PRIVACY POLICY

laHva, Inc. is a California corporation with its principal place of business in San Diego, California.

• –Corporate and website inquiries: [email protected]
• –Privacy requests, deletion requests, and support: [email protected]
• –laHva, Inc., 10089 Willow Creek Road, Suite 200, San Diego, CA 92131

Requests to access, correct, or delete personal information should go to [email protected]. That is the address we verify requests against and act on.

This policy covers three things:

• 1.meetjensen.com, which is currently a pre-launch page with an email signup form.
• 2.meetjensen.com/walkthrough, a private section made available to people considering a possible transaction or relationship with laHva who receive its link and password. Section 3A covers it.
• 3.JENSEN OS, software that installs and runs on hardware you control.

Your rights and obligations as a licensee of the software are set out in a separate license agreement. This policy is about data.

JENSEN OS is not yet generally available.

What you are signing up for. One email, when JENSEN OS is available. That is the whole of it. We do not send a newsletter, a product-update series, or marketing messages, and joining this list does not sign you up for any. If we ever want to send you anything beyond the launch notification, we will ask for your consent separately first.

What we store. When you submit the form, our database records:

• –the email address you submitted, stored in a normalized (lowercase, trimmed) form;
• –a timestamp generated by the database at the moment of the entry;
• –an identifier generated by the database for the entry;
• –a value identifying the signup source, which is currently fixed to the homepage form; and
• –a two-letter country code derived by our hosting provider, Cloudflare, from your connection. This is country-level only.

Our signup handler does not write your IP address or your browser's user-agent string into our database.

Getting off the list. Email [email protected] and ask to be removed. We handle these requests by hand, we delete the entry, and we will confirm. There is no self-service removal page, so email is the route.

Hosting. The site is served through Cloudflare, which processes technical information about requests — including IP addresses — to deliver and protect the site. Those are Cloudflare's own logs, generated by Cloudflare's systems.

meetjensen.com/walkthrough is a private section of this site, made available to people considering a possible transaction or relationship with laHva who receive its link and password. If you have never received a link and a password for it, none of this section applies to you.

How entry works. You enter your name and email address, optionally the organization you are entering for, and the password you received. You read the Walkthrough Confidentiality Terms in full on that page and tick a box to agree to them. We record that agreement. Access lasts twelve hours, or until you press Log out.

The login cookie. When you enter, our own server sets one cookie on your browser. It holds a session identifier and nothing else. It is marked HttpOnly and Secure, it expires after twelve hours or when you log out, and it exists only to keep you logged in. It is not used for advertising, analytics, profiling or tracking of any kind, and it is not read by anyone but us. It is a strictly necessary cookie, which is why we do not ask for consent to set it — without it the section cannot work.

What we record when you agree. Our database stores: the name, email address and organization you entered; a server-generated timestamp; the version number of the confidentiality terms you were shown and a cryptographic fingerprint of that exact text; the fact that you ticked the box; the IP address your request came from; your browser's user-agent string; and a two-letter country code derived by Cloudflare from your connection.

What we record while you are inside. Each login, page view, PDF generation, logout and session expiry is logged with a timestamp, the IP address and the user-agent string.

Your name on the material. The name and email address you entered are displayed on the pages you view and on every page of the PDF generated for you.

Why we collect it. To give you access; to know who agreed to what and when, because the agreement is what the material is disclosed under; to discourage the material being passed on; and to be able to identify the source if a copy is passed on anyway. That is the whole of it. We do not use any of it for marketing, and we do not add you to the email list.

This is different from the email signup. The Walkthrough records are held in a separate database table from the email signup described in Section 3, and the two are not combined. The statement in Section 3 that our signup handler does not record IP addresses or user-agent strings remains true of the signup. The Walkthrough does record them, for the reasons above.

How long we keep it. Acceptance records: ten years from the date you agreed. Access logs: five years from the event. We keep them this long because they are the evidence of an agreement whose obligations last for years, and because a claim arising from that agreement can be brought well after it ends. We do not retain the generated PDF itself — only the record that one was generated for you and when.

Who we share it with. Cloudflare, which hosts the site and the database the records are held in. No one else, except where the law compels it, and then only what is legally required. We do not sell or share this information, and it is not used for advertising.

Deleting it. Please see Section 11. Because these records exist to establish, exercise and defend legal claims, we do not delete them on request during the retention periods above. You can ask us what we hold about you, ask us to correct it, and ask for a copy.

Questions. Corporate questions about the Walkthrough: [email protected]. Privacy requests: [email protected].

Our site's own source contains no advertising, marketing, or analytics scripts. It sets one cookie, and only in one place: a strictly necessary login cookie for the Walkthrough, the private section described in Section 3A, set only if you enter that section. On the public pages our source sets no cookies at all.

Cloudflare serves the site and adds two pieces of JavaScript to our pages at its edge:

• –Cloudflare Web Analytics (the RUM beacon), which measures page performance and traffic. Cloudflare's documentation states that the beacon does not access cookies, localStorage, sessionStorage, or IndexedDB, that it collects performance metrics, and that the source IP address is discarded at the nearest Cloudflare data center. See Cloudflare's RUM beacon documentation.
• –Email address obfuscation, which encodes email addresses in the page and decodes them in your browser, to make them harder for automated scrapers to collect. See Cloudflare's email obfuscation documentation.

The Cloudflare Web Analytics beacon described above is not served on the pages of the Walkthrough.

Separately from those scripts, Cloudflare's security and performance features can set their own cookies. Cloudflare documents which cookies those are and what each is for at Cloudflare cookies.

We do not use advertising cookies, cross-site tracking, fingerprinting, session recording, or data-broker integrations. Our Cookie and Tracking Notice covers this in more detail.

5.1 Where the work happens. JENSEN OS installs and runs on hardware you control. Unless you connect an outside service, the work it does — your prompts, your files, your agents' memory, and the results — is processed on your own machine.

5.2 License validation. When the software validates a license against our license service, it transmits four fields: license_id, kid (a key identifier), node_fingerprint (an identifier derived from the machine, used to enforce your Node count), and version (the software version). The software also supports offline activation using a signed license file, which involves no license check.

5.3 Connected accounts. JENSEN OS can connect to outside services, including cloud model providers and social platforms. Nothing is connected by default. Each connection is one you set up and authorize yourself, through the provider's own authorization flow, using your own account.

When you authorize a connection, JENSEN OS:

• –saves the authorization the provider issues, so it can use the connection again without asking you to sign in each time;
• –identifies the account, channel, or page that the authorization covers; and
• –makes authenticated read requests to that provider and receives back the data your authorization covers.

Data returned by a provider is handled on your machine as part of the task you ran. What the provider does with the request, what it logs, and what it retains are governed by that provider's own terms and privacy policy.

If you connect a cloud model provider, the content of your prompt goes to that provider so it can return a response. Using local models instead keeps that processing on your machine.

5.4 Publishing is not a released feature. JENSEN OS does not currently ship a released capability to publish, post, or otherwise write content to a connected provider on your behalf. If that changes, we will update this policy before it ships and describe what it sends and when.

5.5 What laHva receives. laHva receives license validation requests as described in 5.2. We do not collect your JENSEN OS content, and we do not collect the data a provider returns to you through a connection you authorized.

The following apply if and when you connect the service named.

YouTube

The JENSEN OS YouTube connection uses YouTube API Services.

• –By using it, you agree to be bound by the YouTube Terms of Service.
• –Google's handling of your information is governed by the Google Privacy Policy.
• –You can revoke JENSEN OS's access to your Google and YouTube data at any time through Google's security settings page: https://security.google.com/settings/security/permissions.

What is accessed. Identification of the connected Google account and YouTube channel, and the YouTube data your authorization covers, retrieved by authenticated read requests.

What it is used for. Carrying out the task you ran in JENSEN OS. Nothing else.

Where it is held. JENSEN OS runs on hardware you control, and the saved authorization and any retrieved data are handled by your installation. laHva does not store YouTube API Data on its own systems.

Sharing. We do not sell YouTube API Data, and we do not share it for advertising or profiling.

Deletion. If you ask us to delete YouTube API Data, or you remove the connection in JENSEN OS, we will delete it as soon as possible and in no case later than 7 calendar days after the request. If you revoke access through Google's security settings, we will delete stored YouTube API Data within 30 days. To make a request, email [email protected].

Meta platforms (Facebook and Instagram)

Platform Data obtained. Identification of the connected account, the Facebook Page or Instagram Business account the connection covers, and the data your authorization covers, retrieved by authenticated read requests.

Use. Only to carry out the task you ran in JENSEN OS. We do not sell Platform Data, share it for advertising, or use it to build profiles.

Deletion. Any user may request deletion of Platform Data we hold by emailing [email protected] with the request and the connected account. We will act on it. You can also remove the integration's access from your Meta account settings, which stops further access.

LinkedIn

Use of the LinkedIn connection is subject to the LinkedIn API Terms of Use.

What is obtained. Identification of the connected account and the basic profile information your authorization covers, retrieved by authenticated read requests, on the basis of the authorization you grant.

Withdrawal and deletion. You can withdraw your authorization at any time through LinkedIn or by removing the connection in JENSEN OS. On your request, or on the closure of your LinkedIn account, we will delete LinkedIn API data and any stored access token, except where the law requires us to retain something. Email [email protected].

These are four different actions with four different effects. Doing one does not do the others.

a. Revoke the authorization at the provider. Use the provider's own settings — for Google and YouTube, the Google security settings page. This stops JENSEN OS from making any further authenticated request on your behalf. It is the step that ends provider access definitively.

b. Disable or remove the connection in JENSEN OS. This stops the software from using that connection. It is not represented here as erasing every stored copy of the authorization, or of data already retrieved. For records held on your own machine, see (c); for anything laHva holds, see (d). To be certain a provider can no longer be reached on your behalf, use (a).

c. Records on your own machine. JENSEN OS runs on hardware you control. Files, logs, and copies that exist on that machine are under your control. Removing a connection is not represented here as purging every stored copy from your system. If you need a machine cleared, clear it yourself or have your administrator do it.

d. Data laHva holds. Email [email protected] to request deletion of information we hold about you. We handle these by hand, act on them, and respond within 30 days, subject to records we are required to keep.

Removing a connection does not delete anything the provider holds. Use the provider's own controls for that.

• –We do not sell or share personal information for advertising.
• –We do not run advertising pixels, retargeting, cross-site tracking, or data-broker integrations.
• –We do not collect your JENSEN OS content, prompts, outputs, agent memory, or files.
• –We do not use connected-account data to build profiles or to train models.

• –Email signup entries: until you ask us to remove yours, or until we have sent the launch notification and closed the list.
• –Walkthrough acceptance records: ten years from the date of acceptance.
• –Walkthrough session logs: five years from the event.
• –Correspondence you send us: as long as needed to handle the matter, and then in our ordinary business records.
• –License validation records, once licenses are issued: for the life of the license plus three years.
• –Order and payment records, once there are any: seven years, for tax and accounting requirements.

Cloudflare generates its own infrastructure and security logs when serving the site. Those are Cloudflare's records, kept according to Cloudflare's practices.

Service providers that process data to run the business, under their own contractual limits:

• –Cloudflare — hosting, delivery, security, the edge scripts described in Section 4, and the database in which our email signup entries and our Walkthrough records are stored.
• –Mercury — banking. It sees settlement-level transaction data as any bank does.

We share personal information with no one else, except where the law compels it, and then only what is legally required.

Email delivery. The provider used to deliver the launch notification will process the addresses on the list for that purpose. We will update this policy to name that provider before it is used.

Payments. We are not collecting payments. If we begin to, a payment processor will handle card details, and we will update this policy to name it before any payment is collected.

Providers you connect inside JENSEN OS are a different matter. We do not send them your data; your installation does, on your instruction, under your own account.

You can ask us what personal information we hold about you, ask us to correct it, ask us to delete it, ask for a copy in a portable form, and ask us not to email you.

Email [email protected]. We will verify that the request came from you and respond within 30 days. Deletion is subject to records we are required to keep for tax, accounting, and fraud-prevention purposes, and to the Walkthrough acceptance records and session logs described in Section 3A, which we retain for the periods stated there because they are the evidence of a confidentiality agreement and are needed to establish, exercise or defend legal claims. Your other rights — to know, to correct, and to a copy — apply to those records in full. We will not treat you differently for exercising a privacy right.

California law gives California residents rights to know, delete, correct, and opt out of the sale or sharing of personal information. We extend the substantive rights to everyone under Section 11. We do not sell or share personal information as those terms are defined in California law. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.

Where the GDPR or UK GDPR applies to our processing of your personal data, the following applies.

Our legal bases are: consent, for the email signup; performance of a contract and steps taken at your request before entering into one, for giving you access to the Walkthrough once you have agreed to its confidentiality terms; legitimate interests, for keeping the site available and secure, and for the acceptance records, session logs and on-page name display described in Section 3A, where our interest is being able to prove what was agreed and to protect confidential information from unauthorized disclosure; and legal obligation, for records we are required to keep. You may withdraw consent to the email signup at any time by emailing [email protected]. Withdrawing consent does not affect the other bases.

Where we keep Walkthrough acceptance records and session logs beyond a request to erase them, we do so because that data is necessary for the establishment, exercise or defense of legal claims. You have the right to object to processing carried out on the basis of legitimate interests, and we will consider any objection on its merits.

In addition to the rights in Section 11, you have the right to restrict or object to processing and the right to complain to your supervisory authority.

laHva is established in the United States and processes the data it holds there. Our service providers publish, in their own data processing terms, the transfer mechanisms they rely on.

meetjensen.com and JENSEN OS are for adults. You must be 18 or older to join the email list or to use the software. We do not knowingly collect personal information from anyone under 18, and if we learn that we have, we will delete it. If you believe a minor has given us information, email [email protected].

We use established service providers and ordinary safeguards for the limited data we hold.

JENSEN OS runs on your hardware. The security of that machine, and of the credentials you connect to it, is under your control.

If we change this policy, we will post the new version here with a new effective date. Where this policy describes what the software does, we will update it before a version that changes that behavior ships.

laHva, Inc.
10089 Willow Creek Road, Suite 200
San Diego, California 92131

• –Corporate and website: [email protected]
• –Privacy, deletion, and support: [email protected]