Privacy Policy

This Privacy Policy describes how Joby ("Joby," "we," "us," or "our") collects, uses, discloses, and protects information when you use our website, CRM platform, mobile apps, calling and messaging tools, and related services (collectively, the "Service"). This policy covers two different categories of data: - Account and website data: information about prospective customers, account owners, and authorized users (for which Joby generally acts as the business/controller). - Customer Data: information our business customers upload or process in the Service about their own leads, contacts, customers, recordings, messages, and jobs (for which Joby generally acts as a service provider/processor on the customer's behalf). If you are an end customer of a business that uses Joby, please contact that business directly for questions about how they use your information.

We collect information you provide directly, information collected automatically, and information processed through your use of the Service. Examples include: - Account and profile information: name, email address, phone number, company name, login credentials, and role/permissions. - Billing and transaction information: billing contact information and subscription/payment details (processed by payment providers such as Stripe; Joby does not store full payment card numbers). - Customer Data you upload or generate: leads, contacts, notes, estimates, job records, dispatch data, attachments, and communications content. - Call and messaging data: call metadata, recordings, voicemails, transcriptions, message content, sender/recipient numbers, timestamps, and delivery status when those features are enabled. - Location and time tracking data: clock-in and clock-out times, break times, job associations, hourly rates, payroll report fields, clock-in/out GPS proof, live location route points while a worker is clocked in and enabled for live tracking, timestamps, accuracy, device/app metadata, and related audit logs. - Device and usage data: log files, IP address, browser type, device identifiers, operating system, app version, pages/screens visited, features used, and actions taken. - Support and communications data: messages you send to support, onboarding details, and feedback.

We use information to: - Provide, operate, maintain, and improve the Service - Authenticate users and secure accounts - Process subscriptions, invoices, and payments - Deliver calling, messaging, transcription, scheduling, and CRM features - Deliver time tracking, live dispatch, GPS proof, workforce reporting, and job verification features when enabled by your organization - Respond to support requests and communicate service updates - Monitor performance, troubleshoot issues, and detect fraud, abuse, or security incidents - Comply with legal obligations and enforce our Terms of Service We do not sell Customer Data you store in the Service. We do not use Customer Data to build advertising profiles or for cross-customer marketing.

Where privacy laws such as the GDPR/UK GDPR apply, we rely on one or more of the following legal bases depending on the context: - Performance of a contract (for example, providing the Service you requested) - Legitimate interests (for example, security monitoring, product improvement, and fraud prevention) - Consent (for optional marketing communications or optional features where required) - Compliance with legal obligations Business customers are responsible for identifying the appropriate legal basis for the Customer Data they collect and process using Joby.

We share information only as reasonably necessary to operate the Service and comply with law, including with: - Service providers and subprocessors that host infrastructure, support communications, payments, analytics, and product functionality. A current list of subprocessors is published at /subprocessors. - Your organization's administrators and authorized users, according to your account settings and permissions - Professional advisors (such as legal, accounting, or security consultants) under confidentiality obligations - Government authorities or law enforcement when required by valid legal process or to protect rights, safety, and security - A successor entity in connection with a merger, acquisition, financing, or sale of assets (subject to appropriate safeguards) We require service providers to handle data under contractual restrictions and to use appropriate safeguards for the services they provide. Business customers may review the Data Processing Addendum at /data-processing-addendum and the current Subprocessor list at /subprocessors.

Joby provides tools that may be used to place calls, send messages, and record or transcribe communications. You are responsible for using these features in compliance with applicable laws and regulations, including consent requirements for calls, texts, recordings, and marketing communications. You are responsible for: - Obtaining any required consent before sending messages or placing calls - Honoring opt-outs and do-not-contact requests - Providing any legally required notices for call recording or transcription - Using approved messaging routes and registrations where required (for example, A2P/10DLC) Joby processes communications data to deliver the requested features and to maintain and secure the Service. Additional communications requirements are published at /communications-policy.

Joby includes optional workforce time tracking, GPS proof, and live location features for business customers. When these features are enabled: - Workers may clock in, clock out, take breaks, associate time with jobs/leads, and generate time-clock records used by their organization for operations, reporting, and payroll review. - Clock-in and clock-out events may include GPS proof, timestamp, accuracy, job/lead association, and related audit metadata. - Live location tracking runs only for workers whose organization has enabled the live tracking seat and only while the worker is clocked in. It may collect location in the background when the app is closed or not on screen. - Authorized organization administrators, dispatchers, and managers may view live work location, route history within the configured retention window, time-clock entries, and reports according to their permissions. - Raw live route points are retained according to the organization's selected setting, currently 7, 14, or 30 days. Time-clock records, GPS proof attached to clock events, reports, exports, and audit logs may be retained longer as Customer Data. Business customers are responsible for providing any employee, contractor, bring-your-own-device, privacy, wage/hour, and workforce monitoring notices or consents required by law before enabling these features. A customer template is available at /employee-monitoring-notice-template. Workers who do not want live location tracking should not clock in with that feature enabled and should contact their organization administrator or manager.

We use administrative, technical, and physical safeguards designed to protect information, including access controls, encryption in transit, encryption at rest (where supported by our providers), logging, and monitoring. No method of transmission or storage is completely secure, and no service can guarantee absolute security. If we become aware of a confirmed security incident affecting personal information in our systems, we will investigate, take reasonable steps to contain and remediate the issue, and provide notifications as required by applicable law and contractual commitments.

We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. In general: - Account and billing records are retained for business, tax, and compliance purposes - Customer Data is retained according to your subscription and product settings - Raw live location route points are retained according to your organization's selected setting, currently 7, 14, or 30 days, and are then scheduled for deletion from active systems - Clock-in/out records, payroll reports, GPS proof attached to time entries, audit logs, and exported reports are retained as Customer Data according to your account, legal, and product settings - After account termination, we generally provide a limited period (typically up to 30 days) for export before deletion from active systems, unless otherwise required by law or agreement - Backup copies may remain for a limited period before being overwritten as part of routine backup cycles

Joby AI features may process prompts, transcripts, call audio, messages, estimates, notes, job records, and other Customer Data to provide AI voice agents, transcription, summaries, message drafts, estimate copy, chat, and workflow assistance. AI output should be reviewed by an authorized human before use. Additional AI-specific terms are published at /ai-terms. AI assistant connections. Company owners and admins may connect an AI assistant such as Claude to their Joby company using "Sign in with Joby". When they do, the assistant can read, and only read, that company's CRM data (leads, customers, appointments, tasks, estimates, invoices, payments and settings reference data) through Joby's API in order to answer the user's questions. The assistant provider receives the data returned for each question and handles it under its own privacy policy. Joby logs each request (user, company, tool and time) for security and support, does not receive the user's conversations with the assistant, and stops sharing data the moment the connection is revoked in Joby or in the assistant.

Depending on your location and relationship to Joby, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. If we process your information on behalf of one of our business customers, we may direct your request to that customer so they can respond as the data controller/business. You may also: - Update account/profile information in your account settings - Opt out of non-essential marketing emails using the unsubscribe link - Contact us to request account deletion (subject to legal and contractual requirements) To submit a privacy request, contact privacy@joby.io.

We use two categories of cookies: - Essential cookies: required for authentication, security, session management, and core Service functionality. These are set as soon as you visit and cannot be disabled while using the Service. - Non-essential cookies: analytics, marketing, and conversion tracking on our public marketing website (joby.io). These include Google Tag Manager / Analytics, Apollo, and Meta Pixel. We do NOT load these until you click "Accept" on the cookie banner that appears on your first visit to joby.io. If you click "Decline" or never click anything, no non-essential trackers are loaded. You may change your choice at any time by clearing the joby_cookie_consent value from your browser's local storage and reloading the page. We do not use non-essential cookies on the logged-in app at app.joby.io. You can also control cookies through your browser settings. Disabling certain essential cookies may prevent the Service from working.

Joby and our service providers may process information in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers, such as contractual protections and other legally recognized transfer mechanisms.

The Service is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact privacy@joby.io so we can review and delete it where appropriate.

If you are a California resident, you have the following rights regarding personal information that Joby controls (account holders, prospects, and marketing visitors — not Customer Data, which is controlled by your business): - Right to know what personal information we collect, use, disclose, and (where applicable) sell or share - Right to access a copy of your personal information - Right to correct inaccurate personal information - Right to delete personal information (subject to legal exceptions) - Right to opt out of any "sale" or "sharing" of personal information - Right to limit use of sensitive personal information - Right not to receive discriminatory treatment for exercising these rights We do not sell personal information for money. We do load advertising and analytics cookies on our marketing website ONLY after you opt in via the cookie banner. Under the CCPA's broad definition of "sharing" for cross-context behavioral advertising, declining the cookie banner is your opt-out signal. We honor Global Privacy Control (GPC) signals from browsers that send them. The Service may process precise geolocation as sensitive personal information when a business customer enables GPS proof or live location tracking. We use that information only to provide the requested Service features, maintain security, comply with law, and support the business customer's lawful instructions. We do not sell or share precise geolocation for cross-context behavioral advertising. To submit a CCPA request, email privacy@joby.io with "California Privacy Request" in the subject line. We respond within 45 days. We may verify your identity before fulfilling the request to protect your information.

If you are a Joby business customer subject to GDPR, UK GDPR, CCPA, or other privacy laws, review the Data Processing Addendum at /data-processing-addendum. To request a countersigned DPA, email legal@joby.io. Feature-level retention details are published at /data-retention.

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. If we make material changes, we may provide additional notice (such as by email or in-product notice) where required.

Privacy questions or requests: privacy@joby.io California Privacy Requests: privacy@joby.io (subject "California Privacy Request") Legal questions: legal@joby.io General support: support@joby.io Joby CRM LLC 1180 South Beverly Drive Los Angeles, CA 90035 United States