App Privacy Policy
Last updated: 23 August 2026
This policy explains how the JimJam cleaner app handles information about the people who use it for work. It is separate from the privacy policy for this website, which covers enquiries made through our contact form.
The short version
- •When you tap Check in or Check out, the app asks your phone for one fresh location fix.
- •It does not follow you in the background. It does not build a route or a location trail between those actions.
- •Your exact coordinates are kept for 6 months, then deleted.
- •The camera is used only when you choose to attach a photo. A photo is never required.
- •Authorised JimJam office staff can see detailed attendance evidence. Clients cannot see your coordinates, your GPS accuracy or your device time.
- •If you write free text explaining why a task was skipped, its English translation is shown to the client. Please do not put your name or anyone else's personal details in it.
- •You can ask what we hold about you, ask for a copy or a correction, and exercise the other rights below.
Who is responsible
JIMJAM FACILITIES LTD, registered in England and Wales, company number 17066903, registered office 15 Hollydown Way, London E11 4YA.
JimJam Facilities Ltd decides why and how the information described here is used. It is the controller.
For any privacy question or request: hello@jimjam.ai
This website is operated by JimJam AI Ltd (company number 17067064). The app, and the information described in this policy, are controlled by JIMJAM FACILITIES LTD.
Where information comes from
- •You - when you sign in, check in or out, record a task outcome or exception, report an incident, or choose to take a photo.
- •Your phone - a location fix and its accuracy, the device time, and on some Android devices a flag indicating whether the location may be simulated.
- •JimJam office staff - who create your account, assign your visits, and may record a reasoned correction.
- •The app and server - which add the server time and calculate distance from the site, the geofence result and the attendance status.
What the app records, and why
Account details. Your sign-in identity, name, contact details, preferred language, and the sites and visits assigned to you. Used to give you the right account and the right jobs, and to contact you.
Location at check-in and check-out. The latitude, longitude and accuracy of a single fix, taken at the moment you tap the button. Used to compare that fix against the site's saved location and to review attendance where there is a question.
The app does not track your location at any other time. No background collection, no route.
Geofence result. The distance from the site and whether the fix passed the site's radius check. Used to produce a consistent attendance result and to show office staff where a person should look.
Times. The time shown by your device and, separately, the time the server received the event. Two times are kept because phones can be offline or have the wrong clock, and the difference matters when reconstructing what happened.
Location integrity flag. Some Android devices report whether a location may be simulated. This is a signal only. It is not treated as proof that anyone has done anything wrong.
Attendance evidence. Check-in and check-out events, the visit and site, any exception reason you gave, the attendance status, and any correction made by a supervisor with a recorded reason.
Photos. Only when you choose to attach one - to an incident report, or as evidence on a visit. Never required.
Free text you write. Task skip or exception detail, incident descriptions, notes about supplies. Stored in the language you wrote it in, and translated into English so office staff can read it.
For task skip or exception detail only, the English translation is shown automatically to the relevant client. The original-language text stays with JimJam office staff. Please do not include names or personal details in that field.
Why we are allowed to use this information
| What we use | Why | Our legal basis | Extra condition for health information |
|---|---|---|---|
| Account details, site and visit assignments, preferred language | To give you the right account and the right jobs, and to contact you | Contract - Article 6(1)(b) UK GDPR: necessary to perform our work agreement with you | Not applicable |
| Check-in and check-out times, and approved hours | To pay you correctly and keep the pay records the law requires | Legal obligation - Article 6(1)(c): National Minimum Wage Regulations 2015 | Not applicable |
| The location fix at check-in and check-out, its accuracy, distance from site, geofence result, and the location integrity flag | To confirm attendance at the right site, settle questions about a visit, and give clients honest proof that work happened | Legitimate interests - Article 6(1)(f). Our interests are: proving to clients that a visit took place, protecting you from a wrongful accusation about attendance, and spotting service failures. One fix is taken at each tap and no trail is built. You can object - see Your rights. | Not applicable |
| Incident reports, including injuries, and any photos attached to them | To keep the accident records the law requires, manage safety on site, and answer or defend claims | Legal obligation - Article 6(1)(c): Social Security (Claims and Payments) Regulations 1979 and RIDDOR 2013, and Legitimate interests - Article 6(1)(f), where an incident record or photo is kept to manage safety on site or to answer or defend a claim beyond what the law requires us to record. You can object to this - see Your rights. | Article 9(2)(b) - employment, social security and social protection - with the condition in Schedule 1 Part 1 paragraph 1 of the Data Protection Act 2018. Article 9(2)(f) - legal claims - also applies where a record is needed to bring or defend one. We keep an Appropriate Policy Document covering this, available on request. |
| Free text you write, and its translation | So office staff can read and act on what you told them | Contract - Article 6(1)(b) | Not applicable |
| Photos you choose to attach to a visit | To show a client the work was done, where you choose to provide it | Legitimate interests - Article 6(1)(f). Our interest is evidencing completed work. Always optional, never required. | Not applicable |
Who can see what
You see your own jobs, your own submissions and your own attendance outcomes.
Authorised JimJam office staff see the full detail above, including coordinates and both timestamps, to run the service and answer attendance questions.
Clients get a limited view. They see that a visit happened and its verification status. They do not receive your coordinates, your GPS accuracy, your device time or the location integrity flag. The single exception is the English translation of task skip or exception detail, described above.
How long information is kept
| What | How long |
|---|---|
| Your exact coordinates (latitude and longitude of a check-in or check-out) | 6 months from the event, then deleted |
| GPS accuracy, distance from site, and the location integrity flag | 6 months, deleted with the coordinates |
| Attendance and approved-hours evidence, including the geofence pass or fail result | 6 years from whichever is later: the end of the client contract for that site, or the end of your work with JimJam. Minimum-wage law separately requires us to keep pay records, which runs on its own timing. |
| Photos you attach to a visit | 6 years, on the same timing as attendance evidence above |
| Incident records, not including photos | Reviewed at 3 years from the date the entry was made; deleted or anonymised at 6 years, unless a claim, investigation or legal duty means we must keep it longer |
| Photos attached to an incident | Kept only as long as the investigation, insurance or claim needs them, and never longer than 6 years from whichever is later: the end of the client contract for that site, or the end of your work with JimJam. Where an investigation, insurer or claim sets an earlier date, that date applies. |
| Account, sign-in credentials, sessions and contact details | Deleted 90 days after your work with JimJam ends |
| Site assignments and unavailability | Deleted or anonymised 12 months after the assignment ends |
| Machine translations of app content | 90 days from creation |
| Site access material and site documents | Deleted 30 days after the item stops applying |
| Photos attached to a client note | 6 months from upload |
| Billing and invoice records | The invoice record is kept permanently as a business record. Personal details in it, such as your name, are removed 6 years after the end of the VAT period. |
| Records of a privacy request you make | 3 years from the case closing, with restricted access |
Backup copies may persist beyond these periods until they are overwritten in the ordinary backup cycle.
Where your information is processed
Our suppliers process information in the UK and in other countries, including the United States. Where information leaves the UK we rely on the safeguards below. Each supplier processes only on our instructions, under a written data processing agreement.
| Supplier | What they do | Where | Safeguard for transfers out of the UK |
|---|---|---|---|
| Supabase | Database, file storage, sign-in | UK and wherever its sub-processors operate | Standard Contractual Clauses with a UK Addendum |
| Vercel | Hosting for the web portal | Primary region Washington DC, United States; London available | Standard Contractual Clauses and Vercel's UK International Data Transfer Addendum |
| DeepL SE | Translation between English and worker languages | Germany, with AWS infrastructure in the EEA and the United States | Transfers to Germany rely on UK adequacy for the EEA; onward transfers under DeepL's own agreement |
| Resend | Sending email, including client reports | API records stored in the United States | UK Standard Contractual Clauses; Resend participates in the EU-US Data Privacy Framework and its UK Extension |
| Sentry | Error reporting, so faults can be diagnosed | United States | Standard Contractual Clauses |
| Expo | Mobile app builds and delivery | United States | Standard Contractual Clauses |
Translation. Text you write may be sent to DeepL SE. A data processing agreement under Article 28 UK GDPR is in place with DeepL, executed on 31 July 2026.
We do not sell, rent or trade personal information.
Your rights
Under the UK General Data Protection Regulation you have the right to:
- •Access - ask for a copy of the personal data we hold about you
- •Rectification - ask us to correct anything inaccurate
- •Erasure - ask us to delete your personal data, where the law allows
- •Restriction - ask us to limit how we use it in certain circumstances
- •Portability - ask for your data in a machine-readable format
- •Objection - object to certain processing
To exercise any of these, contact hello@jimjam.ai. We will respond within one month.
Some records cannot be deleted on request. Minimum-wage law requires us to keep pay records for six years. We also keep attendance evidence for six years as our own policy, which can run for longer than the law requires. If either applies to your request, we will tell you which records are affected and which of those two reasons applies.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes to this policy
If we change how the app uses your information we will update this page and change the date at the top. Where a change is significant we will also tell you in the app.