Privacy notice

Wonderlabs Limited is the controller of your personal data (in India, the “data fiduciary”). Contact us about privacy at hello@japper.app.

• Account details: your name, email address or phone number, and the country you’re moving from.
• Your move: your answers to our questions (such as field of study, occupation, experience, English level, and budget or savings as ranges), the destinations you’re considering, your saved plan and matches.
• Documents you upload (for example a CV, transcript or statement of purpose) and the results of checks you ask for. Stored privately.
• Messages: what you ask Jappy and its answers, voice notes and call audio you send (turned into text), and messages to our team.
• Payments: what you bought, when and for how much. Card and bank details are handled by our payment providers; we never see your full card number.
• Channels: your Telegram or WhatsApp ID if you connect them, and your notification choices.
• Advisor bookings: who you booked, when, and anything you choose to share with them.
• Device and usage: a random ID stored in a cookie, the pages you visit and the steps you take, your approximate country (from your IP address, which we don’t store), your browser type, and the ad or link that brought you (for example UTM tags and ad click IDs).

• To provide Japper (matches, plans, Jappy, document checks, alerts, bookings, community access): because it’s needed for our contract with you.
• To take payments and keep records: our contract with you, and our legal obligations (such as tax and accounting).
• To keep Japper safe (preventing fraud, scams and abuse) and to improve it (understanding which steps people get stuck on): our legitimate interests, balanced against your rights.
• To measure our ads: your consent in the EEA, the UK and Switzerland; elsewhere our legitimate interest, and you can opt out at any time (see cookies below).
• Marketing emails: only if you agreed, and you can unsubscribe in any email.

Jappy, our AI immigration assistant, and our document and writing checks use AI models run by OpenAI (OpenAI, L.L.C. and its affiliates), which acts as our processor. When you use these features, the text you type (your question, your dream in your own words, your statement or CV), the parts of your plan and the quiz answers Jappy needs to explain your routes, or the document you asked us to check, are sent to OpenAI through its API to produce an answer. We don’t send your email address, phone number or payment details. OpenAI processes it on our behalf, to provide the service to us. OpenAI’s API terms say data sent through its API is not used to train its models unless the customer opts in, and we don’t opt in. Read OpenAI’s API data policy.

Nothing is sent until you agree. Until you have agreed, each feature that would send what you type to OpenAI (the free-text dream prompt, Jappy chat, writing feedback, a call, a document check) shows a line under it saying that Jappy uses AI to answer and that by sending you agree to this Privacy Policy. Sending your first message (or starting the call or check) is your agreement, and only then is anything sent. Signed in, your agreement is stored on your account (with the date and the version of the wording you agreed to); signed out, it’s stored in a cookie or on your device. You can turn it off any time in Profile (or Settings in the app), then Privacy, and nothing you type is sent after that until you send a message to Jappy again, which turns it back on. The tap-through quiz and your calculated routes never need it. Because Japper’s help chat also uses AI, it stays scripted until you agree.

AI answers can be wrong. Nothing about you is decided by AI alone: fit is worked out by fixed rules from your answers, and anything important is shown to you with its source.

We don’t sell your personal data. We share it only with:

• Service providers who run parts of Japper for us: hosting, database and file storage, email and messaging, AI processing (OpenAI), payments (Stripe, Paystack, and Apple or Google for in-app purchases) and customer support. They may only use it to provide their service to us.
• Advisors you book, with the details you choose to share (for example your plan, if you tick “share my plan”).
• Other community members, for what you post in a community.
• Advertising platforms (Meta, TikTok and Google), only as described under cookies below.
• Authorities, if the law requires it, or to protect someone’s safety.
• A buyer of our business, if that ever happens, under the same promises as this notice.

Essential cookies keep you signed in, remember your quiz while you take it, remember where you came from (so we know which ads and links work), and remember your cookie choice. Japper doesn’t work without them.

Ad cookies and pixels from Meta, TikTok and Google tell us which of our ads brought people to Japper, so we can stop paying for ads that don’t help anyone. When you take a key step (such as finishing the quiz, saving a plan or paying), we may also send that event to those platforms from our servers, with your email or phone number scrambled (hashed) so it can be matched to an ad click but not read.

• In the EEA, the UK and Switzerland, none of this happens unless you say yes. We ask the first time you visit.
• Everywhere else it’s on by default, and you can switch it off here at any time. When it’s off, nothing about you is sent to ad platforms.

Japper’s providers may store or process data outside your country, including in the European Union, the United Kingdom and the United States. When data leaves your country we use the safeguards your law requires, such as standard contractual clauses or transfers to countries recognised as protecting personal data adequately.

• Your account and plan: while you have an account.
• Quiz answers you never save: deleted after a short period.
• Documents: until you delete them or your account.
• Payment records: as long as tax and accounting law requires.
• When you delete your account, we delete or anonymise your personal data, except what the law requires us to keep.

Wherever you live, you can ask us to:

• see the personal data we hold about you and get a copy;
• correct it;
• delete it;
• stop or limit how we use it, or object to a use;
• move it to another service in a common format;
• withdraw consent you gave, at any time (this doesn’t affect what we did before).

You can do most of this in Settings, or write to hello@japper.app. We’ll answer within one month, and tell you if we need longer. We may ask you to confirm who you are first.

• Nigeria (Nigeria Data Protection Act 2023 and the NDPR): you have the rights above, including to object to automated decisions. You can complain to the Nigeria Data Protection Commission.
• European Union and EEA (GDPR): you have the rights above, and can complain to the data protection authority where you live or work.
• United Kingdom (UK GDPR and the Data Protection Act 2018): you have the rights above, and can complain to the Information Commissioner’s Office (ico.org.uk).
• India (Digital Personal Data Protection Act 2023): you can access a summary of your data, correct or erase it, nominate someone to exercise your rights if you can’t, and raise a grievance with us at hello@japper.app. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.
• Anywhere else: you have the rights above, and any others your local law gives you. Write to us and we’ll help.

To delete your account and data, use “Delete my account” in Settings, or write to us from the email on your account. We’ll confirm when it’s done. Messages you posted in communities may remain visible to other members; tell us if you want them removed too.

Japper is for people aged 18 and over. We don’t knowingly collect data from children. If you think a child has given us their data, tell us and we’ll delete it.

We protect your data with encryption in transit, private storage for documents with short-lived links, strict access controls on our systems, and access for staff only when needed to help you. No system is perfect; if a breach affects you, we’ll tell you and the regulator as the law requires.

We’ll update this notice when what we do changes, and tell you about important changes before they apply. See also our terms of use.