Legal

Regional Privacy Supplement

Effective Oct 8, 2026 · Version 2026-10-08--01

This supplement adds to the Privacy Policy of Squaaads Design Services Inc., doing business as Jam (“Jam”, “we”, “us”) for people in the places below. Where it says something different from the Privacy Policy for your region, this supplement applies.

1. Canada

Jam is based in Ontario and follows the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Québec, the Act respecting the protection of personal information in the private sector.

  • Our Privacy Officer, the person in charge of protecting personal information, can be reached at hello@letsjam.design.
  • You may ask to access and correct your information, withdraw consent, and, in Québec, receive it in a structured, commonly used format.
  • Spell does not make decisions about people based solely on automated processing.
  • When information is processed outside Québec or Canada, we assess the protection it will receive and use contracts to keep it protected.
  • You may complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.

2. European Economic Area, United Kingdom and Switzerland

Who is responsible

Jam is the controller for the public site, the waitlist and studio account management. For information inside a studio’s instance, the studio is the controller and Jam its processor.

Legal bases

  • Performing our contract with a studio, and taking steps you ask for before one (such as a walkthrough).
  • Our legitimate interests in running, securing and improving Spell and responding to waitlist sign-ups, balanced against your rights.
  • Your consent, for optional page-speed measurement — which you can withdraw at any time in Cookie settings.
  • Complying with legal obligations.

International transfers

Instances are hosted in Canada, which the European Commission, the United Kingdom and Switzerland recognize as providing adequate protection for commercial organizations. Transfers to providers in the United States rely on Standard Contractual Clauses or another mechanism the law recognizes.

Your rights

You can ask for access, correction, deletion, restriction, portability and to object, withdraw consent at any time, and complain to your local data protection authority. Email hello@letsjam.design.

3. United States

Residents of California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws have rights to know, access, correct and delete personal information, and to opt out of its sale, sharing for targeted advertising and certain profiling. We do not sell or share personal information for advertising, or profile people in ways that produce legal or similarly significant effects.

Categories we collect

CategoryExamplesSources
IdentifiersName, email address, account ID, network (IP) addressYou, your studio, your browser
Account and profileRole, handle, profile picture, sign-in methodYou, your studio, Google if you sign in with it
Commercial informationYour studio’s agreement and fees with Jam; waitlist details such as studio name and team sizeYou, your studio
Internet activityRequest logs, pages used, audit log of changes, page-speed measurements if you allow themYour browser, Spell
Professional informationStudio, role and work for clients; job applications, résumés and interview notesYou, your studio, candidates
Customer contentTasks, comments, files, hours, contracts and signatures, meetings, invoices, Astra conversationsYour studio and its users, connected services
InferencesAstra’s summaries and candidate evaluations, made for the studio that askedSpell, from customer content
Sensitive informationOnly if someone includes it in content, for example in an applicationWhoever provides it

We use these categories for the purposes in section 3 of the Privacy Policy, disclose them to the sub-processors listed on the Sub-processors page, and keep them for the periods in section 8. Sensitive information is used only to provide the Service to the studio that holds it.

Making a request

Email hello@letsjam.design. We verify requests before acting on them, and an authorized agent may ask on your behalf with your signed permission. If we decline, reply to our answer with the subject “Privacy appeal” and we will review it. Using your rights never affects how we treat you.

4. Brazil

Under the Lei Geral de Proteção de Dados (LGPD) you may confirm whether we process your data and access, correct, anonymize, port or delete it, learn who we share it with, and revoke consent. Our Privacy Officer, who acts as our contact for data subjects and the ANPD, can be reached at hello@letsjam.design.

5. Everywhere else

Wherever you are, you can write to hello@letsjam.design about your information and we will help as far as we can.

6. Changes

We update this supplement as laws and Spell change; the effective date above shows the current version.

Spell uses a few cookies and a little browser storage to run the site and the app. Strictly necessary ones stay on. The optional one is off until you switch it on. Details are in our Cookie Policy and Privacy Policy.

Strictly necessaryAlways active

Needed for the site and the app to work: remembering your privacy choices, keeping you signed in, protecting sign-in and connection steps, and remembering small layout choices you make inside Spell. They cannot be switched off here; blocking them in your browser stops those things working.

  • spell_cookie_preferences

    Spell · 180 days

    Remembers the cookie choices you make on this site.

  • sb-<project>-auth-token

    Spell (Supabase Auth) · Until you sign out; refreshed while you are signed in

    Keeps you signed in and protects your session. Set only when you sign in.

  • spell-next

    Spell · 10 minutes

    Returns you to the page you were going to after you sign in with Google.

  • spell_slack_state

    Spell · 10 minutes

    Protects the step that connects your Slack account to Spell.

  • spell_view_as

    Spell · 1 hour

    Lets an administrator see Spell as another person sees it. Ends on its own.

  • sidebar_state

    Spell · 7 days

    Remembers whether you left the app’s sidebar open. Set only inside the app.

  • spell_admin_people_collapsed

    Spell · 1 year

    Remembers which sections an administrator folded on the People page.

  • App preferences

    Spell · Until you clear it

    Remembers small choices inside the app, such as your light or dark theme and the last project you picked.

Performance

Measures how quickly our public pages load, so we can keep them fast. Off unless you switch it on. It sets no cookies and does not follow you to other sites.

  • Vercel Speed Insights

    Vercel, for Spell · Nothing stored in your browser

    Records loading-speed measurements (Core Web Vitals) with the page address and your browser and device type.

Change or withdraw your choice at any time from Cookie settings at the foot of every page. Saying no to the optional setting never stops you using the site. Spell does not sell personal information or use advertising cookies.