Privacy Policy

This policy explains how jejubom (“we”, “us”) handles personal information when you use OrderManagement AI: the website ordermanagementai.com, the web app at console.ordermanagementai.com, the Android app OrderManagement AI (com.ordermanagementai.app), which runs the web app on your phone, and the Android app OrderManagement AI SMS (com.ordermanagementai.sms). Together we call these the “Service”. Our Terms of Service cover how you may use the Service.

1. Who we are

We are the controller of your account information and of the information we use to run and protect the Service.

Much of what is stored in the Service is information a business puts in about other people: its customers, delivery recipients, staff, and the people who text it. For that information, the business is the controller, and we act as its processor to provide the Service. If you are one of those people, please contact that business first. We’ll help it respond.

2. What we collect

We collect information you give us and information created as you use the Service. Some information comes from your phone or browser, and some of that only if you allow it. You need to sign in with Google and agree at sign-up to create an account. The rest of the information in the table is needed only for the features you choose to use.

If you add information about other people (customers, recipients, staff), you must have the right to do so and give them any notice the law requires. Please don’t use the Service for information it isn’t designed for, such as payment card numbers, government ID numbers or health information.

3. The SMS app (OrderManagement AI SMS, Android)

The SMS app sends order texts from your phone to your company’s Inbox. If you allow it, it also lets your company send texts from the web through your phone.

What it uploads

• Texts from the numbers you share. Received and sent texts (SMS and MMS) from the numbers you choose to share, or every text on the phone if you choose to share all. For each text: the message, the other party’s number, the contact name saved on your phone (if you allowed Contacts), the time, whether it was received or sent, SMS or MMS, and a device ID.
• New texts are uploaded as they arrive. Earlier texts: when you start sharing, the app also uploads texts from the shared numbers (or all texts, if you share all) found among the phone’s latest 5,000 SMS and 1,000 MMS messages from the past year, newest first.
• MMS photos: only from MMS messages you receive after you start sharing. Photos in older messages and in messages you send are not uploaded.

What stays on your phone

• Texts from numbers you don’t share.
• Your contacts. The app looks up a name on the phone only to label a text it uploads. Your contact list is not uploaded.
• Call log and recent texts. To suggest numbers you might want to share, the app reads the numbers and times of your last 500 calls and 2,000 texts, on the phone only. They are not uploaded. Only the numbers you pick are saved, as your shared-number list.

Other information the app uses

• Shared-number list: the numbers you share are stored with your account for each company (not encrypted), so the app and the web can show them.
• Device details: Android ID, device model, app version, when the app was installed and registered, last upload and last check-in times, whether text permissions are on, whether Android’s “remove permissions if app is unused” setting is on, upload counts, a push-notification token (and a fingerprint of it), when you logged out, your sending choices and whether the phone is the company’s main phone.
• Push notifications (Firebase Cloud Messaging): to tell you if collection stopped or an update is available, to pass on send requests from the web, and to sync changes to your shared numbers.
• SIM information: phone state is used to handle dual-SIM phones. The SIM slot is sent with each uploaded text but isn’t stored on our servers.
• Crash reports (Firebase Crashlytics): if the app crashes, a crash report is sent to Google, including the error details and technical details such as the app version, device model, Android version and a random installation ID used by Crashlytics. We don’t attach your account ID. The app doesn’t include Firebase Analytics or any advertising tools.
• Sign-in with Google through Android’s Credential Manager.
• Invite links: if you install the app from a company invite link, the app reads the invite code through Google Play’s Install Referrer. QR codes are read on the phone by Google Play services’ code scanner. Updates can be offered in the app through Google Play.
• The app’s data is excluded from Android backups and device-to-device transfers.

Sending texts from the web through your phone

• This works only if the phone’s owner turns on Send texts from the web through this phone in the SMS app. Separately, Send for others as the main phone lets the phone send on behalf of other staff whose phones haven’t allowed sending.
• The web places the recipient number and message in a queue for the phone. They stay there, not encrypted, and are normally deleted within 5 minutes (at most about a day if the phone never picks them up). The phone sends the text as a normal text from its own number over its own carrier plan. We keep the send result for 7 days.
• Sending from the web isn’t available for companies whose country is the United Kingdom.

App permissions

The OrderManagement AI app (Android)

The OrderManagement AI app shows the web app inside an Android app. It collects the same information for the same purposes as the web app, with these differences:

The OrderManagement AI app doesn’t use SMS, contacts or call log permissions. You sign in with your Google account, and the sign-in is kept on the phone. Automatic backup and device-to-device transfer are turned off.

4. How we use it and why

We use personal information only to run the Service as described in this policy. We don’t use it for advertising and we don’t sell it. If you are in the United Kingdom or the European Economic Area, data protection law requires us to tell you the lawful basis for each use.

At sign-up we ask you to confirm that you agree to this policy. If you are in the UK or EEA, that confirmation isn’t the lawful basis for our processing: we rely on the bases in the table above, and on consent only where the table says so. The separate agreement to international transfers is explained in section 7.

Where we rely on legitimate interests, you can object (see section 11). We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. AI analysis only makes suggestions for a person to review.

5. AI analysis

• When: each time someone in your company uses an AI feature, such as Inbox analysis, reading text from photos, or AI bulk-add of customers and products. Inbox analysis can be run only by the owner and by staff the owner has given the “AI analysis” permission.
• What is sent: the texts being analyzed, including the other party’s number and contact name; pasted text; order photos (resized so the longest side is 1,568 pixels) and PDFs; text from spreadsheets (our server converts the first sheet to text); email text and attachments; and the customer and product details the AI needs to match the order, which can include recipient names, phone numbers and addresses. The AI can look up your own customers and products; it doesn’t search other sources.
• Who: Anthropic, PBC is our main AI provider. If Anthropic is unavailable (for example, because of a rate limit, an outage or a network error), the request goes to OpenAI OpCo, LLC instead. Both are in the United States.
• How they use it: under their API terms, these providers state that they don’t use API data to train their models. They may keep it for a limited time, for example to monitor abuse, and longer if it is flagged for a policy violation, under their own terms.
• On our side: the request is stored encrypted while it’s processed, then deleted automatically. A request that is still waiting is deleted after 24 hours; a finished or failed request about 1 hour after it ends.
• Results are suggestions. Nothing is added to your records until someone confirms it.

6. Who we share it with

We don’t sell personal information or share it for cross-context behavioral (targeted) advertising. We disclose it only as follows.

7. International transfers

We are based in the Republic of Korea, and the Service runs on servers in the United States. Using the Service means your personal information is transferred to, stored in, or accessed from these countries, as set out below.

• AI analysis: at sign-up we ask you to agree to the international transfer of your personal information for AI analysis, that is, to content being sent to Anthropic and OpenAI in the United States (section 5). For these transfers, we rely on that agreement.
• Storage in the US and access from Korea: storing data with Google in the United States and operating the Service from Korea are how the Service is provided. The United Kingdom has recognized the Republic of Korea as providing an adequate level of data protection (the Data Protection (Adequacy) (Republic of Korea) Regulations 2022), and the European Commission adopted an adequacy decision for the Republic of Korea in 2021.
• Risks: the United States doesn’t have a single comprehensive data protection law, so US law may not protect your information in the same way as UK or EEA law, and US public authorities may be able to access it.
• Encryption: connections are encrypted (TLS), and company data is stored encrypted with a key unique to your company. This isn’t end-to-end encryption: our servers process the data in readable form to provide the Service (see section 9).
• You can contact us with questions about these transfers (contact us).
• If you don’t want these transfers: storing data in the US and AI analysis are how the Service works, so we can’t provide an account without them. If you later change your mind, you can delete your account (see Delete your account).

8. How long we keep it

We keep personal information while your account or company uses the Service, and delete it when you delete it, delete your account, or the owner deletes the company, except as listed below. Automatic deletions run in the background and can take up to about a day longer than the times shown.

After deletion, remaining copies in Google’s systems are removed through Google Cloud’s own deletion process.

9. Security

• Company data (customers, orders, texts, photos, files and signatures) is encrypted with AES-256-GCM using a key unique to your company. That key is itself encrypted with a key held in Google Cloud Key Management Service, separate from the database. A decrypted company key is kept only briefly (up to 30 minutes) in server memory.
• The copy of your account details we keep in our database (name, email, phone number and photo URL), email app passwords and AI requests are encrypted with a server-held key. Your sign-in record in Firebase Authentication also holds your name, email, phone number and photo URL; Google encrypts it at rest.
• Connections to the Service are protected with TLS.
• Within the Service, only members of your company can access its data, within the permissions the owner sets, and anyone with an invoice link can open that one invoice. Changes and deletions are logged.
• Not end-to-end. Our servers decrypt data to provide the Service (AI analysis, syncing between devices, sending, and troubleshooting), and we, as the administrators of our Google Cloud project, can access the keys.
• Some operational details are not encrypted with the company key: company name (by default made from the sign-up name), country and plan; dates, IDs and status fields that structure your records; your shared-number list; IP addresses and browser types in session, sign-up and change records; the time, direction, device and uploading account of shared texts; texts waiting to be sent (normally deleted within 5 minutes); and test sign-up email addresses. Like all data in Google Cloud, they are still encrypted at rest by Google.
• No system is perfectly secure. If you think your account or data has been compromised, please contact us.

10. Cookies, browser storage and Do Not Track

Our code doesn’t set cookies, and we don’t use analytics, advertising or other tracking tools. The web app uses your browser’s storage for things it needs to work:

• your sign-in state (Firebase Authentication);
• a random session ID (to show your logged-in devices) and a random device ID (for delivery proof);
• a copy of the company data you’ve opened, to make the app faster. It is cleared when you log out, so log out on shared computers;
• small preferences and work in progress, such as view settings, the company chosen for text sharing, an invite code while you join, unsaved entries, and running AI requests.

Google sign-in opens in a Google window, where Google may use its own cookies under Google’s privacy policy. The web app loads its font from jsDelivr (cdn.jsdelivr.net), so that provider receives your IP address and browser details when your browser fetches the font. Other than that, we don’t let other companies collect personal information about your online activities over time and across websites through the Service.

Do Not Track and Global Privacy Control. We don’t track you across websites or over time for advertising, so we don’t change anything in response to Do Not Track signals. We also don’t sell or share personal information, so there is nothing for a Global Privacy Control signal to opt you out of.

11. Your rights and choices

What you can do in the Service

• View and correct most information on the screen where it appears.
• Owners can export company data to Excel: Settings › Company info › Export data. Delivery photos, signatures and uploaded files aren’t included in the export.
• Stop sharing a number, or all texts, in the SMS app (Shared numbers). Log out of the SMS app, or uninstall it, to stop new uploads.
• Log out of all devices: Settings › Account & security.
• Turn off optional permissions (location, contacts, call log, notifications) in your browser or Android settings.
• Delete your account: Settings › Account & security › Delete account. See Delete your account.

If you are in the United Kingdom or the EEA

You have the right to:

• access your personal information and get a copy;
• have inaccurate information corrected (rectification);
• have your information erased;
• restrict how we use it;
• receive it in a portable format, or have it sent to another provider (portability);
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent. This doesn’t affect processing that already happened.

You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113, or, in the EEA, to your local data protection authority. We’d appreciate the chance to address your concern first.

If you are in the United States

Depending on where you live, for example California or another state with a consumer privacy law, you may have the right to:

• know what personal information we have collected about you, and how we use and disclose it, and get a copy in a portable format;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising or profiling. We don’t do any of these;
• limit the use of sensitive personal information. We use it only to provide the Service you ask for;
• not be treated differently for using these rights.

How to make a request

• Email support@ordermanagementai.com, ideally from the email address of the Google account you use with the Service, and tell us your company name.
• To protect your data, we verify requests by checking that you control the account’s email address, and we may ask for more information if needed. You can use an authorized agent; we may ask for your written permission and confirm the request with you directly.
• We respond without undue delay and within the time limits set by law, for example one month under UK GDPR or 45 days under California law. Where the law allows, we may extend this and will tell you why.
• Where California law applies, we confirm receipt of a request to know, correct or delete within 10 business days.
• If we decline your request, we’ll explain why. You can appeal by replying to our answer, and we’ll respond within the time the law requires. If we deny your appeal, you can contact your state Attorney General.
• If your information is in another business’s company data (for example, you are that business’s customer), please contact that business. We’ll help it respond.
• If an update to our Terms or this policy is waiting for your agreement, the app shows only the agreement screen. You can still email us to export your data or delete your account.

12. US state privacy notice (including California)

This section gives additional information that some US state privacy laws require, including the California Consumer Privacy Act as amended by the California Privacy Rights Act. It describes our practices; it isn’t a statement about whether a particular law applies to us.

• Sources: you, your devices and browser, and Google (when you sign in).
• Purposes: to provide, maintain and secure the Service as described in section 4.
• Sale and sharing: we don’t sell personal information and don’t share it for cross-context behavioral advertising, and we haven’t done so. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
• Sensitive personal information: we use and disclose it only to provide the Service you request and for other purposes the law permits, not to infer characteristics about you.
• Retention: see section 8.
• Direct marketing (California “Shine the Light”): we don’t disclose personal information to third parties for their own direct marketing.
• To make a request, see How to make a request.

13. Children

The Service is for businesses and isn’t directed to children. You must be 18 or older to use it, and we don’t knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.

14. Changes to this policy

• We post changes on this page with a new effective date and list them in the history below. We give notice on this page and in the Service at least 7 days before a change takes effect, or 30 days before for important changes (such as adding types of information, purposes or service providers). Wording or procedure updates that don’t reduce your rights can take effect when posted.
• If a change adds types of personal information we collect, adds purposes for using it, or adds recipients of international transfers, we will ask you to agree again on the agreement screen the first time you use the Service after the change takes effect. Until you agree, you can’t use the Service, but your account and data are kept. If you don’t want to agree, email us and we’ll help you export your data and delete your account.

History: September 26, 2026, first version. October 6, 2026 (effective when posted): added the OrderManagement AI Android app and described its permissions and the information it uses (optional location, text shared from other apps, an install record and invite code) at the end of section 3. It collects the same information for the same purposes as the web app. We also changed our contact email to support@ordermanagementai.com. September 29, 2026 (effective when posted): updated section 8 because we now delete more: when someone leaves a company or deletes their account, the texts they shared with it are erased as if they had stopped sharing; stopping sharing also deletes Inbox items not yet turned into orders or shipments; and a test sign-up is deleted with the account. No change to what we collect or why.

15. Contact us