Privacy notice

JEPROVAL — hosted privacy notice Version: fi-privacy-20261028-1 CONTROLLER JUHARYY / Juha Ryynänen, Finnish business ID 1250702-8. Plassintie 35 A5, 85100 Kalajoki, Finland. Primary contact: juharyy@outlook.com. Telephone +358 45 855 7166; voicemail when unanswered. Calls at your operator's normal rate, no additional service charge. INFORMATION AND PURPOSES You supply the business question and answers. The application stores those answers, generated reports/drafts, saved observations, case/access identifiers, password hashes, recovery controls, usage/security records and cost reservations. For purchases, it also stores buyer name/type, optional business reference, confirmation email, declared country, price, accepted agreement and declarations, payment identifiers/status, delivery records and withdrawal/complaint records. We use information necessary to provide requested assessments and paid service, maintain access and deliver confirmations on the basis of the contract or your request for pre-contractual service. Required transaction records are retained for legal obligations. Essential security, access control, duplicate-payment prevention and abuse/cost limits serve our legitimate interest in operating a secure, financially controlled service; your rights and the necessity of the processing must be respected. We do not treat a purchase as marketing consent. Providing required buyer/contact information is necessary to complete a purchase. Do not submit health information, credentials, other people's personal records or confidential customer data. Use only information necessary for your question. RECIPIENTS AND INTERNATIONAL PROCESSING Render hosts the application; the configured application region is Frankfurt. Necessary answer text and question/case context are sent to the OpenAI API for AI processing. The API requests use store=False. This does not mean zero provider retention: OpenAI's standard abuse-monitoring logs may retain content for up to 30 days, with documented legal/security exceptions. API business data are not used to train OpenAI models by default under its published business policies. Stripe processes payment/card information and billing-address information on its own payment page. JEPROVAL does not store card numbers. The application receives necessary payment status/identifiers and relevant billing-country information. Resend provides transactional email delivery, processing recipient addresses and the order/withdrawal-confirmation content. Your email provider also processes messages delivered to your inbox. Do not reply with API keys or card details. These providers can process data outside the EU/EEA, including in the United States. An EU application server alone does not confine all processing to the EU. Applicable provider data-processing terms and transfer safeguards, including EU Standard Contractual Clauses and adequacy mechanisms where applicable, govern transfers. Provider details and safeguards are available at: https://render.com/dpa https://openai.com/policies/data-processing-addendum/ https://developers.openai.com/api/docs/guides/your-data https://resend.com/legal/dpa https://stripe.com/privacy Contact the controller for information about applicable safeguards/copies. RETENTION AND DELETION CRITERIA Access expiry is not automatic erasure. An unfinished free case has an inactivity policy of 14 days from the last answer; a completed free assessment has its shown 30-day access period. Paid access lasts 30 days from verified confirmation. Working answers, reports and interpretations are needed for that access period, requested support, and resolving an actual complaint or dispute. They are not kept merely because an accounting record must be retained. After those purposes end, unnecessary working content is eligible for deletion/anonymisation through operator maintenance. You may request deletion earlier; any legal exception is assessed and explained. There is no promise that the program erases everything on day 30 and no automatic paid-case deletion schedule in this release. Order, agreement, payment and related business-correspondence records needed to verify transactions are retained for the applicable statutory accounting period: generally at least six years from the end of the year in which the accounting period ended. Financial statements/books and corresponding accounting lists have a ten-year minimum where applicable. This is not a basis for retaining unrelated business answers for six or ten years. Necessary records for an actual legal claim may be preserved for that claim; access is restricted. Backups and the interpretation cache may contain working data. The automatic backup rotation retains up to seven recognized batches; manual/exported copies need separate operator review/deletion and are not included in that rotation. Provider logs follow their own applicable service/security/legal retention. Pseudonymised budget/abuse counters may outlast the working case where necessary to prevent deletion from resetting limits; they do not contain answer text or API keys. Retention must remain tied to that purpose, not unlimited reuse. SECURITY AND BROWSER STORAGE The hosted service uses HTTPS, an essential session cookie, case ownership checks, request protection and access controls. Passwords are stored as salted hashes, not readable passwords. Keep passwords/recovery codes private. No security system can guarantee complete protection. Downloaded reports are under your control. The downloadable software has a separate local-data/privacy description; this notice describes the hosted service. YOUR RIGHTS Contact juharyy@outlook.com to request access, correction, erasure, restriction, objection or portability where applicable. We verify case ownership/identity only as necessary and explain any lawful retention exception. Requests are handled within GDPR deadlines. You can complain to Finland's Data Protection Ombudsman, https://tietosuoja.fi/. No solely automated legally binding business decision is made for you: you review JEPROVAL output and make your own decisions.