Privacy policy
How Joe AI collects, uses and protects personal data.
Last updated: 31 August 2026
1. Purpose and scope
Joe AI publishes a conversational agent powered by artificial intelligence, built for real-estate professionals. It answers the calls and messages an agency receives, qualifies requests from tenants, owners and buyers, then creates the matching tickets and records in the agency's own tools.
This policy describes the processing of personal data carried out through the www.getjoe-ai.com website, the app.getjoe-ai.com portal, the mobile applications and the service itself.
It does not replace the information each client agency must give to the people it contacts or who contact it, nor the terms of the contract entered into between Joe AI and that agency.
2. Who processes your data
- Company
- JOE-AI SAS
- Legal form
- Simplified joint-stock company (SAS) with a share capital of 1,000 euros
- Registration
- Paris Trade and Companies Register — 931 220 735
- Registered office
- 25 rue des Écouffes, 75004 Paris, France
- President
- The company Babylone, itself represented by Stanislas Chertok.
- Contact
- contact@getjoe-ai.com
Any question about this policy or about exercising your rights may be sent to that email address, or by post to the registered office.
3. Our two roles: controller and processor
Joe AI acts in two different capacities, and telling them apart matters because they do not carry the same obligations.
Joe AI is a controller for the data it determines itself: website browsing, demonstration and contact requests, the commercial relationship with its clients, portal user account management, billing and platform security.
Joe AI is a processor, within the meaning of Article 28 of the General Data Protection Regulation, for the data processed on behalf of its client agencies: the calls, messages, emails and contact records of tenants, owners, buyers and suppliers. In that case the client agency is the controller: it defines the purposes, informs the individuals concerned and remains their point of contact. Joe AI acts only on its documented instructions.
If you dealt with a Joe AI agent during a call or a written exchange, please contact the real-estate agency concerned first. If you are not sure which one to approach, write to us and we will point you in the right direction.
4. Data processed where Joe AI is the controller
Depending on how you interact with us, we process the following categories of data:
- Website visits: technical data strictly necessary to deliver the pages and keep them secure (internet protocol address, browser type, request timestamps).
- Demonstration or contact requests: first name, surname, business email address, telephone number, company, job title and the content of your message.
- Portal users: login credentials, name, business email address, role, associated agency, preferences, connection and activity logs.
- Contractual relationship and billing: billing details, subscription history, service usage, exchanges with support.
We do not process special categories of data within the meaning of Article 9 of the General Data Protection Regulation, and we never knowingly collect data relating to minors.
5. Data processed on behalf of our clients
When an agency uses Joe AI, the platform processes the following data on its behalf:
- Calls: caller's number, timestamp and duration, audio recording, transcript of the conversation, and the information extracted from that transcript (nature of the request, property address, level of urgency, contact details provided).
- Written exchanges: text messages, WhatsApp conversations, messages left through the live chat on the agency's website, and emails where the agency has connected its mailbox.
- Contact and property records synchronised from the agency's property-management or customer-relationship software: identity, contact details, link to a unit, a building or a mandate.
- Tickets and requests created from those exchanges, together with their follow-up through to closure.
This data is partitioned per agency: no client organisation ever has access to another organisation's data.
6. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service, managing accounts and the contract | Performance of the contract |
| Handling demonstration and contact requests | Pre-contractual steps taken at your request |
| Business-to-business marketing | Legitimate interest, or consent where the regulation requires it |
| Platform security, prevention of fraud and abuse | Legitimate interest |
| Improving and monitoring service quality | Legitimate interest |
| Billing, accounting and tax obligations | Legal obligation |
| Handling calls and messages on behalf of an agency | Processing agreement; the legal basis is determined by the agency |
Where we rely on our legitimate interest, we check that it does not disproportionately affect your rights, and you may object to it at any time.
7. Retention periods
| Data | Period |
|---|---|
| Technical logs containing personal data (calls, exchanges with integrations) | 30 days |
| Audit and security logs | 180 days in production |
| Scheduled-task execution logs | 14 days for the detail, 7 days for periodic synchronisations |
| Data processed on behalf of an agency (recordings, transcripts, tickets, contacts) | Term of the contract, then deletion |
| Contacts left without activity | Automatic anonymisation in the database |
| Prospects and contact requests | 3 years from the last exchange |
| Portal user accounts | Term of the agency's contract |
| Accounting records and invoices | 10 years, as required by the French Commercial Code |
On expiry or termination of the contract, and unless the client instructs otherwise in writing, any data processed on its behalf still in our possession is deleted.
Anonymising contacts left without activity removes their identifiers in clear text and keeps only irreversible fingerprints, so that a new call or message from the same person can still be matched to their file without us retaining their contact details.
8. Transfers outside the European Union
Hosting, the database, recording storage and the artificial-intelligence analysis of transcripts all take place in the European Union, in the eu-west-3 (Paris) and eu-central-1 regions.
Some of our providers, in particular for telephony, speech synthesis and notifications, process data from the United States. These transfers are governed by the safeguards set out in Chapter V of the General Data Protection Regulation, in particular the European Commission's standard contractual clauses or, where applicable, the recipient's certification under the European Union–United States Data Privacy Framework.
A copy of the applicable safeguards may be requested from contact@getjoe-ai.com.
9. Security and minimisation
Joe AI implements administrative, technical, organisational and physical measures designed to protect the confidentiality and integrity of data, including:
- Encryption of traffic in transit and of data at rest.
- Application-level encryption of the credentials used to connect to agency software.
- Partitioning of data by client organisation.
- Access control, administrator authentication and logging of sensitive actions.
- Application-level traffic filtering, continuous monitoring and operational alerting.
- Automatic purging of logs containing personal data, and anonymisation of contacts left without activity.
Joe AI is working towards compliance with the ISO/IEC 27001:2022 standard and documents its information security management system.
10. Artificial intelligence and automated decisions
The conversational agent analyses the content of exchanges in order to understand a request, qualify it and route it to the right person within the agency. Transcripts are processed by language models running, by default, in the European Union.
This processing produces no decision based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Article 22 of the General Data Protection Regulation: what happens next with your request is always down to a member of the agency's staff.
Your exchanges are not used to train general-purpose artificial-intelligence models.
Calls are recorded and transcribed on behalf of the client agency, which is responsible for informing the people called and, where applicable, for obtaining their consent.
11. Your rights
Subject to the conditions set out in the regulation, you have the following rights:
- The right to access your data and obtain a copy of it.
- The right to have inaccurate or incomplete data corrected.
- The right to erasure of your data.
- The right to restriction of processing.
- The right to object, in particular to direct marketing.
- The right to portability of the data you provided to us.
- The right to withdraw your consent at any time, where the processing relies on it.
- The right to set instructions on what happens to your data after your death.
To exercise these rights, write to contact@getjoe-ai.com setting out your request. We reply within one month, which may be extended by two months for complex requests. Proof of identity may be requested where there is reasonable doubt.
If your request concerns data processed on behalf of a real-estate agency, we forward it to that agency, which is the sole controller, and we assist it in replying.
You may also lodge a complaint with the competent supervisory authority:
- Authority
- Commission nationale de l'informatique et des libertés
- Address
- 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Website
- www.cnil.fr
12. Cookies and trackers
The www.getjoe-ai.com website sets no cookies and uses no audience-measurement or advertising tools. No consent banner is therefore required.
The third-party video players in the press section load only after you explicitly click them: no exchange with those services takes place until you activate them.
The app.getjoe-ai.com portal uses only the cookies strictly necessary to authenticate you and keep your session open. They are exempt from consent and are not used for any tracking.
13. Changes to this policy
This policy may be updated to reflect changes to the service, to our providers or to the regulation. The date it was last updated appears at the top of the page.
Where a change is substantial, clients are informed as provided for in the contract.