Privacy Policy

1. Who is responsible for your data

This policy explains how JEEKSSHIRE 24 FZE LLC processes the personal data of visitors in the European Union and European Economic Area. It is the controller under Art. 4(7) of Regulation (EU) 2016/679 (GDPR).

• Controller: JEEKSSHIRE 24 FZE LLC, a Free Zone Establishment of the Ajman NuVentures Centre Free Zone, Government of Ajman, UAE, licence and registration number 2624416735888.
• Registered office: Office CWS-1V-227119, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, UAE.
• Privacy contact: 024ismo@gmail.com — for requests under Arts. 15 to 22 GDPR.
• Website covered: https://jeeksos.com.

2. What this policy covers

It covers jeeksos.com as it exists today: a pre-launch informational site with a contact form. The website has no user accounts, no passwords, no sign-in with Google or any other identity provider, no payments, no analytics, no advertising, no tracking pixels and no profiling.

3. Personal data we process

• Contact-form data — the name, e-mail address, topic (General, Support, Partnership or Other) and message you type, and the time of submission. Supplying it is voluntary; without an e-mail address we cannot reply.
• Mail-delivery log entries — timestamp, recipient, topic, delivery status and message identifier, logged when your message is sent on.
• Anti-spam data — a request counter keyed to a hashed form of your IP address, in temporary storage, and a hidden honeypot field.
• IP address for language detection — sent to an external service to resolve the country, solely to pick the default language. The result returns to your browser and is not stored by us.
• Server logs — nginx access and error logs: IP address, timestamp, requested URL, HTTP status, user agent, referrer.
• Access gate — a PHP session cookie, josgate, recording that a visitor passed the pre-launch password gate.
• Connection data disclosed when web fonts load (section 5).

We process no special categories of data (Art. 9) and no criminal-offence data (Art. 10).

4. Purposes and legal bases

Processing	Purpose	Legal basis
Contact form	Answering your enquiry and recording it	Art. 6(1)(f), our interest in replying to people who write to us; Art. 6(1)(b) where the enquiry concerns pre-contractual steps taken at your request
Mail-delivery logs	Confirming delivery, diagnosing failures	Art. 6(1)(f) — a reliable contact channel
Honeypot and per-IP rate limit	Blocking automated spam and abuse	Art. 6(1)(f) — information security
IP-to-country lookup	Choosing a language you can read	Art. 6(1)(f) — a comprehensible interface; nothing stored
Server logs	Running the server, detecting faults, resisting attacks	Art. 6(1)(f) — availability
Pre-launch access gate	Keeping unreleased material non-public	Art. 6(1)(f) — control over our own material
Web fonts	Consistent typography	Art. 6(1)(f) — see the trade-off in section 5

No processing here rests on consent under Art. 6(1)(a): nothing non-essential is stored on your device. Art. 6(1)(c) applies only where a lawful order obliges us to retain or disclose data. Under Art. 6(1)(f) we weighed our interest against your rights — the data is minimal, you are not profiled, and you may object under Art. 21.

5. Recipients

Recipient	Role	Data involved
SMTP.bz	E-mail delivery (processor)	Contact-form content in transit to our inbox
ip-api.com	IP-to-country lookup (processor)	Your IP address, at page load
Google LLC	Google Fonts (independent recipient)	Your IP address and user agent when your browser fetches fonts from fonts.googleapis.com and fonts.gstatic.com
DigitalOcean	Hosting of the origin (processor)	All website data; the server is in Frankfurt, Germany
Timeweb	Entry proxy, St Petersburg, Russia (processor)	Requests from visitors in Russia only; terminates TLS, forwards to the origin, stores no content. EEA visitors reach Frankfurt directly
Cloudflare	DNS and geo-routing (processor)	DNS queries only; in DNS-only mode, page traffic is not proxied through it

We do not sell personal data, do not share it for advertising, and disclose it to no one else except under legal obligation.

On Google Fonts. Because fonts are fetched from Google's servers rather than ours, your IP address reaches Google LLC whenever a page loads. We have no contract with Google giving us control over that disclosure, and German courts have criticised this pattern; we flag it rather than bury it. Blocking third-party font requests prevents it.

6. International transfers

The controller is established in the United Arab Emirates, for which the European Commission has issued no adequacy decision under Art. 45 GDPR. Most website data nonetheless stays inside the EEA: the origin server is in Frankfurt, Germany, where contact-form submissions and server logs are handled.

For transfers that do leave the EEA — access by our staff in the UAE, the Russian entry proxy, and non-EEA providers — we rely on the Standard Contractual Clauses adopted by the European Commission under Art. 46(2)(c) GDPR. We ran a transfer impact assessment before relying on them and apply supplementary measures: TLS in transit, access limited to those who must read enquiries, and minimisation. The Google Fonts disclosure in section 5 is not covered by those clauses, which is why we name it separately. Ask at 024ismo@gmail.com for detail on these safeguards.

7. Retention

Data	Kept for
Contact-form e-mails and ensuing correspondence	While the enquiry is handled, then up to 24 months, then deleted
Mail-delivery log lines	12 months
Anti-spam rate-limit counters	1 hour, rolling, then discarded
nginx server logs	30 days
josgate session cookie	The browser session only
jos.lang in localStorage	Until you clear your site data

8. Security

In line with Art. 32 GDPR we encrypt all traffic with TLS, limit access to enquiries to those who must read them, collect only what the stated purposes require, rate-limit the contact form, and set the access-gate cookie HttpOnly, Secure and SameSite=Lax so scripts cannot read it and it is not sent across sites — measures suited to a site holding no accounts, passwords or payment data.

9. Cookies and local storage

Art. 5(3) of the ePrivacy Directive 2002/58/EC requires consent before information is stored on or read from your device, unless that storage is strictly necessary for a service you asked for. We set no advertising, analytics or tracking cookies, so no consent banner is needed. Two items are stored: the josgate session cookie, strictly necessary for the pre-launch gate, and jos.lang in localStorage, which remembers your chosen language and never leaves your device. See our Cookie Policy.

10. Your rights

Subject to the GDPR's conditions you may: obtain access to your data and a copy of it (Art. 15); have inaccurate data rectified (Art. 16); have data erased (Art. 17); obtain restriction of processing (Art. 18); have rectification, erasure or restriction notified to recipients (Art. 19); receive your data in a portable machine-readable format where processing is automated and based on consent or contract (Art. 20); object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) (Art. 21); and not be subject to solely automated decisions with legal or similarly significant effects (Art. 22 — we take none). Where processing ever rests on consent you may withdraw it under Art. 7(3), without affecting what was lawfully done before.

11. How to exercise them

Write to 024ismo@gmail.com and say what you want. We reply within one month, extendable by up to two further months for complex requests, in which case we give the reason within the first month (Art. 12(3)). Requests are free of charge (Art. 12(5)). If we cannot identify you from the data we hold, we will say so rather than gather more to find you.

We have not yet designated a representative in the Union under Art. 27 GDPR. Until one is appointed, send every request to the company address above; it is monitored, and no request will be refused for want of a representative. We have not appointed a Data Protection Officer: Art. 37(1) does not require one here, as our core activities involve no large-scale regular and systematic monitoring and no special categories of data. Privacy matters are handled by company management.

12. Complaints

We would like to hear from you first, but under Art. 77 GDPR you may lodge a complaint with a supervisory authority — in particular that of your habitual residence, your place of work, or the place of the alleged infringement. The national authorities are listed at https://edpb.europa.eu/about-edpb/about-edpb/members_en. You also have the right to a judicial remedy under Arts. 78 and 79.

13. Children and automated decision-making

This website addresses adults and professionals. We do not knowingly collect data from children, and the contact form is the only way to send us anything at all. If you believe a child has written to us, tell us and we will delete it. We also carry out no automated decision-making and no profiling under Art. 22 GDPR: nothing scores, ranks or classifies you, and the language detection selects a display language, nothing more.

14. Changes to this policy

When this policy changes we replace the published version and update the date below. If a change materially affects data we already hold from you — a new purpose, a new recipient, or longer retention — we will tell you by e-mail, where we have an address, before it takes effect.

15. The Jeeks OS application

Jeeks OS is a social and creative operating system for creative professionals: portfolio and professional profile, creative jobs and projects, a social feed, messaging and communities, a marketplace, AI and creative tools, and knowledge sharing — announced for macOS, iOS, the browser, Windows and Android. It has not launched. No accounts, published portfolios, messages or marketplace transactions exist, so none of that data is collected today. Service-specific processing begins only at release and will be governed by this policy as updated then, with the new categories, purposes, legal bases and retention periods set out before you are asked to use it.

This version of the Privacy Policy is dated 11 September 2026.

1. Who handles your personal information

The business responsible for the personal information described here is JEEKSSHIRE 24 FZE LLC, a Free Zone Establishment registered with the Ajman NuVentures Centre Free Zone (Government of Ajman, UAE) under licence and registration number 2624416735888, at Office CWS-1V-227119, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates. We operate jeeksos.com and are building the Jeeks OS application.

For any privacy matter — questions, rights requests, complaints — write to 024ismo@gmail.com, the single monitored channel for everything below. A Data Protection Officer is not required here: we conduct no large-scale monitoring and hold no sensitive personal information, so none has been appointed and the company answers requests itself.

2. Scope

This is the United States version of our privacy policy, written for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and applying equally — with the differences in section 8 — to residents of Virginia, Colorado, Connecticut, Utah and Texas. It covers what jeeksos.com collects today.

3. Notice at collection: categories of personal information

These are the CCPA categories we have collected in the preceding 12 months, and the purpose of each.

CCPA category	What it is	Purpose
Identifiers	Name and e-mail address from the contact form; IP address from web requests	Answering your enquiry; serving and securing the site
Commercial information	The topic you choose (General, Support, Partnership, Other) and your message	Routing and answering your enquiry
Internet or network activity	Server logs (IP, timestamp, URL, status, user-agent, referrer) and mail-delivery lines (timestamp, recipient, topic, delivery status, message id)	Security, abuse prevention, diagnosis, proof of delivery
Geolocation — approximate only	Country derived from your IP; never precise location, no GPS or device location	Choosing the default interface language

We collect none of the remaining categories: no protected classifications, biometric, audio or visual data, no professional, employment or education information, no inferences or profiles, and no sensitive personal information — no government identifiers, financial or card data, precise geolocation, race, religion, union membership, health, sexual orientation, or private communications beyond the message you send us. The site has no accounts, passwords, third-party sign-in, payments, analytics, advertising, pixels or trackers.

4. Sources and purposes

Three sources only: you, through the contact form; your device, since any web server receives your IP address, user-agent and request details; and the country inferred from your IP. We buy nothing from data brokers.

We also use this information to block spam through a hidden honeypot field and a per-IP rate limit, to troubleshoot faults, and to comply with law or defend legal claims — nothing else.

5. Disclosures to service providers

In the preceding twelve months we disclosed personal information for business purposes only to these providers, each bound by terms forbidding any other use:

• SMTP.bz — e-mail delivery; receives your message, name and e-mail address.
• ip-api.com — IP-to-country lookup for default language; receives your IP address. The result returns to your browser and is not stored on our server.
• Google LLC — Google Fonts from fonts.googleapis.com and fonts.gstatic.com; your IP address and user-agent are disclosed to Google when your browser requests a font.
• DigitalOcean — hosting of the origin server, Frankfurt, Germany.
• Timeweb — an entry proxy in St Petersburg, Russia, for Russian visitors only; it terminates TLS, forwards the request and stores no content.
• Cloudflare — DNS and geo-routing in DNS-only mode, so traffic is not proxied through Cloudflare.

We also disclose where law or legal process requires, or to protect our rights or property. There are no other recipients.

6. We do not sell and do not share your personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the preceding twelve months, and never have. We have no knowledge of selling or sharing the information of consumers under 16, because we do not sell or share at all.

We process no sensitive personal information for any purpose triggering the right to limit its use, run no targeted advertising or profiling under the Virginia, Colorado, Connecticut, Utah or Texas statutes, and sell no sensitive or biometric data, so the specific sale notices required by Texas law do not apply. With nothing to opt out of, no "Do Not Sell or Share My Personal Information" link is required — though we honour any opt-out you send and treat a Global Privacy Control signal as valid, with the practical effect that nothing changes.

7. Processing outside the United States

We are in the United Arab Emirates and our origin server is in Germany, so your information is processed outside the United States; Russian visitors pass through the St Petersburg proxy. The safeguard is contractual: every provider in section 5 is bound to confidentiality and security and may use the information only on our instructions.

8. Your rights

Subject to verification, you have these rights:

• Know and access — the categories and specific pieces we hold, with their sources, purposes and recipients.
• Delete — subject to narrow exceptions, such as records we must keep by law or to defend a claim.
• Correct — inaccurate information.
• Portability — a usable copy of what you gave us.
• Opt out — of sale, sharing, targeted advertising and profiling; none occur.
• Limit — the use of sensitive personal information; we hold none.
• Non-discrimination — no denial of service, different price or lower quality for exercising a right. We run no financial incentive or loyalty programme.

Virginia, Colorado, Connecticut and Texas residents hold the same access, correction, deletion, portability and opt-out rights and may appeal a refusal by replying to our decision; we answer appeals in writing with reasons within 60 days, and if denied you may contact your state Attorney General. Utah gives access, deletion, portability and opt-out, but no correction right and no appeal.

9. How to exercise them

E-mail 024ismo@gmail.com, naming your state of residence and the right you want to use. Since we hold no accounts, we verify you against our records: normally by confirming the request comes from the e-mail address you wrote from, and asking you to confirm the date and topic of that enquiry. For deletion, or for specific pieces of information, we also ask for a signed declaration under penalty of perjury that you are the consumer concerned. Verification data is used only to verify you and is then deleted; if we cannot verify you, we say so.

An authorised agent may act for you with your signed written permission or a power of attorney, which we may confirm with you. Requests are free unless manifestly unfounded or excessive. We acknowledge receipt within 10 business days and respond within 45 days, extendable once by a further 45 days for complex requests, with notice inside the first 45. Requests to know cover the preceding 12 months unless you ask for longer.

10. Retention and security

Information	Kept for
Contact-form e-mails and correspondence	While the enquiry is handled, then up to 24 months, then deleted
Mail-delivery log lines	12 months
Anti-spam rate-limit counters (hashed IP)	1 hour, rolling, then discarded
Server (nginx) access and error logs	30 days
josgate pre-launch session cookie	The browser session only
jos.lang language preference	Until you clear site data; never leaves your device

Traffic is encrypted with TLS; mailbox and server access is limited to authorised company personnel; the gate cookie is HttpOnly, Secure and SameSite=Lax; rate-limit counters store a hash, not the IP itself; and we deliberately collect very little, the strongest safeguard of all. No storage or transmission is perfectly secure, and we do not claim otherwise.

11. Cookies and local storage

One strictly necessary cookie, josgate, keeps you signed in to the pre-launch access gate for your browser session. One localStorage entry, jos.lang, remembers your interface language on your device and never reaches us. No advertising, analytics or tracking cookies are used; the Cookie Policy has the detail.

12. Children, automated decisions, changes and complaints

The site is not directed to children, and we do not knowingly collect information from anyone under 16, or under 13 within the meaning of the Children's Online Privacy Protection Act. If you believe a child sent us something through the contact form, tell us and we will delete it.

We make no automated decisions about you and carry out no profiling — nothing here scores, evaluates or predicts anything about a visitor. The only automated step is the country lookup that picks a default language, which you can override at once.

When this notice changes, the revised version appears here and takes effect on publication; a material change affecting information you already gave us is flagged at the top of the page, and we seek consent where the law requires it.

If you are unhappy with how we handled your information or your request, tell us first at 024ismo@gmail.com. You may also complain to the California Privacy Protection Agency or the California Attorney General, or in Virginia, Colorado, Connecticut, Utah and Texas to your state Attorney General. No representative has been designated for us under Article 27 GDPR (European Union) or Article 53 PIPL (People's Republic of China); until one is, requests under those laws also go to the same address and we handle them directly.

13. The Jeeks OS application has not launched

Jeeks OS is a social and creative operating system for creative professionals — portfolio and professional profile, creative jobs and talent, social feed, messenger and communities, marketplace, AI and creative tools, knowledge sharing — announced for macOS, iOS, the web, Windows and Android. It is not live; everything above describes the website alone.

Service-specific processing — accounts, published portfolios, messages, marketplace transactions and the identity and payment information those require — begins only at launch; none of it happens today. This notice will be updated to describe it before it starts, and the updated version will govern it.

1. Who we are and how to reach us

This Privacy Policy explains how JEEKSSHIRE 24 FZE LLC handles personal data collected through https://jeeksos.com (the Website), which presents the product Jeeks OS. Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing framework we are the Controller, determining the purposes and means of the processing below.

• Legal name: JEEKSSHIRE 24 FZE LLC (Free Zone Establishment)
• Licence and Registration No.: 2624416735888, issued by the Ajman NuVentures Centre Free Zone (ANC Free Zone), Government of Ajman, under Amiri Decree No. 15 of 2023; verifiable at www.ancfz.ae.
• Registered office: Office CWS-1V-227119, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates
• Privacy contact: 024ismo@gmail.com

This policy covers the Website only. The Jeeks OS application has not launched — see section 14.

2. What personal data we actually collect

The Website is a pre-launch information site. It has no user accounts, no passwords, no sign-in with Google, Yandex or any other identity provider, no payments, no analytics, no advertising and no tracking pixels. We collect no sensitive personal data. The complete list is:

• Contact form. Your name, e-mail address, the topic you select (General, Support, Partnership or Other) and your message. Your address goes in the Reply-To header so we can answer.
• Mail-delivery log. One server log line per message: timestamp, recipient, topic, delivery status and message identifier — not your message body.
• Anti-spam data. A hidden honeypot field, and a per-IP submission counter in temporary files keyed by a hash of the IP address.
• IP address for default language. On load, your IP address goes to the geolocation service ip-api.com to resolve your country and pick the initial interface language. The answer returns to your browser and is not stored on our server.
• Language preference. Saved in your browser's local storage under jos.lang; it never reaches us.
• Pre-launch access gate. The Website is password-protected before launch. Past the gate, a strictly necessary session cookie josgate is set (HttpOnly, Secure, SameSite=Lax), expiring with your browser session.
• Server logs. Standard nginx access and error logs: IP address, timestamp, requested URL, HTTP status, user-agent and referrer.
• Web fonts. Typefaces load from Google Fonts, disclosing your IP address and user-agent to Google LLC.

3. Purposes and legal basis

The PDPL prohibits processing without the data subject's consent except in the cases listed in Article 4. We rely on the following:

Processing	Basis under Article 4
Contact form	Necessary to take steps at your request with a view to a business relationship, on data you supply voluntarily
Mail-delivery log	Our legitimate interest in reliable, verifiable mail delivery
Honeypot and rate limiting	Our legitimate interest in information security
Country lookup via ip-api.com	Our legitimate interest in presenting the site in a sensible language; you can change it at any time
josgate session cookie	Strictly necessary to provide the pre-launch access you requested
Server logs	Our legitimate interest in security and availability, and our obligation under Article 20
Google Fonts	Our legitimate interest in consistent presentation

Where we rely on consent for any future processing, Article 6 gives you the right to withdraw it at any time, without affecting processing already carried out.

4. Who receives the data

We do not sell, rent or share personal data for anyone else's marketing. It goes only to the providers we need to run the Website:

• SMTP.bz — e-mail delivery; carries your contact-form message to our inbox.
• ip-api.com — receives your IP address, returns a country code.
• Google LLC — Google Fonts; receives your IP address and user-agent.
• DigitalOcean — origin hosting in Frankfurt, Germany (EU); stores the site and its server logs.
• Timeweb — entry proxy in St Petersburg, Russia, for visitors from Russia; terminates TLS, forwards to the origin, stores no content.
• Cloudflare — DNS and geo-routing in DNS-only mode; traffic is not proxied through it.

We may also disclose personal data where a competent UAE authority or court legally requires it.

5. Transfers outside the United Arab Emirates

The Website's origin infrastructure is in Germany, and several providers above operate outside the UAE. Personal data of UAE users therefore leaves the United Arab Emirates.

Article 22 of the PDPL permits transfers to states the UAE Data Office has determined to provide adequate protection, or under an applicable international agreement. Where no such determination applies, Article 23 permits transfer under a contract or binding undertaking obliging the recipient to apply protection no less than the PDPL requires, with explicit consent, or where the transfer is necessary to perform a contract with or in the interest of the data subject.

We rely on Article 23: our agreement with each provider imposes written obligations of confidentiality, security, processing only on our instructions and assistance with data-subject requests, maintaining protection consistent with the PDPL. Routing your message abroad is also necessary to deliver the reply you asked for. Should the Data Office issue an adequacy determination covering these destinations, Article 22 will apply instead.

6. How long we keep data

Data	Retention
Contact-form e-mails and the correspondence that follows	While the enquiry is handled, and up to 24 months afterwards, then deleted
Mail-delivery log lines	12 months
Anti-spam rate-limit counters	1 hour (rolling), then discarded
nginx server logs	30 days
josgate session cookie	Browser session only
jos.lang in local storage	Until you clear your site data

7. Security and personal data breaches

Under Article 20 of the PDPL we apply measures appropriate to this limited processing: TLS on every connection; a session cookie marked HttpOnly, Secure and SameSite=Lax; honeypot and per-IP rate limiting; IP addresses hashed rather than stored in the anti-spam counters; restricted administrative access to the server and inbox; and short retention periods.

If a breach occurs that would prejudice your privacy, confidentiality or security, we will notify the UAE Data Office without undue delay under Article 9 of the PDPL, and inform affected data subjects where the breach is likely to harm them, describing what happened, the data involved and the steps taken.

8. Your rights

Subject to the conditions in the PDPL, you have the right to:

• Information and access (Article 13) — be told how your data is processed and obtain a copy of it.
• Portability (Article 14) — receive data you provided in a structured, machine-readable format, and have it passed to another controller where feasible.
• Correction or erasure (Article 15) — have inaccurate data corrected and data erased once we no longer need it.
• Restriction (Article 16) — limit processing while a dispute over accuracy or lawfulness is resolved.
• Objection (Article 17) — stop processing based on our legitimate interests, and object at any time to direct marketing.
• Object to automated processing (Article 18) — we carry out none (section 11).
• Withdraw consent (Article 6) — where processing rests on consent.

9. How to exercise your rights

Write to 024ismo@gmail.com, from the address you used to contact us or with enough detail for us to locate your data. We will answer within 30 days, in accordance with Article 19 of the PDPL; if a request is unusually complex we will tell you within that period why we need longer and when to expect a full answer. There is no charge. If we cannot act — because we cannot verify your identity, or must keep the data by law — we will explain why.

10. Cookies and local storage

The Website sets one cookie, josgate, strictly necessary for the pre-launch gate and expiring with your browser session, and stores your language choice locally under jos.lang. There are no analytics, advertising or tracking cookies of any kind. Full details, including how to clear these, are in our Cookie Policy.

11. Automated decision-making and profiling

We do not profile you and make no decisions about you based solely on automated processing. The only automated rule is the per-IP rate limit, which may temporarily refuse excessive form submissions from one address; it has no legal or similarly significant effect, and you can always reach us by e-mail.

12. Children

The Website is not directed at children and we do not knowingly collect their personal data. If you believe a child has sent us personal data through the contact form, write to 024ismo@gmail.com and we will delete it.

13. Data Protection Officer, and complaints

Article 10 of the PDPL requires a Data Protection Officer only where processing creates a high risk to confidentiality and privacy, systematically and comprehensively evaluates sensitive personal data including profiling, or involves a large volume of it. No trigger applies here: there is no profiling, no large-scale monitoring and no sensitive personal data. We have therefore not appointed a Data Protection Officer. Privacy matters are handled directly by the company at 024ismo@gmail.com.

We would like the chance to resolve any concern first. You also have the right to complain to the UAE Data Office, the federal authority supervising the PDPL, through the channels it publishes on the UAE Government portal at u.ae.

14. The Jeeks OS application

Jeeks OS is a social and creative operating system for creative professionals — portfolio and professional profile, creative jobs, projects and talent, social feed, messenger and communities, creative marketplace, AI and creative tools, knowledge sharing — announced for macOS, iOS, the web, Windows and Android. It has not launched. Nothing in this policy involves accounts, published portfolios, messages or marketplace transactions: none of that exists yet, and none of it is collected today. Service-specific processing begins only at launch, governed by this policy as updated then.

15. Changes to this policy

When we change this policy we update the version date on this page. If a change materially affects how we handle personal data — a new purpose, category of data, recipient, or retention period — we will say so prominently on the Website before it takes effect, and where the change concerns processing based on your consent we will ask again.

1. The personal information handler and how to contact it

This Privacy Policy is issued under the Personal Information Protection Law of the People's Republic of China (PIPL), read with the Cybersecurity Law and Data Security Law. It applies to individuals in mainland China who visit jeeksos.com (the "Website"). The personal information handler — the party deciding the purposes and means of handling — is:

• JEEKSSHIRE 24 FZE LLC, a Free Zone Establishment incorporated 29 June 2026 under Amiri Decree No. 15 of 2023
• Licence and Registration No. 2624416735888, issued by Ajman NuVentures Centre Free Zone, Government of Ajman; verification at www.ancfz.ae
• Office CWS-1V-227119, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates
• E-mail: 024ismo@gmail.com; group site jeeksshire24.com

The handler is established outside the PRC, with no establishment, server or storage inside mainland China. No Art. 53 PIPL representative or dedicated institution in the PRC has been designated; until one is and is named here, send every enquiry, rights request and complaint to 024ismo@gmail.com. A data protection officer is not required here — no large-scale monitoring, no sensitive personal information, and volumes far below the thresholds that make a dedicated person in charge mandatory.

2. Personal information actually handled

The Website is a pre-launch marketing site with no user accounts, no third-party sign-in, no payments, no analytics, no advertising and no trackers. The complete set of personal information handled is:

• Contact-form data — your name, e-mail address, topic (General, Support, Partnership or Other) and message.
• IP address for language detection — sent to ip-api.com to resolve your country so the interface opens in a sensible language; the result returns to your browser and is not stored on our server.
• Anti-spam data — a hidden honeypot field and a per-IP rate-limit counter in temporary storage, keyed by a hash of the IP address.
• Mail-delivery log lines — timestamp, recipient, topic, delivery status, message identifier.
• Server logs — nginx access and error logs: IP address, timestamp, requested URL, HTTP status, user-agent, referrer.
• Access-gate cookie — the Website is password-protected before launch; a strictly necessary session cookie josgate (HttpOnly, Secure, SameSite=Lax) is set after sign-in.
• Web fonts — loading Google Fonts discloses your IP address and user-agent to Google LLC.

No sensitive personal information under Art. 28 PIPL — biometrics, religious belief, medical or financial data, location tracking, or data of a minor under 14 — is collected.

3. Purposes and legal basis under Art. 13 PIPL

PIPL recognises no "legitimate interests" basis. Only the bases below are relied on.

Purpose	Information	Art. 13 basis
Receiving and answering your enquiry	Name, e-mail, topic, message	Art. 13(2) — necessary to perform a contract or take steps at your request before one; reinforced by Art. 13(1) consent when you submit the form
Choosing the default interface language	IP address sent to ip-api.com	Art. 13(1) — consent; the result is discarded immediately
Blocking automated form abuse	Honeypot field, hashed-IP counter	Art. 13(2) — necessary to deliver the contact service you requested
Securing pre-launch access	josgate session cookie	Art. 13(2) — necessary to give you access at your request
Operating and securing the Website	Server logs, mail-delivery lines	Art. 13(2), and Art. 13(5) for the short period needed to answer security incidents

Where consent is the basis, giving it is voluntary and withdrawable at any time, with effect for the future only. If you do not submit the form, no contact data is handled.

4. Recipients

Personal information is disclosed only to these entrusted parties, each acting on our instructions:

• SMTP.bz — e-mail delivery of contact-form messages to the company inbox.
• ip-api.com — resolving an IP address to a country for language selection.
• Google LLC — web fonts; your IP address and user-agent are disclosed when your browser requests them.
• DigitalOcean — hosting of the origin server in Frankfurt, Germany (EU).
• Timeweb — entry proxy in St Petersburg, Russia, terminating TLS for visitors routed through it and forwarding to the origin; it stores no content.
• Cloudflare — DNS and geo-routing, DNS-only mode; traffic is not proxied through Cloudflare.

We do not sell personal information or share it for anyone else's purposes, and disclose it to a public authority only under a legally binding order.

5. Cross-border transfer and separate consent (Arts. 38 and 39 PIPL)

Correspondence and server logs sit on the Frankfurt origin server and in the company mailbox, read by UAE personnel to answer you. Because the handler and its infrastructure are outside mainland China, anything you send us leaves the PRC.

Art. 39 PIPL requires that you first be told the overseas recipient's name and contact details, the purposes and methods of handling, the categories involved, and how to exercise your rights against it — all set out in sections 1 to 4 and 8. Art. 39 also requires your separate consent: submitting the contact form is a distinct, voluntary act consenting specifically to that transfer, and you may decline by not submitting it. What crosses the border is correspondingly narrow — your enquiry data, plus the technical request data any visit to a foreign server entails.

Art. 38 PIPL offers three routes for an outbound transfer: a CAC security assessment, certification by a specialised body, or filing of the CAC standard contract. Current handling stays within the exemption for transfers necessary to perform a contract to which the individual is a party, and is far below the volume thresholds triggering a mandatory assessment or filing. Before any large-scale transfer begins — in particular when Jeeks OS launches and handles account data of users in the PRC — the applicable Art. 38 route will be completed first and named here.

A personal information protection impact assessment under Art. 55 PIPL covers the outbound transfer and the contact form: the lawfulness and necessity of the purposes, the impact on individuals, and the security risks. Its record is kept at least three years and redone before any material change.

6. Retention

• Contact-form e-mails and resulting correspondence: while the enquiry is handled and for up to 24 months afterwards, then deleted.
• Mail-delivery log lines: 12 months.
• Anti-spam rate-limit counters: 1 hour, rolling, then discarded.
• nginx server logs: 30 days.
• josgate session cookie: the browser session only.
• jos.lang language preference: kept in your browser's local storage until you clear site data; never sent to us.
• IP address sent to ip-api.com: not stored by us at all.

7. Security measures

Traffic is encrypted with TLS. The pre-launch gate restricts access; its session cookie is HttpOnly, Secure and SameSite=Lax. Rate-limit counters are keyed by a hash, not a raw IP. Mailbox access is limited to those answering enquiries, retention limits are enforced by deletion, and measures are reviewed whenever handling changes — as Arts. 51 and 59 PIPL and the Cybersecurity Law require. If personal information is leaked, distorted or lost, we notify the competent authority and affected individuals under Art. 57 PIPL.

8. Your rights under Arts. 44 to 50 PIPL

• Know and decide about the handling, and restrict or refuse it (Art. 44).
• Access and obtain a copy of your personal information, and have it transferred to a handler you designate where the authorities' conditions are met (Art. 45).
• Correct or supplement inaccurate or incomplete information (Art. 46).
• Delete it (Art. 47) — where the purpose is achieved, retention is no longer necessary, you withdraw consent, or handling was unlawful. Where a statutory retention period has not expired we stop active handling instead of erasing.
• Obtain an explanation of our handling rules (Art. 48), in plain language, for any part of this policy.
• Withdraw consent at any time, by a convenient means (Art. 15).

Send requests to 024ismo@gmail.com. We reply within 30 days, free of charge, asking only what is needed to locate your data — normally the e-mail address used and the approximate date. If we refuse we give reasons, and you may sue in a people's court under Art. 50 PIPL.

Under Art. 49 PIPL, close relatives of a deceased individual may exercise the rights of access, copying, correction and deletion over that person's personal information for their own lawful and legitimate interests, unless the deceased arranged otherwise before death. Write to the same address, stating the relationship.

9. Cookies and local storage

There are no analytics, advertising or profiling cookies. The only cookie is the strictly necessary josgate session cookie; the only local-storage entry is jos.lang, recording your chosen interface language on your own device. Details are in our Cookie Policy.

10. Minors

The Website is directed at adult creative professionals. We do not knowingly collect personal information of anyone under 14 — which PIPL treats as sensitive, requiring a guardian's separate consent and dedicated handling rules. If you believe a child under 14 has sent us such information, write to 024ismo@gmail.com and we will delete it.

11. Automated decision-making

There is none, and no profiling, within the meaning of Art. 24 PIPL. Nothing about you is decided by machine; there is no personalised pricing, recommendation or targeted push.

12. Changes to this policy

If the purposes, methods or categories of personal information change, the updated policy is published here with a new effective date. Where PIPL requires it — a change of purpose, method or category, or a new cross-border transfer — fresh consent is sought rather than the change taking effect silently.

13. Complaints

Please raise concerns with us first at 024ismo@gmail.com. You may also complain to the Cyberspace Administration of China, or to the local cyberspace administration and other departments performing personal information protection duties in your province or municipality, and may bring an action in a people's court under Art. 50 PIPL.

14. The Jeeks OS application

Jeeks OS is a social and creative operating system for creative professionals, with versions for macOS, iOS, web browser, Windows and Android announced as coming soon. It is not launched. Everything above concerns the Website only. Service-specific handling — accounts, published portfolios, messages, marketplace transactions — begins only at launch, will be governed by this policy as updated then, and for individuals in mainland China will not begin before the applicable Art. 38 route is in place and separate consent under Art. 39 obtained.

1. Operator and how to contact it

This Policy is issued under Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Law") and explains how personal data of visitors to jeeksos.com (the "Website") is processed.

The operator is JEEKSSHIRE 24 FZE LLC (the "Operator", "we"), a Free Zone Establishment registered by the Ajman NuVentures Centre Free Zone, Government of Ajman, under licence and registration number 2624416735888. Registered office: Office CWS-1V-227119, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates. Registry details can be verified at www.ancfz.ae.

Send any question, consent withdrawal or request under Articles 14–17 of the Law to 024ismo@gmail.com. Our Telegram channels (@jeeksshire24) handle general product enquiries; formal data requests belong at that e-mail address. Responsibility for organising the processing rests with the Operator's management and is exercised through the same address. No data protection officer has been appointed, and none is required for this processing: we carry out no large-scale monitoring and handle no special categories of data.

2. Scope

This Policy covers the Website only. The Jeeks OS application has not launched, so no accounts, portfolios, messages or marketplace transactions exist today (section 14).

3. Personal data we actually process

• Contact-form data: your name, e-mail address, the topic selected (General, Support, Partnership, Other) and the text of your message; your address also goes in the Reply-To header so we can reply.
• Mail-delivery log entries: timestamp, recipient, topic, delivery status and message identifier, written to a server log.
• Anti-spam data: a one-way hash of your IP address keys a short-lived counter enforcing a per-address submission limit; a hidden honeypot field collects nothing from a human visitor.
• IP address for language detection: on page load it is sent to ip-api.com to resolve the country, solely to choose the default interface language; the result goes to your browser and is not stored by us.
• Server logs: nginx access and error logs — IP address, timestamp, requested URL, HTTP status, user agent, referrer.
• Pre-launch gate: the Website is password-protected before launch; after sign-in the strictly necessary cookie josgate (HttpOnly, Secure, SameSite=Lax) is set and expires with the browser session.

We operate no accounts, passwords or third-party sign-in, take no payments, run no analytics, advertising, pixels or trackers, do not profile visitors, and neither sell nor share personal data. We do not knowingly collect special categories of data; if any reaches us inside a message, it is deleted once noticed.

4. Purposes and legal grounds

Purpose	Data	Ground under the Law
Receiving your enquiry and replying	Name, e-mail, topic, message	Your consent, given by deliberately submitting the form (Arts. 6(1)(1), 9), and processing necessary to carry out your request (Art. 6(1)(5))
Evidencing delivery, diagnosing failures	Mail-delivery log entries	Legitimate interest in reliable operation (Art. 6(1)(7))
Protecting the form from spam and abuse	Hashed IP address, honeypot	Legitimate interest in the security of the resource (Art. 6(1)(7))
Choosing the default interface language	IP address sent to ip-api.com	Legitimate interest in a usable presentation (Art. 6(1)(7))
Operating and securing the server	Server logs	Legitimate interest in running and defending the Website (Art. 6(1)(7))
Restricting access before launch	josgate session cookie	Legitimate interest in controlling access to an unreleased product (Art. 6(1)(7))

We do not process data to promote goods, works or services and send no marketing mailings; Article 15 would require separate prior consent, which we neither ask for nor hold.

5. Actions performed with the data

Within these purposes we perform the actions named in Article 3(3): collection, recording, systematisation, accumulation, storage, clarification, extraction, use, transfer to the recipients in section 6, depersonalisation (hashing of IP addresses), blocking, deletion and destruction. Processing is mixed: automated by our server software (form handling, logging, rate limiting, language detection) and non-automated when a person reads your message and replies.

6. Recipients

Your data reaches only the following, each for the purpose stated:

• SMTP.bz — e-mail delivery provider; carries your message and address to our company inbox.
• ip-api.com — receives your IP address and returns a country code for language selection.
• Google LLC (United States) — web fonts load from fonts.googleapis.com and fonts.gstatic.com, disclosing your IP address and user agent.
• DigitalOcean — hosting of the origin server, Frankfurt, Germany.
• Timeweb — the entry proxy in St Petersburg, Russia, through which Russian visitors reach the Website.
• Cloudflare — authoritative DNS and geo-routing in DNS-only mode: traffic is not proxied through it, and it sees only DNS queries.

We disclose data to no one else, save where a legally binding demand on the Operator requires it.

7. Location of data and cross-border transfer (Art. 12)

The origin server is in Frankfurt, Germany. Requests from Russia pass through an entry proxy in St Petersburg, Russia, which terminates TLS and forwards them to the origin; it is a transit node and stores no requests, submissions or pages. Your message is recorded and stored in Germany and read from the company inbox in the United Arab Emirates, so cross-border transfer under Article 12 occurs:

• To Germany — a party to Council of Europe Convention ETS No. 108, and so a state ensuring adequate protection of data-subject rights.
• To the United Arab Emirates, where the Operator is established, and to providers in section 6 outside states ensuring adequate protection — on the basis of your consent to cross-border transfer, given when you submit the form. If you prefer no such transfer, use Telegram rather than the form.

8. Retention and destruction

Data	Period
Contact-form messages and the resulting correspondence	While the enquiry is handled and up to 24 months afterwards, then deleted
Mail-delivery log entries	12 months
Anti-spam rate-limit counters	1 hour (rolling), then discarded
nginx server logs	30 days
josgate session cookie	The browser session only
jos.lang language preference in localStorage	Until you clear site data; never sent to our server

Once the purpose is achieved, data is destroyed within 30 days under Article 21(3), unless a shorter period above has already run. Unlawful processing, if discovered, is stopped within three working days and the data destroyed within ten working days where lawfulness cannot be restored.

9. Security measures (Art. 19)

We apply organisational and technical measures proportionate to this processing:

• all traffic is carried over TLS, and the gate cookie is HttpOnly, Secure and SameSite=Lax;
• form input is validated and rate-limited, IP addresses being held only as one-way hashes in temporary storage;
• inbox and server access is limited to those who need it, over authenticated channels;
• logs carry the minimum fields needed and are deleted on the section 8 schedule;
• we collect nothing beyond section 3 — our most effective safeguard.

10. Your rights and how to exercise them (Arts. 14–17)

As a data subject you have the right to:

• confirmation that your data is processed, and the information in Article 14(7): grounds, purposes, methods, the data and its source, retention periods and who processes it for us;
• correction of inaccurate or outdated data, and blocking or destruction of data obtained unlawfully or no longer needed;
• withdrawal of consent (section 11);
• objection to processing for the promotion of goods, works or services, which we do not carry out;
• freedom from decisions with legal effects taken solely by automated processing (Art. 16) — we take none;
• appeal against our acts or omissions to Roskomnadzor or a court, and compensation for losses and moral harm (Art. 17).

Write to 024ismo@gmail.com from the address you used on the form, or give the date and topic of your message so we can locate the data; we ask for no identity documents and no data we do not already hold. We answer within 10 working days, extendable by reasoned notice within that period by 5 working days at most. Where you show that data is inaccurate, incomplete or unlawfully obtained, we correct, block or destroy it and confirm within 7 working days.

11. Withdrawing consent

Consent given by submitting the form may be withdrawn at any time, in free form, by writing to 024ismo@gmail.com; one sentence is enough. We then stop processing and destroy the data within 30 days, unless the law requires us to keep it. Withdrawal does not make earlier processing unlawful, and it ends any correspondence under way.

12. Cookies and local storage

There are no advertising, analytics or tracking cookies. The only cookie is the strictly necessary josgate session cookie (section 3); the only browser storage is the jos.lang key in localStorage, holding your chosen language on your device. See our Cookie Policy for detail.

13. Children and automated decisions

The Website is not directed at children and we do not knowingly collect their data; if you believe a child has written to us, tell us at 024ismo@gmail.com and we will delete the message. We take no decisions about you by solely automated processing and do no profiling: the country lookup in section 3 picks a display language, nothing more.

14. The Jeeks OS application

Jeeks OS is a social and creative operating system for creative professionals — profile and portfolio, creative jobs and projects, social feed, messenger and communities, a marketplace, AI and creative tools, knowledge sharing — announced for macOS, iOS, the web, Windows and Android. It has not launched. No account, portfolio, message or marketplace data is processed today. Service-specific processing begins only at launch, under this Policy as updated then, with its new categories, purposes, grounds, recipients and retention periods published beforehand.

15. Changes

We may amend this Policy, in particular as the Website changes or when Jeeks OS launches. The current version is always published on this page and takes effect on publication. Where a change materially affects processing based on your consent, we ask for fresh consent.

16. Complaints

Please raise any concern with us first at 024ismo@gmail.com; that is usually the fastest fix. You may also complain to the Russian supervisory authority, Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media), through its electronic reception at rkn.gov.ru, or apply to a court, including for compensation of losses and moral harm under Article 17.