Privacy Policy

Effective: 2026-05-10. Written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.

⚠ Legal entity details are still placeholders. Set LEGAL_ENTITY_NAME and LEGAL_REGISTERED_ADDRESS in the production environment before charging customers. LEGAL_COMPANY_NUMBER is optional until the entity is registered; LEGAL_VAT_NUMBER is optional until the VAT threshold is crossed.

Who is the data controller?

The data controller for personal data processed through JAD Apps is [REGISTER LEGAL ENTITY BEFORE LAUNCH], registered at [REGISTER LEGAL ENTITY BEFORE LAUNCH].

For privacy questions, data subject requests, or to report a concern, write to privacy@jadapps.app or use our contact form.

What we collect, why, and for how long

Each row below sets out the data, our purpose, the legal basis under UK GDPR Article 6, and the retention period.

Account data

What: Name, email address, profile image, and OAuth provider account identifier (e.g. your Google account ID). Created when you sign in.
Why: To create and protect your JAD Apps account and let you sign in.
Legal basis: Performance of the contract between you and us (Article 6(1)(b) UK GDPR).
Retention: Held while your account is active. If you request deletion, we purge within 30 days, retaining only what we must for tax/audit (typically 6 years for invoices).

Subscription & billing data

What: Subscription tier, status, Stripe customer/subscription/price IDs, billing period dates, cancellation status, billing address (collected by Stripe at checkout), and VAT/tax number if you provide one.
Why: To run your subscription, charge the correct VAT, and meet our accounting and statutory record-keeping obligations.
Legal basis: Performance of contract (Article 6(1)(b)) for subscription management; Legal obligation (Article 6(1)(c)) for tax/accounting records.
Retention: Subscription records retained for 6 years after the end of the financial year in which the last transaction occurred (HMRC requirement).

Payment data

What: Payments are processed by Stripe. We do not store card numbers, CVCs, or bank details. Stripe sends us payment-event metadata (success/failure, last-4, country, dunning stage) so we can update your account.
Why: To process payments, recover failed payments, and prevent fraud.
Legal basis: Performance of contract (Article 6(1)(b)).
Retention: Stripe retains payment records under its own policies. Our copies are kept for the same 6-year accounting window.

Tool data

What: Files you process with the tools. The tools run in your browser. Files are not uploaded to JAD Apps servers in the standard tool flow.
Why: To run the tool you asked for. Files never leave your device unless you explicitly opt in to a server-side feature (none are enabled by default).
Legal basis: Performance of contract (Article 6(1)(b)).
Retention: Not retained by us.

Usage metadata

What: When you are signed in: tool name, action type (run / download / limit-blocked), file size, row counts, cleanup counts, duration, and timestamps. We do not store the contents of your files.
Why: To show your dashboard usage history and detect abuse / runaway jobs.
Legal basis: Legitimate interest (Article 6(1)(f)) in running and securing the service. You can request deletion at any time.
Retention: 12 months rolling, then aggregated and anonymised.

Security & abuse logs

What: Auth event logs, IP addresses on API key usage, rate-limit counters, failed sign-in attempts.
Why: To detect credential stuffing, prevent abuse, and respond to security incidents.
Legal basis: Legitimate interest (Article 6(1)(f)) in protecting the service and our customers.
Retention: 90 days, unless required for an active investigation.

Support correspondence

What: Emails, support tickets, and any data you choose to share when contacting us.
Why: To answer your question and keep a record of the resolution.
Legal basis: Legitimate interest (Article 6(1)(f)) in providing support.
Retention: 3 years from the date of last interaction.

Sub-processors

We rely on the following sub-processors to run the service. We have data processing agreements in place with each of them.

Provider	Purpose	Region	Transfer mechanism
Cloudflare, Inc.	Hosting (Cloudflare Pages), edge compute, CDN, DDoS protection, DNS.	Global edge network — UK / EU / US.	UK IDTA + EU Standard Contractual Clauses (SCCs) for any traffic that lands outside the UK/EEA.
Supabase, Inc.	Database (Postgres) holding subscription, usage, and account records.	EU (Frankfurt) by default.	EU SCCs / UK IDTA for support staff access from outside the EEA/UK.
Stripe Payments Europe, Ltd.	Payment processing, billing, invoices, tax calculation.	Ireland (controller) with US sub-processing.	EU SCCs / UK IDTA.
Resend (Plus Five Five, Inc.)	Transactional email delivery (welcome, receipts, password resets, dunning).	United States.	EU SCCs + UK IDTA.
Google LLC	Google OAuth sign-in. Receives the redirect at sign-in time only.	United States.	EU SCCs + UK IDTA.

International transfers

Some sub-processors operate outside the UK/EEA (notably Stripe, Resend, and Google). Where data is transferred internationally, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU SCCs, or — for transfers to countries with a UK adequacy decision — the adequacy decision itself. You can request a copy of the relevant transfer mechanism by contacting us.

Cookies

We use only the cookies listed below. None of them are advertising or cross-site tracking cookies. You can review and change your preferences at any time via the cookie banner shown on first visit.

Name	Purpose	Type	Duration
authjs.session-token / __Secure-authjs.session-token	Encrypted JWT session cookie. Required to keep you signed in.	Strictly necessary	30 days
__Host-authjs.csrf-token	Cross-site request forgery protection on the auth endpoints.	Strictly necessary	Session
jad-cookie-consent	Records your cookie preferences so we don't ask again.	Strictly necessary	12 months

Your rights

Right of access

You can request a copy of the personal data we hold about you. The dashboard's “Export my data” action returns a JSON file covering account, subscription, usage, and email-log records.

Right to rectification

If anything we hold about you is wrong, email us and we'll correct it. Profile fields tied to Google sign-in are managed in your Google account.

Right to erasure

You can delete your account from Settings → Account. We send a confirmation email; once confirmed, your data is purged within 30 days, and any active Stripe subscription is cancelled at the same time.

Right to restriction & objection

You can ask us to limit processing or object to processing based on legitimate interests. We will comply unless we have an overriding legal reason to continue.

Right to data portability

Your “Export my data” payload is provided in a machine-readable JSON format you can move to another service.

Rights related to automated decision-making

We do not make automated decisions that have a legal or similarly significant effect on you.

Right to withdraw consent

Where we process data on the basis of consent (e.g. non-essential cookies), you can withdraw that consent at any time via the cookie banner or your account settings.

Right to complain

You can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate a chance to fix things first.

Children's data

JAD Apps is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has signed up, contact privacy@jadapps.app and we'll delete the account.

Security incidents

If we suffer a personal data breach that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and notify you without undue delay. Suspected vulnerabilities can be reported to privacy@jadapps.app.

Changes to this policy

We may update this policy as the service evolves or the law changes. Material changes will be notified to active subscribers by email at least 14 days before they take effect.