Privacy Policy
How the AIRewards SDK handles information. Last updated: October 17, 2026 · Version 1.0
1. Who we are and scope
Bajaar LLC (“AIRewards”, “Jutera”, “we”) provides an embeddable rewarded AI-search widget and publisher platform. This Policy describes personal information we process in three roles: (a) from publisher personnel (account users) in the dashboard; (b) from end users of a publisher’s website or app when the AIRewards widget runs — where we act as a service provider to the publisher for the rewarded-activity service, and as an independent operator of advertising mediation; and (c) from visitors to our marketing and documentation sites. The publisher’s own privacy policy also applies to end users and controls the publisher’s use of webhook and reporting data.
2. Information we collect
Publisher account data: email, company name, role, one-time-passcode and login records, IP address and user agent at login, dashboard settings, webhook URLs, payout details and tax-form status, and support communications. Tax documents themselves are held in our finance records; the dashboard stores status flags.
End-user / widget data (per session): the publisher-supplied opaque user_id and optional metadata the publisher chooses to send (publishers must not send emails, names, or other direct identifiers as user_id or metadata); questions asked, AI responses shown, pick and attribute selections, conversation and event IDs; timestamps; coarse technical signals (IP address, user agent, device and browser type, language, approximate location derived from IP at country/region level); availability, cap, and anti-fraud outcomes; and advertising interactions and identifiers set by ad partners (Section 4).
Site and docs data: pages viewed, referrers, and basic analytics. We do not knowingly collect data from children under 13 (or the applicable minimum age) — the widget is for publishers to deploy only where lawful; report concerns using the contact in Section 10.
3. How we use information
We use information to operate and secure the service (sessions, passcodes, keys, fraud and flood prevention, caps, bans); to run the duel and continue conversations; to select, serve, measure, and reconcile advertising and revenue share (including provisional and payable accounting and payout); to deliver webhooks and reports to the publisher that supplied the user_id; to debug and analyse model quality and preference signals (in de-identified or aggregated form where feasible); and for legal, tax, and policy compliance, and to communicate with publisher personnel about the account. Questions and responses are processed by our AI routing provider (FreeRouter) and its downstream model providers and gateways solely to generate responses and operate the service. Publishers and end users must not submit highly sensitive personal information in questions, and we apply the retention limits in Section 6.
4. Advertising technology
Advertising in the widget is served through mediation partners, today Gravity, Koah, and Velocity, and in the future other networks (for example Thrad) after notice by updating this Policy and the partner list in our documentation. These partners (and their downstream buyers) may use cookies, SDKs, mobile and web identifiers, IP address, and interaction signals to select, serve, cap, measure, and prevent fraud for ads, and to build interest-based advertising profiles under their own policies. Server-side partners receive the conversation context needed to select a relevant ad (for example the question and winning response), session and event IDs, and device IP and user agent; browser-SDK partners interact directly with the end user’s browser or app webview. This advertising activity may constitute a “sale” or “sharing” of personal information (identifiers, internet activity, approximate location, and in-context content signals) for cross-context behavioural advertising under laws such as the CCPA/CPRA. Opt-out mechanisms are in Section 7. We do not receive publishers’ end-user emails or names from the widget, and we direct publishers not to send them.
5. Cookies and similar technologies
We use strictly necessary cookies and storage (dashboard sessions, the passcode flow, the widget session, and theme preferences). Ad-partner cookies and SDK identifiers are described in Section 4. We do not use non-essential analytics cookies on the dashboard. We treat a Global Privacy Control (GPC) signal as a request to opt out of sale/sharing for that browser, as described in Section 7.
6. Retention
Conversation content (questions and responses) is retained while needed for ad-context derivation, abuse review, and quality analysis, and is purged within 90 days of last activity except for flagged content under review. Earning, advertising, and ledger records are kept for the life of the account plus 7 years for accounting and tax. Security and fraud logs are kept for 12 months. Passcode and session records are short-lived (days). Publisher account data is kept for the life of the account plus applicable statutory periods after closure. Backups purge on their normal cycle. Aggregated and de-identified statistics may be retained indefinitely.
7. Choices and rights
Depending on jurisdiction (including California and other state privacy laws, and the GDPR/UK GDPR where applicable), individuals may request access, correction, deletion, portability, restriction of or objection to processing, and may opt out of sale/sharing or targeted advertising, and appeal a denied request. End users: start with the publisher whose app or site you used (it controls your account and can identify you); we will support the publisher and, where we can identify your widget records from information you provide (publisher name, approximate dates, and your user_id if known), honour verified requests directly. Publisher personnel: exercise rights via the dashboard or the contact in Section 10. Opt out of sale/sharing: contact us via Section 10 with “Do Not Sell or Share” in the subject, or use a browser sending a Global Privacy Control signal; the widget’s advertising will then be limited to contextual (non-cross-context) ads where technically feasible. We do not discriminate against anyone for exercising their rights, and we accept authorised-agent requests as required by law.
8. Disclosure of information
We disclose information: to ad partners (Section 4); to service providers under contract (hosting, email delivery, FreeRouter and downstream model providers per Section 3, payout and finance processors, and support tooling); to the publisher that supplied an end user (their events and reports — that publisher’s use is governed by its own policy); for legal process, safety, fraud prevention, and Terms enforcement; and in a business transfer (merger, acquisition, or asset sale) subject to this Policy or notice. We do not sell publisher personnel contact lists, and we do not sell personal information outside the advertising activity described in Section 4.
9. Security and international transfers
We apply reasonable administrative and technical safeguards (hashed secrets and codes, encrypted transport, access controls, and audit logging for admin actions); no system is perfectly secure. Data is processed in the United States. The service is intended for U.S. publishers at this stage; publishers deploying to other jurisdictions are responsible for confirming lawfulness with us before doing so.
10. Contact; changes
Privacy contact: privacy@jutera.com, Bajaar LLC (Jutera / AIRewards SDK). A data-processing addendum for publishers is available on request. We will post changes here and, for material changes, notify publisher account emails or the dashboard in advance where required. Continued use after effectiveness constitutes acknowledgment to the extent permitted by law.