Privacy Policy

1. Who We Are & Applicable Law

The Joshou platform is owned and operated by AgileCatalyst.AI Ltd ("we", "us"), incorporated in the Dubai International Financial Centre (DIFC), Dubai, UAE. We operate the website and platform at joshou.ai. We are the data controller for personal data processed through our website, sign-in, and account administration; for content and site data you bring into the platform, we act as a data processor on your instructions.

This policy is issued in compliance with the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020) and its accompanying regulations, which is our primary applicable law as a DIFC-registered entity. Where we serve individuals in the European Economic Area (EEA) or the United Kingdom, we additionally apply GDPR-equivalent standards as set out in this policy.

We do not currently meet the threshold requiring mandatory appointment of a Data Protection Officer (DPO) under DIFC DP Law 2020. All privacy enquiries are handled directly at compliance@agilecatalyst.ai.

2. Data We Collect

• Account data — your name, email address, and profile photo, from Google sign-in.
• Google Search Console & Analytics data — when you connect a site, you grant Joshou read-only access to that property's search performance and analytics data via Google's own OAuth consent screen, revocable at any time from Settings.
• Site & content data — brand voice, money pages, topics, and articles you configure or generate within the platform.
• Billing data — plan, subscription status, and payment metadata via Stripe; we do not store your full card number ourselves.
• Usage data — pages visited, session activity, and generation/API usage needed to enforce your plan's limits and improve the product.

3. How We Use Your Data

• To authenticate you and operate your organization's account.
• To generate AI-drafted articles and SEO Console reports for the sites you connect.
• To process billing and manage your subscription.
• To improve platform features and website experience.
• To send product updates and relevant communications where you have provided consent or where we have a legitimate interest.
• To comply with legal and regulatory obligations under DIFC law.

4. Processing Conditions (DIFC DP Law 2020) & Legal Bases (GDPR)

Under the DIFC Data Protection Law 2020, we process personal data on the following conditions, which also correspond to GDPR lawful bases for EEA/UK individuals:

• Performance of a contract — processing necessary to deliver platform access and the subscription you signed up for.
• Legitimate interests — analytics, platform security, and business communications, where these do not override your rights and freedoms.
• Consent — marketing communications, and the Google OAuth grant you make when connecting a Search Console/Analytics property. You may withdraw either at any time.
• Legal obligation — where required by applicable DIFC or UAE law.

5. Data Retention

Account and contact data is retained for the duration of your relationship with us plus three (3) years. Site, topic, and article data is retained for as long as your organization's account is active, plus 30 days after cancellation to allow data export. Analytics data is retained for up to 26 months.

6. Sub-Processors & International Transfers

We use the following categories of sub-processors, which may process data outside the DIFC or EEA: cloud hosting and database (Vercel, Neon), AI drafting (Anthropic, and Groq as an automatic fallback — or your own Anthropic account if you supply an API key on the Agency plan), authentication and connected-property data (Google), and billing (Stripe). Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or transfers to jurisdictions recognized as providing adequate protection. We do not sell personal data to third parties.

7. Your Rights

Under the DIFC Data Protection Law 2020, you have the right to: access your personal data; request correction of inaccurate data; request deletion in certain circumstances; object to processing based on legitimate interests; and request portability of data you have provided to us in structured, machine-readable form. You can revoke a connected Google Search Console/Analytics grant at any time from Settings, and disconnecting there deletes the stored credential.

If you are in the EEA or UK, you additionally have the right to restrict processing and to withdraw consent where processing is based on consent.

To exercise any of these rights, contact compliance@agilecatalyst.ai. We will respond within 30 days.

8. Security

We implement industry-standard technical and organizational measures to protect personal data, including encryption of stored OAuth credentials and API keys. If you believe your data has been compromised, contact us immediately at compliance@agilecatalyst.ai.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the DIFC Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by DIFC DP Law 2020. Where the breach poses a high risk to affected individuals, we will also notify those individuals without undue delay.

10. Cookies

We use essential cookies for sign-in and site operation (including remembering which of your sites the topbar switcher has selected) and, where you consent, analytics cookies. You can manage cookies through your browser settings at any time.

11. Complaints

If you are located in the DIFC or UAE, you have the right to lodge a complaint with the DIFC Commissioner of Data Protection. If you are in the EEA, you may contact your national data protection supervisory authority. We would appreciate the opportunity to address your concerns directly first — please contact us at compliance@agilecatalyst.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and notify you of material changes via email or a website notice at least 14 days before they take effect.

13. Contact & Data Controller

AgileCatalyst.AI Ltd (operating as Joshou)
1 Innovation Hub, DIFC, Dubai, United Arab Emirates
compliance@agilecatalyst.ai