Privacy Policy

1. Data controller

The controller of the data collected through Journn is [Legal company name], registered at [Registered address], VAT/Company number [VAT/Company number]. For any request regarding your personal data, you can write to us at [privacy/legal email].

2. What data we collect

Account data: email, name and profile picture, provided via Google or by email at sign-up.

Business data: project name and website, industry, business description, target audience, competitors, city or service areas: information you enter yourself, or that we collect by analyzing the public pages of your website to generate relevant content.

Third-party credentials: if you connect your CMS (WordPress, Shopify) or Google Search Console, we store the credentials/tokens needed to publish articles or read ranking data, encrypted at rest.

Content: generated articles, their intermediate versions and associated SEO metadata.

Usage data: which features you use, how many articles you generate, and the cost of third-party API calls tied to your account, for billing and abuse-prevention purposes.

Contact requests: if you write to us through our access-request form, we store your email, name and any website you provide.

3. Why we use your data

We use your data to: provide and deliver the Service you requested (performance of a contract); connect your Google account and Search Console only after your explicit consent; manage billing and comply with tax and accounting obligations; prevent abuse, fraud and anomalous use of the Service (legitimate interest); respond to requests you send us.

4. Who we share your data with

We do not sell your personal data. We share it only with providers that help us deliver the Service, to the extent necessary:

- Anthropic and OpenAI, to generate text and images with artificial intelligence; - DataForSEO and Serper, for keyword research and search results data (they receive search terms, not your identifying data); - Google, if you connect Search Console access; - Supabase, which hosts our database and manages authentication; - Resend, to send transactional emails and periodic reports; - Paddle, to process payments for the Standard plan: we never see or store your card data.

Each provider processes data under its own privacy policy and, where required, under a data processing agreement (DPA) with us.

5. International data transfers

Some of the providers listed above are based, or process data, outside the European Economic Area (e.g. the United States). In these cases we rely on the safeguards provided by applicable law (e.g. the European Commission's Standard Contractual Clauses) to ensure an adequate level of protection for your data.

6. How long we keep your data

We retain your account and project data for as long as your account remains active, plus the period required to comply with tax or legal obligations after closure.

Keyword research data (cache) expires automatically after 7 or 30 days depending on the type of data, and is recalculated if requested again. Contact requests (e.g. the access-request form) are kept until we process them or for as long as needed to follow up with you.

7. How we protect your data

Your CMS credentials and access tokens (e.g. Google Search Console) are encrypted at rest using AES-256-GCM. All communication with the Service happens over HTTPS. Access to data within your organization is governed by roles (owner, admin, editor, viewer), so each user only sees what they need.

8. Your rights

Under Regulation (EU) 2016/679 (GDPR) you have the right to: access your data, request its correction or deletion, request portability, object to processing, or withdraw a previously given consent (e.g. Google Search Console connection, which you can disconnect at any time from the app).

To exercise these rights, write to us at [privacy/legal email]: we currently handle these requests manually and respond within the timeframes required by law. You also have the right to lodge a complaint with your local data protection authority.

9. Cookies

We only use strictly necessary cookies: a session cookie to keep you signed in, a cookie to remember your chosen language, and short-lived cookies (a few minutes) used while connecting Google Search Console. We do not use profiling, advertising or third-party tracking cookies, so no consent banner beyond this notice is required.

10. Children

The Service is not intended for individuals under 18 years of age, and we do not knowingly collect data from children.

11. Changes to this notice

We may update this notice over time. In case of material changes, we will notify you by email or with an in-app notice before they take effect.

12. Contact

For any question about this notice or your data, write to us at [privacy/legal email].