Privacy

This page adds to the Żabka Jush privacy policy (Jush, Delio and Alcostore) what happens to data when you connect an AI assistant (such as Claude or ChatGPT) to your Jush account. The controller is Lite e-Commerce sp. z o.o.. Everything not described here, including how to reach the data protection officer, your rights and transfers outside the EEA, follows the Jush privacy policy. Wersja polska.

What we process

• Your Jush account id (Firebase uid), to recognise your connections.
• Encrypted Jush session tokens, so the assistant works without signing in again.
• Per connection: the app's name, the date you connected it and the permissions you granted, plus your default service if you pick one.
• During sign-in: your phone number and a temporary sign-in token (on servers in the EU, deleted once the code is verified), the date of birth on your Jush account to check that you are 18 or older (not stored), and your IP address for sign-in rate limits and bot protection.
• Technical logs, usage statistics and error reports without personal data: your account id, the tool name, its result, the time and the app's name.

We do not store your name, e-mail, delivery addresses or bank account number, nor the content of conversations, tool arguments or Jush responses. The server passes them between the assistant and Jush.

Purposes and legal basis

Providing the service you asked for (Art. 6(1)(b) GDPR), and security, abuse prevention and fixing errors (Art. 6(1)(f) GDPR). Nothing is used for advertising.

Who receives data

• The AI assistant you connect (e.g. Anthropic for Claude, OpenAI for ChatGPT) receives the tool results you ask for, under its own privacy policy.
• Google Firebase (sign-in), Cloudflare (hosting, bot protection), Sentry (error reports).

These providers may process data outside the EEA under standard contractual clauses or a European Commission adequacy decision.

How long we keep it

• A connection lasts until you disconnect it; one unused for 90 days expires by itself. When you disconnect, we delete its session tokens.
• Phone number and sign-in token: at most 10 minutes. SMS rate-limit counters: at most 24 hours after the last SMS.
• Logs, statistics and error reports: up to 3 months.

Your rights

• Disconnect an app at Connected apps or in the assistant's settings. Logging out of the Jush app does not disconnect it.
• For your rights of access, rectification, erasure, restriction, objection and portability, write to the data protection officer: daneosobowe@lite.tech. You may also complain to the Polish data protection authority (Prezes UODO).