you can complain to the data protection authority in the country where you live or work. Because we are a Spanish company, our lead authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

How to delete your account and all of its data, step by step: hellojames.io/delete-account.

10. Automated decisions

James decides by himself whether a situation is serious enough to message the family member you named. We are telling you plainly because it is an automated decision that affects a real person.

What it can do: send the message you authorised, to the contact you gave, and say the emergency number out loud. What it cannot do: call emergency services on your behalf, contact anyone you did not name, or make any decision about money, medicine or care. If a message fails to send, James says so out loud rather than letting anyone believe help is coming.

11. Children

You can read all your child’s conversations with James. If there is danger, you are told at once. Text is kept until you delete the child or account. Older conversations may contain only summaries or partial text. Duration is the observed text span; conversations without a session ID are grouped by a 15-minute gap. The service can be set up for a child, and the account must then be held by a parent or legal guardian, who gives consent under Article 8. We do not knowingly create accounts for children on their own. If you believe a child has an account without a guardian, write to privacy@hellojames.io and we will remove it.

The James app on Google Play is for adults (18+). A James for a child can only be set up on the website, by a parent or legal guardian.

12. Security

Summarised here, described in full on the security page: encrypted connections only, every database encrypted at rest with SQLCipher, each person reachable by their own private link, no audio at rest, access to the server limited to key-based administration, and an automated test on every code change that confirms one person's memory cannot be reached from another's link.

We do not sell your conversations, we do not share them with third parties for their own purposes, and we do not use them to train any model. The one exception we cannot promise away: if a court or a competent authority compels disclosure under the law, we must comply. That is true of every company in the EU, and we would rather write it here than let you assume otherwise.

13. If something goes wrong

If there is a personal data breach that puts people at risk, we notify the relevant supervisory authority within 72 hours and tell affected people directly, in plain words, including what was taken and what to do about it.

14. Changes

If we change this policy in a way that matters, we will email account holders before it takes effect, not after. The date at the top always reflects the current version.