Terms of Service

A person may create a central Jamey Account through a participating Jamey business page and may use that account to authenticate with other participating Jamey businesses. This gives the person a reusable identity and avoids requiring a separate password/account registration for every business.

Account reuse is not automatic sharing of the person's information between businesses. When a person chooses to join, sign in to or use another Jamey business, Jamey may make available only the minimum central-account information necessary to establish the new connection—normally the Jamey Account identifier, verified sign-in status, name and email address. Each business is separately responsible for its own relationship with that person and must provide its own applicable terms and privacy notice.

Jamey must not make Customer CRM Data, prior orders, delivery addresses, bookings, payment data, campaign preferences or activity from one business available to another business merely because the same person has a Jamey Account. Any optional feature that lets a person actively share saved details with another business must clearly identify the recipient and fields to be shared, and require a separate affirmative action by the person.

The Customer must not silently create a reusable Jamey Account from an order, delivery or booking form. A person must be clearly told that a Jamey Account is being created and must directly complete the account-registration step. Guest order/checkout information must remain a guest order unless and until the person separately chooses to create or link a Jamey Account.

The Customer may allow its employees, contractors and other persons it authorises (each an Authorised User) to use the Services for the Customer's internal business purposes. The Customer is responsible for:

ensuring that each Authorised User uses the Services lawfully and in accordance with the Agreement;

maintaining accurate account, billing and organisation information;

keeping credentials, devices and access methods secure;

promptly disabling access when an Authorised User should no longer have it; and

ensuring that it has the necessary rights, notices, permissions and lawful basis for the information it places in or sends through the Services.

The Customer must not permit access by competitors for benchmarking, resell or sublicense the Services except as expressly agreed, reverse engineer the Services except where mandatory law permits it, interfere with security or service operation, introduce malicious code, or use the Services for unlawful, discriminatory, deceptive, abusive or rights-infringing conduct.

The Customer may use the Services to create, import, organise and manage records relating to its customers, prospects, suppliers, employees, business contacts and other relationships (Customer CRM Data). This may include linking a person or contact to a company, account, opportunity, project, service, communication, campaign, transaction or other record selected by the Customer.

The Customer instructs Jamey to host, store, display, search, organise, link and otherwise process Customer CRM Data solely to provide, secure, support and improve the contracted Services, and only in accordance with the Customer's documented instructions and the Agreement. Jamey does not acquire ownership of Customer CRM Data.

The Customer remains responsible for deciding why and how it uses Customer CRM Data, including whether it may create or maintain any link between a data subject and a Customer record. The Customer represents and warrants that it has provided all required notices and has a valid legal basis for each such use. The Customer must not instruct Jamey to process data in a way that breaches applicable law or the rights of an individual.

Where the Services offer campaign, messaging or audience features, the Customer may create narrowly defined recipient lists, exclusion lists and other campaign conditions. Jamey will process these selections as the Customer's service provider. The Customer must use the features only for recipients it is entitled to contact and must honour opt-outs, objections, suppression lists, consent withdrawals and applicable channel-specific rules.

Jamey does not use Customer CRM Data or Customer campaign audiences to market Jamey's own services to those individuals. The Customer is solely responsible for the content, timing, target audience and legal basis of its own campaigns, including any profiling or segmentation used for direct marketing.

Jamey may technically restrict, suspend or reject a campaign where reasonably necessary to protect service security, comply with law, enforce these Terms, prevent spam or abuse, or honour a valid opt-out or legal request.

Where the Customer uses the Services to offer food ordering, delivery, booking or another B2B2C form to its own clients, the Customer must clearly identify itself as the business receiving the order and as the controller of the end customer's personal data. The Customer must provide an easily accessible, current link to its own terms of service and privacy notice before submission.

The Customer may require the end customer to manually tick an unticked checkbox confirming acceptance of the Customer's terms where acceptance is necessary to place the order or enter the contract. The checkbox must not be presented as consent to the Customer's privacy notice or as blanket consent to unrelated processing. The Customer must keep proportionate evidence of the accepted terms version, timestamp and order/form reference.

If the Customer also offers Jamey Account registration from the same page, it must be a distinct, clearly labelled account-registration flow that links to Jamey's central-account Terms and Privacy & Data Handling Notice. The Customer's order-form acceptance does not itself create or authorise a reusable Jamey Account.

Any marketing permission—including permission to send promotions by email, SMS, WhatsApp or another electronic channel—must be separate from the order, optional, unticked by default, specific to the relevant channel/purpose and recorded with suitable evidence. An end customer must be able to order without accepting marketing. The Customer remains responsible for its product/service information, food/allergen and consumer-law disclosures, delivery fulfilment, privacy notice, lawful basis, marketing rules and any rights request from its end customers.

Jamey uses Vercel for domain management and application hosting, with the relevant production workloads configured in European regions. Jamey uses Supabase, with its primary PostgreSQL database configured in a European region, as the main relational data store for the Services. PostgreSQL is used to support reliable, sequential and transactionally consistent processing of Service records.

European-region configuration is a data-location control, not a guarantee that no personal data will ever be accessed or transferred outside the European Economic Area (EEA). Vercel, Supabase and their approved sub-processors may process limited service, telemetry, support, security or backup data internationally where necessary and subject to appropriate safeguards. The current provider and sub-processor details are maintained at the location stated in Appendix 1.

Some Services may provide AI-assisted features, such as drafting, classification, summarisation, translation, generation, analysis or automation. By deliberately submitting an AI request, the Customer instructs Jamey to send the input necessary for that request to OpenRouter, Inc., a United States-based AI-routing provider, and to the selected downstream model provider(s).

Jamey may select or change the model or provider used for a request to offer suitable quality, availability, safety, cost or performance. The selected provider, and its logging, retention, training and processing-location practices, can vary by model and endpoint. Consequently, the Customer must not submit sensitive personal data, credentials, payment-card data, special-category personal data, confidential third-party information or other information requiring strict residency or zero-retention treatment through an AI feature unless Jamey has expressly confirmed in writing that the selected configuration is approved for that purpose.

AI output may be inaccurate, incomplete, biased or unsuitable for a particular purpose. The Customer is responsible for reviewing output before relying on it, communicating it, using it in a campaign or making a decision with legal, financial, employment, health, safety or other material effect. AI output is not legal, financial, tax, medical or other professional advice and must not be used as the sole basis for an automated decision that significantly affects an individual.

Jamey will maintain an AI-routing policy and, where the relevant configuration permits, restrict provider routing according to the applicable data-retention and training requirements. The Customer remains responsible for choosing whether to use an AI feature and for ensuring it has a lawful basis and all required notices for the input it submits.

Jamey uses Stripe to process payments for Jamey's own B2B subscriptions. Payment-card or bank-account details are collected and processed by Stripe through its payment products; Jamey receives the transaction, invoice and payment-status information needed to administer the subscription. Stripe's own terms and privacy documentation also apply to its processing.

The Services may also allow a Customer to use Stripe Connect to accept payments from its own clients and to receive payouts in a B2B2C payment flow. In that case, the Customer must create or connect the relevant Stripe account, complete the business verification (KYB), identity, bank-account, tax and other onboarding steps requested by Stripe or its regulated partners, and keep all information accurate, complete and current.

Unless Jamey expressly agrees otherwise in writing, the Customer is responsible for its own goods and services, pricing, tax, invoicing, consumer/business disclosures, refunds, cancellations, chargebacks, disputes, sanctions/AML and other legal or regulatory obligations connected with transactions between the Customer and its own clients. The Customer must not represent Jamey as the seller, merchant of record, payment institution, bank, e-money institution, custodian or provider of regulated payment services. Jamey provides the technical platform only and does not hold, receive or control Customer funds except where an agreed payment flow expressly states otherwise.

The Customer authorises Jamey to transmit the information reasonably necessary to create, manage and support its Stripe Connect relationship, including business, representative, beneficial-owner, contact, transaction and payout information. The Customer is liable for the accuracy and lawfulness of the information it provides and must promptly correct it. Stripe may independently request, verify, retain or share information where required for payment processing, fraud prevention, KYB/KYC, anti-money-laundering or other legal obligations.

Jamey is the controller of personal data it processes to establish and administer its direct relationship with the Customer and Authorised Users. This includes account and identity data, subscription and billing data, support requests, security and access logs, and Jamey's own B2B communications. The details are in the Privacy & Data Handling Notice.

For Customer CRM Data and other personal data that the Customer or its Authorised Users submit to the Services for their own business purposes, the Customer is normally the controller and Jamey is the processor. The data-processing terms in Appendix 1 are incorporated into the Agreement and constitute the parties' Article 28 GDPR data-processing agreement unless the parties have signed a superseding data-processing agreement.

The Customer is responsible for responding to requests from individuals concerning Customer CRM Data. Jamey will provide reasonable assistance within the Services or as otherwise required by applicable data-protection law.

From a business-specific account-management page, an Authorised User may choose Remove me from this business. This removes that individual's membership and access to that business only. It does not delete the individual's Jamey Account or access to other Jamey businesses/services, and it does not automatically erase the Customer's business, CRM, audit or compliance records.

If the individual is the sole owner or administrator of a business workspace, Jamey may require the Customer to appoint a replacement administrator or otherwise verify authority before membership can be removed. This protects the Customer from unintended loss of access.

From the central Jamey account-management page, a user may choose Delete my Jamey Account. After identity confirmation, Jamey will immediately deactivate the account and sign the user out. The account is scheduled for permanent deletion across Jamey services after a 30-day recovery period [confirm], unless deletion must be delayed by law, a valid legal claim, fraud/security prevention, or the need to preserve records required for the Customer's business.

Deleting a Jamey Account does not automatically delete a Customer organisation, its Customer CRM Data or records that the Customer, as controller, is required or entitled to keep. For example, a business may retain a record that a former team member created, changed or was assigned to a CRM item, while the user's central identity is removed or pseudonymised where appropriate.

Only a verified Customer administrator may request deletion of an organisation or workspace. Organisation deletion is separate from user-account deletion and will provide an export opportunity and a clear confirmation of the affected Services and data. Jamey will process the request in accordance with the applicable subscription terms, Article 28 instructions, law, and the retention schedule in the Privacy & Data Handling Notice.

The Customer is the controller and Jamey is the processor of Customer Personal Data. Jamey will process Customer Personal Data only on the Customer's documented instructions, including this Agreement, unless required to do so by applicable law. In that case, Jamey will inform the Customer before processing unless law prohibits that notice.

Jamey will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory duty of confidentiality. Jamey will implement appropriate technical and organisational measures to protect Customer Personal Data, having regard to the risks of processing.

The Customer gives Jamey a general written authorisation to engage sub-processors for the Services. Jamey will maintain a current sub-processor list at https://jamey.lu/legal/sub-processors [publish before launch]. The list will identify, at a minimum, the applicable Vercel, Supabase, OpenRouter/model-provider and Stripe services and their processing locations or transfer safeguards. Jamey will give the Customer reasonable advance notice of a material new sub-processor, allowing the Customer to raise a reasonable, data-protection-based objection.

Jamey will impose written obligations on each sub-processor that are no less protective of Customer Personal Data than the relevant obligations in this Appendix. Jamey remains responsible for its sub-processors' performance to the extent required by applicable law.

Taking account of the nature of processing, Jamey will reasonably assist the Customer through appropriate technical and organisational measures, where possible, with requests by individuals to exercise their data-protection rights. Jamey will also provide reasonable information and assistance for the Customer's data-protection impact assessments, prior consultations and compliance obligations to the extent required by Article 28 GDPR and relevant to the Services.

Jamey will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its own notification obligations.

Jamey will not transfer Customer Personal Data outside the European Economic Area, the United Kingdom or a country recognised as adequate by the European Commission unless an appropriate transfer mechanism and supplementary safeguards are in place as required by applicable law. This may include transfers connected with global infrastructure/support providers and AI processing through OpenRouter and the selected model provider. Where Standard Contractual Clauses are required, the parties will cooperate in good faith to execute the applicable module and supporting measures.

On reasonable written request no more than once per year, Jamey will make available information reasonably necessary to demonstrate compliance with this Appendix. Where that information is insufficient, the Customer may conduct an audit at its own cost on reasonable notice, during normal business hours, without disrupting Jamey's operations and subject to confidentiality and security requirements. Jamey may satisfy an audit request by providing an independent audit report or certification where appropriate.

At the end of the Services, and at the Customer's choice where technically feasible, Jamey will return or delete Customer Personal Data within 30 days [confirm] after the end of the applicable subscription or approved deletion request, unless law requires retention. Residual copies in encrypted backups will be isolated from normal processing and overwritten in accordance with Jamey's backup-retention cycle of [confirm period]. Jamey will not restore Customer Personal Data from a backup except where necessary for disaster recovery, and any restored data remains subject to this Appendix.