Privacy Policy

Effective Date: October 5, 2026
Last Updated: October 5, 2026

Jutsu Inc. ("Jutsu," "we," "us," or "our") provides cybersecurity software and services, including the Jutsu platform, for security monitoring, detection, investigation, response, compliance, and related activities (collectively, the "Services").

This Privacy Policy explains how Jutsu collects, uses, discloses, retains, and otherwise processes Personal Data when you visit jutsu.ai or another Jutsu website that links to this Privacy Policy, communicate with us, create or use a Jutsu account, apply to work with us, or otherwise interact with the Services. It also explains the privacy rights and choices that may be available to you.

Key Points

• Two roles. For our own business data (website visitors, prospects, account administrators, business contacts), Jutsu is a controller / "business." For security data that customers connect to the Services, Jutsu is a processor / "service provider" acting on the customer's instructions (Section 2).
• No sale of Customer Data. We do not sell or share Customer Data, and we do not use it for advertising (Section 9).
• No AI training on Customer Data by default. We do not use Customer Data to train or fine-tune AI models unless the customer agrees in writing, and we require our AI providers not to train on it (Section 7).
• Your rights. Depending on where you live, you may access, correct, delete, or port your Personal Data, and opt out of certain processing. Contact legal@jutsu.ai (Section 15).

1. Who We Are and Scope

1.1 Contact Details

Jutsu Inc.
2043 East St #627
Concord, CA 94520
United States
Privacy and legal inquiries: legal@jutsu.ai

1.2 What This Policy Covers

This Privacy Policy applies to Personal Data Jutsu processes in connection with:

• Jutsu websites and online properties that link to this Privacy Policy;
• Jutsu accounts and applications, including the Jutsu platform;
• cybersecurity monitoring and security operations services;
• integrations with cloud environments, applications, repositories, infrastructure, endpoints, identity systems, security tools, and other customer-authorized systems;
• compliance and evidence-management functionality;
• demonstrations, trials, pilots, design-partner programs, workshops, events, and marketing activities;
• sales, customer success, and support interactions;
• recruiting and job applications; and
• other services that expressly reference this Privacy Policy.

This Privacy Policy does not apply to third-party websites, products, or services that Jutsu does not control, or to information about Jutsu's own employees and contractors, which is covered by separate internal notices.

1.3 Definitions

"Personal Data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual or household, including information treated as "personal information," "personal data," or a similar term under applicable privacy laws.

"Customer" means an organization that has entered into an agreement with Jutsu to use the Services.

"Customer Data" means information submitted to, transmitted to, collected by, or processed through the Services by or on behalf of a Customer, including security telemetry, integration data, and AI inputs and outputs generated from that information, as further described in Section 3.8.

2. Jutsu's Role: Controller and Processor

2.1 Where Jutsu Is the Controller

Jutsu acts as a controller (or "business") when it determines why and how Personal Data is processed. This includes Personal Data about website visitors, prospective customers, Customer account administrators and users (for account management, billing, support, and service communications), business contacts, event attendees, partners, vendors, job applicants, and individuals who communicate directly with Jutsu.

2.2 Where Jutsu Is the Processor

When a Customer connects its systems to the Services or otherwise provides information for Jutsu to process on its behalf, the Customer determines what information is collected and why. For Personal Data contained in Customer Data, Jutsu acts as a processor, "service provider," or "contractor" and processes that data on the Customer's documented instructions, as set out in the Customer's agreement with Jutsu, including any Data Processing Addendum ("DPA"), order form, or statement of work.

If a Customer agreement or DPA conflicts with this Privacy Policy regarding Customer Data, the agreement or DPA controls to the extent of the conflict.

If your Personal Data is processed by Jutsu on behalf of your employer or another organization, please direct privacy requests to that organization. See Section 16.

3. Personal Data We Collect

Depending on how you interact with Jutsu, we may collect the following categories of information.

3.1 Account and Contact Information

Name; business email address; telephone number; company name; job title; account username; organization membership; roles and permissions; account preferences; and authentication and account-management information (such as login records and multi-factor authentication status). We do not store account passwords in plain text.

3.2 Website and Usage Information

When you use our websites or applications, we may automatically collect IP address; browser type; device type; operating system; approximate location derived from IP address; referring website; pages visited; features used; interactions with the Services; session information; timestamps; error, diagnostic, and performance information. We collect this information using cookies, pixels, log files, and similar technologies (see Section 10).

3.3 Sales, Marketing, and Business Information

Company information; contact details; communications; meeting information; product interests; marketing preferences; event registrations; lead information; publicly available professional information; and information provided by partners or business-information providers.

Where we record or transcribe calls or meetings (including with AI-assisted note-taking tools), we will provide notice and obtain consent where required by applicable law.

3.4 Payment and Transaction Information

If paid Services are purchased, payment is processed by our payment service providers. Jutsu may receive billing contact details, billing address, invoice information, payment status, subscription information, and limited payment-method information (such as card type and last four digits). Jutsu does not receive or store complete payment-card numbers when payment is handled directly by a payment processor.

3.5 Support and Communications

Contact details; correspondence; support messages; troubleshooting information; meeting notes; feedback; survey responses; and files or other information you choose to provide.

Please do not send passwords, private cryptographic keys, payment-card numbers, health information, government identification numbers, or other highly sensitive information through ordinary support or communication channels unless specifically requested through an approved secure process.

3.6 Events and Programs

Registration details, attendance, dietary or accessibility requests you choose to provide, and participation in workshops, webinars, trials, pilots, or design-partner programs.

3.7 Job Applicant Information

If you apply for a role with Jutsu, we collect information you provide, such as your name, contact details, résumé or CV, work history, education, references, work authorization (where legally permitted), interview notes, and assessment results. We use this information only to evaluate your application, communicate with you, comply with legal obligations, and establish or defend legal claims. Additional applicant information may be provided in a separate applicant privacy notice at the time of application.

3.8 Customer Data (Processed on Behalf of Customers)

Our Services are designed to process cybersecurity information. Depending on the integrations and features a Customer enables, Customer Data may include:

• Security telemetry: security alerts; event and audit logs; cloud activity logs; authentication events; network, endpoint, application, and API activity; identity and access-management information; IP addresses; device and user identifiers; email addresses or account identifiers appearing in security events; timestamps; and file, process, domain, URL, or network metadata.
• Security and compliance content: vulnerability information; threat intelligence; incident and investigation information; evidence; findings; configuration information; system inventory; compliance evidence; access-control information; security policies; and Customer-provided documentation.
• Integration and configuration information: integration settings; account and tenant identifiers; server or resource identifiers; API configuration; permissions and scopes; filters; detection settings; response policies; and authentication tokens or credentials necessary to maintain an authorized integration.
• AI inputs and outputs: security events and context provided to AI features; user prompts or instructions; generated summaries, classifications, and recommendations; investigation results; and user feedback.

Because security telemetry reflects activity within Customer systems, Customer Data may incidentally contain Personal Data about the Customer's personnel, contractors, customers, or other individuals whose activity appears in those systems.

Jutsu uses integration credentials, tokens, and similar secrets solely as necessary to provide and secure the applicable integration and Services, and protects them with access controls and encryption. Customers should grant Jutsu only the permissions reasonably necessary for the Services they use.

4. Sources of Personal Data

• Directly from you — for example, when you create an account, submit a form, request a demonstration, contact support, register for an event, apply for a job, communicate with us, or configure the Services.
• From our Customers — Customers may provide information about their authorized users, personnel, contractors, customers, or other individuals whose activity appears within security data.
• Automatically — through websites, applications, APIs, integrations, cookies, logs, and similar technologies.
• From Customer-authorized integrations — systems that Customers choose to connect, such as cloud infrastructure, identity systems, code repositories, security tools, applications, and logging systems.
• From third parties — business contact information from partners, resellers, service providers, event organizers, business-information and data-enrichment providers, publicly available sources, and professional networking platforms, used in accordance with applicable law and those sources' terms.

5. How We Use Personal Data (Where Jutsu Is Controller)

We use Personal Data for the following purposes. The legal bases we rely on for individuals in the EEA, UK, and Switzerland are set out in Section 19.1.

• Provide and administer the Services — create and manage accounts; authenticate users; provide dashboards, reports, and support; process transactions; and perform our agreements.
• Protect Jutsu, our Customers, and others — secure our infrastructure; detect and prevent fraud, abuse, and unauthorized access; investigate attacks; debug problems; monitor performance; and enforce our terms and acceptable-use restrictions.
• Improve our Services — using usage, diagnostic, performance, and feedback information, and aggregated or de-identified information, to understand how the Services are used, troubleshoot problems, improve performance and user experience, and develop new functionality.
• Communicate with you — send service, security, and administrative notices; respond to inquiries; and communicate changes to the Services.
• Sales and marketing — communicate about Jutsu, send product updates and educational content, invite you to events, conduct business-to-business marketing, and measure marketing effectiveness, subject to applicable law (including consent where required). You may unsubscribe at any time using the link in our emails or by contacting us. Service and security notices are not marketing and will continue while you have an account.
• Recruiting — evaluate job applications and communicate with applicants.
• Legal and compliance — comply with applicable law; respond to lawful requests; enforce agreements; establish, exercise, or defend legal claims; maintain business records; and conduct audits.
• Corporate transactions — evaluate and carry out a merger, acquisition, financing, reorganization, or sale of assets, as described in Section 8.

We will not use Personal Data for purposes materially incompatible with those described here without providing notice and, where required by law, obtaining your consent.

6. How We Process Customer Data (Where Jutsu Is Processor)

Jutsu processes Customer Data only to provide the Services to the relevant Customer and in accordance with that Customer's documented instructions and agreement, including to: connect Customer systems; ingest, normalize, enrich, and correlate security events; detect potentially suspicious activity; investigate alerts; generate cases, findings, and reports; assist with or execute Customer-configured response actions; collect compliance evidence; and provide support.

Jutsu may also process Customer Data as permitted by the applicable Customer agreement and law to: maintain and secure the Services; detect and prevent fraud, abuse, and security incidents affecting the Services; comply with legal obligations; and create aggregated or de-identified information as described in Section 11.

Jutsu does not use Customer Data for its own marketing, does not combine Customer Data with Personal Data received from other sources except as necessary to provide the Services or as permitted by law, and does not sell or share Customer Data.

7. Artificial Intelligence Features

7.1 How AI Is Used

Certain features use artificial intelligence and machine-learning systems to analyze and correlate security events, classify and enrich alerts, conduct investigations, summarize findings, recommend actions, generate reports, map activity to frameworks or controls, and support other security workflows.

7.2 AI Service Providers

Jutsu uses third-party AI service providers as subprocessors to deliver these features. We limit information provided to them to what is reasonably necessary for the relevant function, and we contractually require them to process Customer Data only to provide services to Jutsu, to protect it with appropriate security measures, and not to use it to train or improve their own models.

7.3 No Training on Customer Data

Jutsu does not use Customer Data to train or fine-tune artificial intelligence or machine-learning models, whether Jutsu's own or a third party's, unless the Customer has expressly agreed in writing. This commitment does not restrict Jutsu's use of aggregated or de-identified information as described in Section 11.

With Customer authorization under the applicable agreement, Jutsu may derive technical threat indicators (such as malicious file hashes, domains, and attacker infrastructure) from Customer Data and use them to protect other Customers. Such indicators do not identify the originating Customer and are not used to identify Customer personnel.

7.4 Automated Actions and Human Oversight

Automated response actions — such as isolating an endpoint, disabling a user account, or revoking a session — are performed only where the Customer has enabled them and within policies the Customer configures. The Customer, as controller, determines whether and how such actions are used and is responsible for any required notice, review, or appeal processes for its own personnel. Jutsu does not use AI features to make decisions that produce legal or similarly significant effects about individuals for Jutsu's own purposes.

AI-generated outputs can be incomplete or inaccurate and should not be treated as definitive security conclusions, legal or compliance advice, audit opinions, or a substitute for human judgment. See Section 24.

8. How We Disclose Personal Data

We disclose Personal Data only as described below.

• Service providers and subprocessors — vendors that provide cloud infrastructure, data storage, databases, AI services, security, monitoring, communications, customer support, analytics, payments, email delivery, CRM, marketing, document management, professional services, and other operational functions. They are contractually bound to process Personal Data only on our behalf and subject to appropriate confidentiality and security obligations. A current list of subprocessors that process Customer Data is available on request.
• Customer-directed integrations — when a Customer enables an integration, Jutsu transmits information to or receives information from that third-party service as directed by the Customer. The third party's own privacy terms apply to its independent processing.
• Your organization — if you use the Services through a Customer account, the Customer's administrators may access information about your use of the Services.
• Resellers and partners — where you purchase or are introduced to the Services through a reseller or partner, we may exchange business contact and transaction information with that partner to administer the relationship.
• Professional advisers — attorneys, accountants, auditors, insurers, and other advisers, under duties of confidentiality.
• Legal and safety — where we reasonably believe disclosure is necessary to comply with law or valid legal process, respond to lawful governmental requests, investigate security incidents, prevent fraud or illegal activity, enforce our agreements, or protect the rights, property, or safety of Jutsu, our Customers, users, or others. Where legally permitted and appropriate, we will challenge requests we believe are invalid or overbroad and will notify the affected Customer before disclosing its Customer Data.
• Corporate transactions — in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or due diligence, subject to confidentiality obligations. Any successor will be required to handle Personal Data consistently with this Privacy Policy and, for Customer Data, the applicable Customer agreements.
• With your consent or at your direction.

9. We Do Not Sell Customer Data

Jutsu does not sell or share Customer Data, for monetary or other valuable consideration, and does not use Customer Data to build profiles about individuals for advertising.

Our public websites may use analytics and advertising technologies. Certain privacy laws treat some disclosures of online identifiers to such providers as a "sale," "sharing," or "targeted advertising," even when no money is exchanged. Where such laws apply, you may opt out using the "Your Privacy Choices" link on our website, by enabling Global Privacy Control, or by contacting us (see Sections 10 and 17).

10. Cookies, Global Privacy Control, and Do Not Track

Cookies and similar technologies. Jutsu uses cookies and similar technologies for authentication, security, preferences, website functionality, analytics, and marketing. Strictly necessary cookies are required for the website and Services to function. Where required by applicable law (including in the EEA and UK), we use non-essential cookies only with your prior consent, which you can withdraw at any time through our cookie settings. Elsewhere, you can opt out of non-essential cookies through our cookie settings. More detail is available in our cookie settings. Your browser may also allow you to block cookies, although some features may not function correctly.

Global Privacy Control. Where applicable law requires us to honor browser-based opt-out preference signals, including Global Privacy Control ("GPC"), we treat a valid signal as a request to opt out of the sale or sharing of Personal Data and targeted advertising for that browser and, if you are logged in, for your account.

Do Not Track. There is no uniform standard for "Do Not Track" signals, and we do not currently respond to them, except where they qualify as a legally recognized opt-out preference signal.

11. Aggregated and De-Identified Information

We may create aggregated, statistical, or de-identified information that cannot reasonably be used to identify an individual or, for information derived from Customer Data, a Customer. Where the applicable Customer agreement permits, we may use such information for service operation, reliability and detection improvements, security research, benchmarking, analytics, and product development.

We maintain and use de-identified information only in de-identified form, will not attempt to re-identify it except as permitted by law (for example, to test the effectiveness of our de-identification techniques), and contractually require any recipients to do the same.

12. Data Security and Security Incidents

We maintain administrative, technical, organizational, and physical safeguards designed to protect Personal Data against unauthorized access, acquisition, alteration, destruction, disclosure, or use. Depending on the systems and information involved, these safeguards may include encryption in transit and at rest, access controls, multi-factor authentication, logging and monitoring, least-privilege access, secure software-development practices, vulnerability management, incident-response procedures, personnel access restrictions, and vendor-security reviews. Our practices evolve as our Services, risks, and industry standards change.

No internet transmission, cloud environment, software platform, security control, or storage system can be guaranteed to be completely secure, and Jutsu cannot guarantee that unauthorized third parties will never defeat our safeguards.

If Jutsu becomes aware of a security incident affecting Personal Data, we will investigate, take appropriate steps to mitigate it, and notify affected Customers, individuals, and regulators as required by applicable law and our contracts. Customers are responsible for keeping their security and administrative contact information current so that we can deliver notices.

13. Data Retention

We retain Personal Data only as long as reasonably necessary for the purposes described in this Privacy Policy, taking into account the type of data, the Services provided, Customer-selected retention settings, contractual requirements, security needs, legal obligations, dispute resolution, and applicable statutes of limitation. When retention is no longer necessary, we delete or de-identify the data.

14. International Data Transfers

Jutsu is headquartered in the United States, and Personal Data may be processed in the United States and other countries where Jutsu or its service providers operate. These countries may have data protection laws different from those in your jurisdiction.

When we transfer Personal Data from the EEA, UK, or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss equivalents, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified, or another mechanism permitted by law, together with supplementary measures where appropriate. You may request a copy of the relevant safeguards by contacting us at legal@jutsu.ai. Additional transfer terms for Customer Data are set out in our DPA.

15. Your Privacy Rights

15.1 Your Rights

Depending on where you live and applicable law, you may have the right to:

• access and obtain information about the Personal Data we hold about you;
• correct inaccurate Personal Data;
• delete Personal Data;
• receive a portable copy of certain Personal Data;
• object to or restrict certain processing, including direct marketing;
• withdraw consent at any time, without affecting processing that occurred before withdrawal;
• opt out of targeted advertising, the sale or sharing of Personal Data, and certain profiling;
• appeal our decision on your request; and
• lodge a complaint with a supervisory authority or regulator.

These rights are subject to legal exceptions. For example, we may retain information needed to comply with legal obligations, defend legal claims, or maintain security.

15.2 How to Submit a Request

Email legal@jutsu.ai with the subject line "Privacy Request." We will respond within the time required by applicable law (generally 30 days in the EEA and UK, and 45 days under most U.S. state laws, extendable where permitted).

Verification. We will verify your identity before fulfilling requests to access, correct, or delete Personal Data, generally by matching information you provide with information we hold. We will use information provided for verification only for that purpose.

Authorized agents. Where permitted by law, an authorized agent may submit a request on your behalf. We may require signed permission from you and may verify your identity directly.

Non-discrimination. We will not discriminate or retaliate against you for exercising your privacy rights.

15.3 Appeals

If we decline to take action on your request, you may appeal by emailing legal@jutsu.ai with the subject line "Privacy Request Appeal" within a reasonable period after our decision. We will respond in writing within the time required by law (generally 45 or 60 days), explaining our decision. If your appeal is denied, you may contact your state Attorney General or other applicable regulator.

16. Personal Data Processed on Behalf of Customers

If your Personal Data appears in security logs, alerts, identity systems, cloud systems, compliance evidence, or other Customer Data that Jutsu processes on behalf of a Customer, that Customer is responsible for responding to your privacy request. Please contact that organization directly. If Jutsu receives your request, we will, as required by law and our contracts, refer it to the relevant Customer (where we can identify it) and assist the Customer in responding. Please identify the relevant organization, if known, so that we can route your request.

17. Notice to California Residents

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations (together, the "CCPA") apply. It supplements the rest of this Privacy Policy and does not apply to Customer Data that Jutsu processes as a service provider or contractor.

17.1 Personal Information We Collect and Disclose

In the preceding 12 months, Jutsu has collected the following categories of Personal Information, from the sources described in Section 4, for the business and commercial purposes described in Section 5:

17.2 Sale, Sharing, and Minors

Jutsu does not sell Personal Information for monetary consideration. Jutsu may "share" Personal Information (online identifiers and website activity) with advertising partners for cross-context behavioral advertising, which may be considered a "sale" or "sharing" under the CCPA. You may opt out via the "Your Privacy Choices" link on our website or by enabling GPC. We do not knowingly sell or share the Personal Information of consumers under 16 years of age.

17.3 Sensitive Personal Information

Jutsu uses and discloses Sensitive Personal Information only for purposes permitted by the CCPA regulations (Cal. Code Regs. tit. 11, § 7027(m)), such as providing the Services, ensuring security and integrity, and complying with law, and does not use it to infer characteristics about you. Accordingly, Jutsu does not offer a right to limit the use of Sensitive Personal Information.

17.4 Your California Rights

You may have the right to know what Personal Information we collect, use, disclose, sell, or share; to access, delete, and correct your Personal Information; to opt out of the sale or sharing of Personal Information; and not to receive discriminatory treatment for exercising your rights. To exercise these rights, see Section 15.2.

17.5 De-Identified Information

We maintain and use de-identified information without attempting to re-identify it, except as permitted by law, as described in Section 11.

17.6 Shine the Light

Jutsu does not disclose Personal Information to third parties for their own direct marketing purposes as described in California Civil Code § 1798.83.

18. Other U.S. State Privacy Rights

Residents of certain U.S. states (including Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws) may have rights to access, correct, delete, and port their Personal Data; to opt out of targeted advertising, the sale of Personal Data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and to appeal our decision on a request. Where such laws apply, Jutsu will honor these rights as described in Section 15, including recognizing legally required opt-out preference signals. Jutsu does not process sensitive data, as defined by these laws, for purposes requiring consent without first obtaining that consent.

19. European Economic Area, United Kingdom, and Switzerland

19.1 Legal Bases for Processing

Where Jutsu acts as controller, we rely on the following legal bases:

When we rely on legitimate interests, we balance our interests against your rights and freedoms. You may request more information about this balancing by contacting us.

Where we need Personal Data to enter into or perform a contract with you (for example, account information), failure to provide it may mean we cannot provide the Services. Otherwise, providing Personal Data is voluntary.

19.2 Your Rights

You have the rights listed in Section 15.1, including the rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may object at any time to processing for direct marketing, and we will stop. You also have the right to lodge a complaint with the supervisory authority in the country where you live, work, or where an alleged infringement occurred. Nothing in this Privacy Policy limits that right.

19.3 Automated Decision-Making

Jutsu does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you, in its capacity as controller. For Customer-configured automated actions, see Section 7.4.

19.4 Customer Data

Where Jutsu processes Personal Data on behalf of a Customer, the Customer is the controller, and requests should be directed to the Customer (see Section 16).

20. Sensitive and Regulated Information

The Services are intended for business cybersecurity operations. Unless expressly agreed in writing, Customers should not intentionally submit data subject to specialized regulatory requirements beyond the agreed scope of the Services, including protected health information governed by HIPAA, complete payment-card data, consumer financial account credentials, Social Security numbers, government-issued identification numbers, private cryptographic keys, special categories of personal data under the GDPR, or other highly sensitive information unnecessary for the Services. If such information is required for an engagement, the Customer and Jutsu will agree appropriate contractual and security terms (such as a Business Associate Agreement) before it is processed.

21. Children's Privacy

The Services are designed for businesses and professional users and are not directed to children. Jutsu does not knowingly collect Personal Data directly from individuals under 16. If you believe a child has provided Personal Data directly to Jutsu, contact legal@jutsu.ai and we will take appropriate steps to delete it.

Security telemetry processed on behalf of a Customer may contain information relating to individuals of various ages. In such circumstances, Jutsu processes that information on behalf of the Customer and does not collect it directly from the individual.

22. Third-Party Services

Our websites and Services may link to or integrate with third-party services. Jutsu is not responsible for the privacy, security, or data-processing practices of third parties that process information for their own purposes. We encourage you to review their privacy policies.

23. Customer Responsibilities

Customers using the Services are responsible for having appropriate authority to connect systems to Jutsu; complying with laws applicable to their collection and use of Customer Data; providing legally required notices to, and obtaining any required consents from, their personnel, customers, or users (including notices about workplace monitoring and automated actions); selecting appropriate integrations and configuring permissions; limiting data provided to what is reasonably necessary; and responding to data-subject requests as controller. Jutsu's processing of Customer Data does not by itself establish that a Customer's underlying collection or use of that data is lawful.

24. Service and AI Limitations

Jutsu's Services assist Customers with cybersecurity monitoring, detection, investigation, response, and compliance. No cybersecurity product can detect every threat, prevent every attack, identify every vulnerability, guarantee that an environment is secure or compliant, or eliminate false positives and false negatives. AI-generated outputs may be incomplete, inaccurate, or unexpected. The Services should be used as part of a broader security program, and Customers should review material security, response, legal, and compliance decisions before acting on them.

Warranties, disclaimers, limitations of liability, and the allocation of risk relating to the Services are governed exclusively by the applicable Jutsu Terms of Service, Master Services Agreement, order form, or other Customer agreement.

25. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, practices, technology, legal requirements, or business operations. We will update the "Last Updated" date and, for material changes, provide additional notice through our website, the Services, or email. We will not apply material changes that reduce the protection of Personal Data we have already collected — including any change to Section 7.3 — without providing advance notice and, where required by law, obtaining consent. Unless otherwise required by law, the updated Privacy Policy is effective when posted.

26. Relationship to Jutsu Agreements

This Privacy Policy describes Jutsu's privacy practices. The provision of the Services is also governed by the applicable Terms of Service, Master Services Agreement, order form, DPA, Business Associate Agreement (if applicable), statement of work, or other written agreement, which may contain additional terms regarding confidentiality, data protection, security, warranties, indemnification, intellectual property, service availability, and limitations of liability. This Privacy Policy is not a contract and does not create warranties regarding the operation, security, availability, accuracy, or effectiveness of the Services beyond those expressly established by applicable law or a written agreement with Jutsu.

27. Contact Us

Questions, concerns, complaints, or privacy requests may be directed to:

Jutsu Inc.
2043 East St #627
Concord, CA 94520
United States
Email: legal@jutsu.ai

If your request concerns information Jutsu processes on behalf of a Customer, please identify the relevant organization, if known.