PRIVACY POLICY

1. Scope and service relationships

This policy applies to website visitors, business contacts, and information we handle in restaurant assessments and related consulting. The information involved depends on the services agreed with a client. Before collecting service information, we establish the engagement's scope, permitted data uses, confidentiality arrangements, relevant participant notices, and appropriate information-handling responsibilities.

When we process personal information on a client's behalf, the client's instructions and the applicable service or data-processing agreement govern that work, subject to law. The client may have its own privacy notice. Where Jab! determines a separate use of information, this policy describes that use. Client instructions and agreements remain subject to the source protections described here and in the applicable participant notice. No agreement overrides a person's nonwaivable privacy rights.

2. The website and local brief tool

The assessment brief is generated in your browser and downloaded to your device. It is not submitted to Jab!. The form's business details, location count, assessment interests, and concern are not sent by this site's code to a Jab! inbox or database. We cannot retrieve your downloaded copy. Your device, browser, and any storage or synchronization service you use may retain it under their own settings.

The current website has no Jab! customer account, payment checkout, or connected submission system. Do not enter employee names, confidential records, credentials, payment details, or sensitive personal information in the brief. Downloading a brief does not start an engagement or send us a request.

3. Hosting, fonts, and browser signals

This website is hosted through OpenAI Sites. The platform may process technical and access information, such as IP addresses, browser information, request times, and authentication records, to deliver and secure its services. Any platform login is separate from the Jab! brief tool. The platform's own information practices are described in OpenAI's Privacy Policy.

The website loads fonts from Google Fonts. Your browser connects to Google's servers for those files, which exposes information needed for the connection, including your IP address. See Google's explanation of Google Fonts privacy and Google's Privacy Policy.

Jab! has not installed advertising pixels, behavioral advertising tools, or analytics code on this website. Our site code does not track you across unrelated websites and does not change its behavior in response to Do Not Track or Global Privacy Control signals because it does not sell personal information or share it for targeted advertising. This statement does not describe the independent practices of the hosting platform or other services you choose to use.

4. Information relevant to an engagement

Depending on the agreed services, information may include:

• Business and contact information: names, work contact details, roles, organizations, instructions, correspondence, proposals, contracts, and billing records.
• Operational information: locations, visit dates, service timings, staffing context, procedures, relevant observations, redacted receipts, relevant visit history, and records a client is authorized to provide.
• Guest, employee, management, and leadership feedback: voluntary responses, experiences, concerns, and context needed to understand them, including whether a guest is a first-time or returning visitor and what they are comparing the experience with. An answer may identify a person even when we do not request a name.
• Assessment records: field notes, verification work, analyses, recommendations, reports, and follow-up findings.

Sources may include business contacts, clients, participants, our observers' observations, and relevant information lawfully available to us. We limit collection to information reasonably relevant to the work. Government identifiers, full payment-card details, medical records, passwords, and unrelated private communications are not part of a routine assessment and should not be provided unless a separate lawful need and handling process have been agreed.

5. How we use information

We use information as reasonably necessary to evaluate and administer engagements; plan and conduct assessments; understand guest and employee experiences; verify findings; identify patterns and operational gaps; prepare and explain reports; support agreed follow-up; communicate with participants and clients; maintain business records; handle billing and disputes; protect our services; prevent fraud and misuse; comply with legal obligations; and establish, exercise, or defend legal claims.

Service information is used within the agreed scope and relevant notices. We may use information that has been appropriately aggregated or de-identified to evaluate methods and improve our services, where permitted by the engagement and law. We do not attempt to re-identify information we maintain as de-identified. Identifiable guest or employee feedback is not used for unrelated advertising, sold as a contact list, or published as a client case study without appropriate permission.

6. Source confidentiality and its limits

Source protection applies at every level: employees, managers, and leadership, as well as guests who provide confidential feedback. We guarantee that ordinary client reports will not name protected sources, subject only to the narrow exceptions in this section. We review names, roles, shifts, exact quotes, unusual events, workplace relationships, and location-specific dynamics, then remove, generalize, combine, or withhold details that could expose a person. Clients receive candid findings and relevant context, not identifying raw transcripts, individual survey responses, or unrestricted access to internal notes. Raw or unfiltered feedback describes the substance of the findings, not permission to expose the people behind them.

We may combine feedback across a sufficiently broad group of participants and restaurants when that helps protect identities. We assess the actual context, not just the number of responses or locations. If a location, role, incident, small group, or comparison between reports could expose someone, we broaden the reporting group, remove details, defer reporting, or withhold the account. We do not attribute pooled feedback to individual locations when doing so could reveal a source. Source protection takes priority over including a more detailed account.

Before collecting feedback, we explain the protections in plain language. Employees, managers, and leadership are told how participation works, what information Jab! may know, what the client will receive, how identifying details are removed, and the narrow disclosure exceptions. People must be able to understand the protections before deciding whether to speak. Client pressure does not weaken the commitment.

Confidential feedback is information whose source may be known to Jab! but is protected in our reporting. Anonymous collection means the collection method is designed not to identify a respondent. We describe a method as anonymous only when its configuration supports that description. Participants can still identify themselves in what they say, and others may sometimes infer an identity from surrounding facts. We cannot guarantee that every inference or unintended disclosure is impossible.

We do not disclose a protected source because a client demands it, dislikes the findings, or wants someone to blame. We may disclose limited source information only when we reasonably determine it is necessary and lawful to address a credible, active threat to life, health, or safety; credible evidence of illegal activity, including unlawful retaliation or unlawful threats to someone’s livelihood; or a requirement of law or binding legal process. Ordinary criticism, workplace disagreements, rumors, performance concerns, and management embarrassment do not by themselves meet that threshold. A complaint about a source is not, by itself, evidence of illegal activity. We share only what is necessary with recipients positioned to respond. These protections and limits are explained in the relevant participant notice before confidential feedback is collected.

Our assessments are not a tool for retaliation against people who provide good-faith feedback. We do not authorize clients to use protected feedback to expose a source or retaliate, and we include source-protection expectations in the engagement. We cannot control every action of an independent organization. This service is not an emergency reporting channel.

7. Recipients and permitted disclosures

Information may be made available, on a need-to-know basis, to assigned Jab! personnel and qualified contractors; providers supporting approved business or assessment functions; authorized client recipients receiving appropriately protected findings; and professional advisers such as legal, accounting, or insurance advisers. Access is subject to appropriate confidentiality, purpose, and handling restrictions. All disclosures remain subject to the source protections above. The business purposes in this section do not create an additional exception for identifying a confidential source to a client.

We may disclose non-source business information when legally required or as reasonably necessary to establish, exercise, or defend legal claims, subject to applicable law and our confidentiality commitments. Business administration, professional advice, legal claims, and business transfers do not independently authorize disclosure of a protected source. Identifying source disclosures remain limited to Section 6. If a merger, financing, reorganization, or transfer of the business requires information to be reviewed or transferred, we limit access appropriately and require recipients to respect applicable privacy obligations and source protections. Such a transaction does not authorize unrelated use of protected feedback.

We do not sell personal information or share it for cross-context behavioral advertising. Giving information to a restricted provider to carry out an agreed service is different from permitting that provider to use it for unrelated purposes. We do not grant blanket permission for unrelated resale or advertising use.

8. Retention

We retain information for as long as reasonably necessary for the purposes described here, the engagement, and applicable legal obligations. Relevant factors include the sensitivity of the information, the assessment and follow-up period, contractual commitments, accounting obligations, limitation periods, security needs, and a specific dispute or legal hold. We do not retain identifying source material indefinitely simply because it might be useful.

When information is no longer needed, we delete it or appropriately de-identify it, subject to required retention and backup deletion cycles. Restricted backup or legally retained information is not repurposed for unrelated use. A deletion request may be limited by lawful retention obligations or another person's rights. Your locally downloaded brief remains under your control. Please redact names, payment details, loyalty identifiers, and other unnecessary personal information from any supporting receipt you choose to share through an agreed channel.

9. Safeguards and incidents

For service information, we establish administrative, technical, and physical safeguards appropriate to its sensitivity and the agreed work. Approved storage and transfer methods, access restrictions, personnel responsibilities, provider obligations, and incident procedures are addressed before service data is exchanged. An enterprise engagement may define additional security requirements in writing.

No website, storage system, or transmission method is completely secure. This policy does not promise a particular certification, an independent security audit, or an absolute guarantee against loss or unauthorized access. We address incidents and provide notifications as required by applicable law and our written obligations.

10. Choices and requests

Depending on applicable law and our role, you may have rights to request access, correction, deletion, or a portable copy of personal information; object to or limit certain uses; withdraw consent where processing relies on consent; or appeal a decision about a request. These rights have exceptions. We do not discriminate or retaliate against a person for exercising applicable privacy rights.

For information connected with an engagement, contact Jab! directly using the details supplied in the participant notice, proposal, or service agreement. Those materials identify the appropriate contact before service information is collected. Include enough information to describe your request, but do not send unnecessary sensitive information. We may verify identity or authority proportionately, coordinate with a client where we act on its behalf, and respond within applicable time limits. Verification must not expose another participant, and we do not collect new identifying information solely to identify an otherwise anonymous respondent.

The website's local brief tool does not transmit privacy requests. Requests about a hosting-platform account or information processed independently by that platform should be directed to the platform using its privacy notice.

11. Location, outside services, and children

Jab! is based in the United States. Information may be handled in locations where approved providers operate. Exclusive U.S. storage or a specific data-residency arrangement applies only when agreed in writing. Applicable international-transfer requirements are addressed before service information is transferred. Websites and services linked from this site have their own notices.

This business website and brief tool are intended for adults and are not directed to children under 13. We do not knowingly seek children's personal information through the website. Any service involving minors, including employees, requires appropriate collection rules and notices for that engagement.

12. Policy changes

We may update this policy to reflect changes in the website, services, information practices, or applicable requirements. The updated date appears at the top. We provide additional notice or obtain consent when required. An update does not silently authorize an incompatible use of information collected under an earlier privacy commitment. This policy does not require anyone to waive rights that cannot lawfully be waived.