Privacy Policy
Visitors to this website
We keep ordinary server logs (IP address, browser, pages requested, time) for security and troubleshooting and delete them within ninety days. We count visits with Umami, a privacy-focused analytics service. It sets no cookies and stores nothing that identifies you: it records the page viewed, the referring site, the browser, operating system and device type, an approximate location, and clicks on a few buttons such as the sign-up button. Links in emails we send may carry a tag that names the mailing, so we can tell which mailing led to a visit; the tag does not identify a person. We do not use advertising cookies or advertising trackers, and we do not follow you across other websites. Signed-in users receive a session cookie and a CSRF cookie that are needed for the site to work.
Customers
When an organisation opens an account we collect the names, email addresses and sign-in details of its users, its data broker registration number, its DROP API key and webhook secret (stored encrypted), billing details, and the files, identifiers and settings it gives us to run its deletion cycles. We use this information only to provide the Service, to bill for it, to send operational email such as deadline reminders and provider notices, and to answer support requests. We never sell it.
Information we process on behalf of data brokers
DROP runner handles consumer identifiers, usually as one-way hashes, so that a data broker can find and delete matching records as California law requires. In doing so we act as the broker's service provider. We process this information only on the broker's instructions, keep it encrypted at rest, do not combine it across customers, and delete it when the broker asks or the account ends, subject to the record-keeping period in our Terms of Service. If you are a consumer with a question about your own data, please direct it to the data broker concerned, or to the California Privacy Protection Agency's DROP service, since we do not hold the information needed to identify or answer you.
Where information is stored and who helps us
All information is stored in the United States. We use the following subprocessors: Render (application hosting, Oregon), Amazon Web Services (encrypted file storage), Postmark (operational email), Sentry (error reports, which are configured not to include personal data). Each is bound by written terms that restrict its use of the data to providing its service to us. Visit statistics for this website are collected by Umami, as described under Visitors above.
Security
Every user must use two-factor sign-in. Secrets are encrypted with keys held outside the database. Files are stored in private buckets with no public access. Access to production systems is limited to the people who operate the Service and is logged.
Retention
Customer account information is kept while the account is open and for three years afterwards, matching the audit period in the Delete Act, unless the customer asks for earlier deletion. Server logs are kept for ninety days. Email we exchange with you is kept as ordinary business correspondence.
Your choices and rights
You may ask us what information we hold about you, ask for a correction, or ask for deletion, by writing to support@jayanas.com. We answer within thirty days. We do not discriminate against anyone for exercising a privacy right.
Changes
If this policy changes we will post the new version here with a new effective date and email customers about material changes.