This Privacy Policy explains how Rabbit’s Hat LLC (registered in Wyoming, USA as “Rabbits Hat LLC”; Bangladesh office:
Jogajog, Chinishpur, Narsingdi Sadar, Narsingdi 1602; Trade Licence No. CUP0414) handles personal data in connection with Jogajog.
It is written to satisfy global good practice (GDPR-grade standards) and applies to all users worldwide.

1. What Jogajog is; who we are

Jogajog is a private organization directory and communication service. Organizations (our customers) load their member rosters;
members use the app to find and reach colleagues and receive organizational communication.

For Member directory data (names, photos, designations, contact details, custom fields, organizational-unit membership): the
Customer organization is the data controller; we are the data processor acting on its instructions.
For account, billing and usage data of Customers and administrators, and for visitors to our own websites: we are the data controller.
Members with questions about why they are listed, or what is visible, should contact their organization’s administrator first; we support the organization in fulfilling such requests.

2. Data we process

Category	Examples
Member profile data	Name (English and Bangla), photo, designation, phone numbers, email, WhatsApp availability, address, organization-defined custom fields (e.g., blood group, batch year)
Structure data	Organizational Units, roles, memberships
Communication data	Broadcast content, recipient lists, delivery/read status; SMS metadata required for billing and troubleshooting
Account & billing data	Administrator identity, organization details, invoices, payment references and gateway transaction IDs. We do not store card or mobile-wallet credentials — online payments are handled by our licensed payment gateway partner Paystation and its banking partners.
Consent records	The version and time at which an administrator accepted the Terms & Conditions, Return & Refund Policy and Privacy Policy at checkout
Technical data	Device/browser type, IP address, app version, crash reports, security logs
Usage analytics	Feature usage events, aggregated and pseudonymized where feasible

3. Purposes and legal bases

Providing the Service (contract performance): hosting directories, executing searches, delivering communications, billing and payment processing, dues collection where enabled.
Security and abuse prevention (legitimate interest): logging, rate limiting, tenant-isolation enforcement, fraud detection.
Service improvement (legitimate interest / consent where required): aggregated analytics, performance measurement.
Legal compliance: tax, accounting, lawful requests from authorities.

We do not sell personal data. We do not show advertising. We do not use Member personal data for advertising or for any purpose outside the service, and we do not use Customer Data to train machine-learning models.

4. Visibility of Member data

Who can see a Member’s details is controlled by the Customer’s visibility rules and, where enabled, by the Member’s own profile settings.
Directory data is never public on the open internet by default; it is visible only to authenticated users of the same organization according to those rules.

5. Sharing and sub-processors

We share personal data only with (a) processors required to run the service — hosting provider, SMS/WhatsApp/email delivery providers,
push notification service, error-tracking service and payment processors (including Paystation for online payments) — each bound to
that purpose by data-protection terms; (b) authorities where legally required; (c) a successor entity in a merger or acquisition, under
the same commitments. We give at least 30 days’ notice before adding a sub-processor that processes Member personal data.

6. International transfers

Data is hosted in Singapore. Where data is transferred across borders, we use recognized safeguards (contractual data-protection clauses
with sub-processors) and maintain the same protections regardless of location.

7. Security

Encryption in transit (TLS) and at rest; organization data is isolated at the database layer and verified by automated tests on every software change.
Sign-in is by passwordless one-time codes; administrative actions are recorded in an append-only audit log; support access to tenant data only with recorded consent.
Backups run nightly with integrity verification. Report vulnerabilities to security@jogajog.app.

8. Data breach notification

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal
data, we will notify affected Customers without undue delay and no later than 72 hours after confirmation, with the information needed for the
Customer to meet its own notification duties.

9. Retention and deletion

Data is retained while your organization’s account is active. On closure: days 0–30 the account is read-only and administrators can export all
data; days 30–60 data is retained but inaccessible except by written request of the Customer’s authorized signatory; on day 60 production deletion
is executed and confirmed in writing; by day 95 deleted data has aged out of the encrypted backup rotation.

Data category	Retention
Member profile & structure data	Life of subscription; customer-deleted records soft-deleted 30 days, then hard-deleted
Broadcast content & delivery logs	13 months
Invoices, payment records, checkout consent records	7 years (statutory accounting/tax retention)
Security & audit logs	24 months
Crash/diagnostic data	90 days
Support tickets	36 months, then anonymized
Marketing-site analytics	14 months, consent-based

10. Your rights and choices

Members: access, correction, deletion and objection rights are exercised through the organization’s administrator; where the organization
is unresponsive, contact legal@jogajog.app and we will assist within the limits of our processor role. Members
may claim and edit their own profile where the organization enables self-service, and may submit in-app update requests.
Customers and administrators: may access, correct, export or delete their account data by contacting support@jogajog.app. Organizations can export all their data at any time.
We honor applicable statutory rights (including GDPR-style rights for EEA/UK users and rights under US state privacy laws such as the CCPA/CPRA), without discrimination for exercising them.

11. Children

The Service is not directed to children. Organizations that list minors in a directory (e.g., schools) are responsible for the lawful basis to do so,
must restrict visibility appropriately, and must not enable self-service accounts for children below the age of digital consent in their jurisdiction.

12. Cookies and similar technologies

The web application uses strictly necessary cookies (session, security) only. This marketing site uses a language-preference cookie and, where
enabled, optional analytics cookies subject to consent. We do not use third-party advertising cookies anywhere.

13. Changes; contact

Material changes will be notified to administrators 30 days in advance. Data protection contact: legal@jogajog.app ·
Rabbit’s Hat LLC — Jogajog (যোগাযোগ), Chinishpur, Narsingdi Sadar, Narsingdi 1602, Bangladesh · +880 1342-292469 ·
Registered office: 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Support: support@jogajog.app.