Privacy Policy
This policy explains what data we collect, what it is used for, how we protect it, who we share it with, and what you can ask us to do with it.
Data we collect
Account data: name, email, phone number. Business data: business name, team members, roles. Transaction data: invoices, payments, balance, and usage history. Technical data: IP address and access logs for security. We do not collect sensitive data beyond what is necessary.
Legal basis for processing
We process data on the basis of: performance of a contract (providing the Services), compliance with legal obligations (e.g. financial records), legitimate interests (security & fraud prevention), and your consent for specific things (e.g. marketing notifications).
Use of data
Data is used to provide and maintain the Services, to bill, to send operational notifications (e.g. invoice reminders via WhatsApp/email), to provide support, and to improve the product. We do not sell your personal data.
Data protection
We apply field-level encryption with per-account keys, role-based access with Row-Level Security (RLS), and audit logging for every access to personal data. PII (e.g. phone numbers) is masked by default; every attempt to reveal it is written to the audit log.
Sharing with third parties (sub-processors)
We share the minimum necessary data with trusted providers to run the Services: Duitku (payment processing) and Meta WhatsApp (message delivery for the WABA product). They are bound by confidentiality obligations and process data only on our instructions.
Storage & retention
Data is stored while the account is active and for as long as legal obligations require (e.g. financial and audit records). After that it is securely deleted or anonymised.
Your rights
You have the right to access, rectify, restrict processing of, and request erasure of your personal data. Erasure requests are handled by crypto-shred (destroying the encryption key) and anonymisation; transaction and audit rows are retained as legally required.
Cookies & similar technologies
We use essential cookies for authentication and session security. Analytics cookies are used only with consent and can be managed from your browser settings.
Security incidents
If a data breach poses a risk to you, we will notify you and the relevant authorities without undue delay.
Policy changes
This policy may be updated. Material changes will be announced by email or in the portal, and the "last updated" date above will be adjusted.
Contact us about your data
For questions about your personal data, or to request a copy or deletion, contact us at privacy@jasaonline.net.