Data Processing Agreement

You are the data controller for personal data you input into the Jojan One platform. Jojan One acts as a data processor, processing that data only on your instructions and in accordance with this DPA.

Jojan One is the data controller for data collected about your use of the platform (account data, usage data, technical data). This is governed by our Privacy Policy.

We process personal data only to provide the services described in the Terms of Service and as instructed by you. We will not process your data for any other purpose without your explicit consent.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. See our Security page for details.

We use a limited number of sub-processors to deliver our services. All sub-processors are bound by data processing agreements that meet the requirements of UK GDPR.

Current sub-processors are: Vercel (application hosting), Supabase (managed database, authentication and file storage), Stripe (payment processing), Anthropic (the AI model behind Jova, processed under terms that exclude use of your data for model training) and Resend (transactional email).

We will notify you of any changes to our sub-processor list with at least 30 days' notice, giving you the opportunity to object.

Your business records are stored in a European region. Some processing takes place outside the EEA - notably requests to our AI model provider - and where it does we rely on Standard Contractual Clauses and equivalent safeguards.

We will assist you in responding to data subject requests under UK GDPR, including requests for access, rectification, erasure and portability.

We will notify you without undue delay if we become aware of a personal data breach affecting your data, and in any event within 72 hours.

On termination of your account, we will delete or return all personal data within 90 days, unless retention is required by law.