Privacy Policy

Who We Are

Joan is operated by Rebel HQ Inc, 440 N Wolfe Rd, Sunnyvale, CA 94085.

What We Collect

• Inquiry information - name, work email, company, role, and the operating problem, timing, or constraints you voluntarily describe
• Visit record (visitors in the United States) - If you visit from the United States and your browser does not send Global Privacy Control or Do Not Track, we keep a pseudonymous record of the visit: the pages viewed and in what order, the sections read and the buttons clicked (by fixed name, never anything you type), which fields of the inquiry form you reached (never what you type in them), how long each page is actively in view, how far you scroll, your device type and browser and operating-system family, your country, your approximate city and state, and your time zone, the kind of source that brought you (for example search or a campaign tag, the name of a campaign tag in a link we shared, such as one naming a LinkedIn post, and the name of the website that linked to you), the network your connection is registered to, and, when that network is not a home, mobile, cloud or VPN network, the domain name it publishes for your address (its reverse DNS name), reduced to the organisation's domain (for example examplefirm.com), only when that name points back to your address, does not contain your address, and names an organisation rather than an internet provider, carrier or cloud service. The record is linked by random identifiers stored in your browser (_sc_vid in local storage; _sc_sid and _sc_sid_ts in session storage); if you opt out, only a session identifier is kept instead (_sc_asid and _sc_sid_ts in session storage), so this browser's separate visits are not linked by anything we store in it; visits from the same network may still be shown together, as they are for any visitor we cannot identify. We do not try to identify you personally from it, except through a personal link or the inquiry form, as described next.
• Personal links and inquiries (visitors in the United States) - If we send you a personal link (a joanai.io/r/… address made for you, which itself contains nothing about you), we record that it was opened and connect it to your visit record, so our team knows the visit was probably yours. If you send us the inquiry form, we connect it to the visit record of that browser, so our team sees that browser's earlier and later visits with your name. We do neither if you opt out or your browser sends Global Privacy Control or Do Not Track.
• Visitors outside the United States, or whose location we cannot determine - From this update we keep no visit record and store no identifiers in your browser; identifiers that an earlier version of this site stored in your browser are removed when you next load one of our pages. We only count page loads by country group, without identifying anyone.
• IP address - Your IP address is processed in memory to protect the site, filter automated traffic, and look up your approximate country, city and state and your network using IP data from DB-IP that we host ourselves, and, for visitors in the United States whose network is not a home, mobile, cloud or VPN network, to ask the domain name system (DNS) for the name your network publishes for the address and to check that the name points back to the address. These lookups send the address, and then the name found, as standard DNS queries, to our hosting provider's DNS resolver and to the DNS servers of the network the address belongs to; we keep only the organisation's domain from the answer, never the full name. For visit records we store only a keyed pseudonym of the address, never the address itself. The internal notice we send ourselves when you submit an inquiry does not include your IP address; it includes the country your network is registered in. Visit records created before this update, including those of visitors outside the United States, contain full IP addresses, browser strings and referring addresses, and older records of access to our former investor materials contain full IP addresses and browser strings; we are pseudonymising or deleting them.

We do not use third-party analytics, advertising trackers, or social media pixels.

Our pages currently load fonts from Google Fonts, so your browser sends your IP address to Google when a page loads; we are moving the fonts onto our own server.

When we look up the approximate country, city and state and the network of an IP address, we do it on our own server with IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). The address is not sent to DB-IP or to any other geolocation or lookup service; the only outside queries are the DNS lookups described above.

How We Use It

• To understand and respond to a work inquiry
• To understand how visitors use the site and to send our team a daily summary of US visit records. The daily summaries, and immediate notices of inquiries, are emailed to our own mailbox, which is hosted by Google Workspace; they are sent through Microsoft Azure Communication Services or Google Workspace. An inquiry notice also includes the visit record of the visit that sent it, where one exists.
• To improve the website
• To protect site security

We do not sell, share, or rent your data to anyone.

How Joan counts visits

Our team receives a daily email about visits to this site. It follows these rules.

• A real visit - one browser on one day (Pacific time), from a visitor in the United States whose visit record we keep as described above, with at least one page that was open for 5 seconds with the tab visible, scrolled 25% (on a page that can be scrolled), or clicked (a click, tap, key press or mouse-wheel turn counts). Automated traffic and our own team's browsers are not real visits.
• An engaged visit - a real visit that opened a Capital & Wealth page or the inquiry page, or had at least two page views of our main pages (Home, Industries, the Capital & Wealth pages and the inquiry page; two views of the same page count, and views of Careers, this notice, the Terms and other pages do not), or spent at least 60 seconds reading in total on any of our pages. A visit made up only of Careers pages, or only of this notice and the Terms, is never counted as engaged.
• Reading time - the time a page is visible in your browser tab: the first 30 seconds after the page opens or you come back to the tab, and after that only while you have scrolled, clicked, tapped, pressed a key or moved the pointer within the last 30 seconds.
• Who is named - A visitor is named in our email only if they sent us the inquiry form from that browser, or opened a personal link we sent to them (anyone they forwarded it to looks the same to us). For everyone else our email shows the kind of network the visit came from, such as an office network, home broadband or a mobile network, the organisation that network is registered to, and, when the network's domain name names an organisation, that organisation's name as its domain spells it, marked as not confirmed as the visitor's employer. We never treat either organisation as the visitor's employer, and seeing a browser on several days is never proof of who it is. "Their time" is the visitor's local time, from the time zone their browser reports.
• What the email can show today - the time each visit started; whether the same browser was seen before (as "2nd visit", counting days, with the day it first came and, when known, where it came from); the pages read, in order, with their reading time and how far each was scrolled; the buttons clicked (by fixed name); how far the inquiry form was filled in (never what was typed); the kind of source and device, the name of the referring website when it is on our short fixed list (for example joans.co), and the name of a campaign tag in a link we shared (for example the title of a LinkedIn post); the country, the approximate city and state (always marked as approximate, and as unreliable on mobile, cloud and VPN networks) and the US time-zone region; the network type; the name of the organisation the network is registered to; and, on networks other than home, mobile, cloud and VPN networks, the organisation named by the network's domain name, marked as not confirmed as the visitor's employer, for visitors in the United States only; the name of the person we sent a personal link to, when that link was opened; and, for a browser that sent us the inquiry form, its earlier and later visits with the name as typed. It never names anyone else, gives visitors no score, and writes no automated summaries. The subject line and preview of the email never contain a name, a company, a network, a place or a campaign.
• No IP addresses or fingerprints - the daily email and the inquiry notice never contain IP addresses, device fingerprints or visitor IDs.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we do not keep a visit record for that visit.

Your privacy choices

You can opt out on this browser. We then do not recognise it on later visits, connect no personal link or inquiry to it, and never name it; we still keep the rest of its visit record, such as the approximate location, network, source and pages of its visits, as for any visitor we cannot identify. Your choice is kept in this browser for 180 days, in the __Host-jc cookie.

Cookies and browser storage

• __sid - a session cookie used only when our team signs in to the site's administration area; essential
• _sc_vid, _sc_sid, _sc_sid_ts - browser storage for the US visit record only
• _sc_asid - session storage for the visit record of an opted-out browser, in place of _sc_vid and _sc_sid
• joan-signature-entry-v2 - session storage recording whether the homepage introduction has played in this browser tab
• __jint - set only on our own staff's browsers, to exclude our visits
• __Host-jc - your privacy choice, set only if you opt out; kept 180 days
• __Host-jl - set for 30 minutes when you open a personal link we sent you, to connect it to your visit
• joan-notice-seen - local storage remembering that you closed the privacy notice bar
• ARRAffinity and ARRAffinitySameSite - Microsoft Azure load-balancing cookies

We use no advertising or third-party cookies.

Your Rights

You can:

• Request deletion of your inquiry and associated data
• Unsubscribe from communications at any time
• Request access to what data we hold about you

Email rebel@rebelhq.ai for any privacy requests.

Mailing address: Rebel HQ Inc, 440 N Wolfe Rd, Sunnyvale, CA 94085.

Data Storage

Your data is stored on secure Azure infrastructure with encryption at rest and in transit (TLS). Visit records are kept for 12 months and then deleted; you can ask us to delete yours sooner at any time. Page-load counts that identify no one are kept longer.

Changes

We may update this policy. Changes will be posted here with an updated date.