Privacy statement

This statement is about your De Jouwer account: the account you sign in with at our products on account.dejouwer.com. It also covers the emails the account sends and this website, dejouwer.com. What you do inside a product is covered by that product’s own terms.

Who we are

The account and this website belong to De Jouwer, based in the Netherlands. We are responsible for what happens to your data. Questions about privacy go to hello@dejouwer.com or through the contact form.

What the account stores

Your profile

• Your email address, and whether it has been confirmed.
• Your name.
• If you sign in with Google or Microsoft: the fixed id that service gives us for your account, so we recognise you next time. The service also sends us your name and email address, and, if it provides them, the link to your profile picture and your language.
• Your language, time zone and phone number, only if you fill them in yourself.

We store no passwords: the account doesn’t have one.

Organizations

At our products you work in an organization, such as your company. We store the organization’s name, who its members are and their role (owner, admin, member or viewer), and which products the organization may use. If someone invites you, we store your email address, the role, who invited you and until when the invitation is valid.

Sign-in codes

If you sign in with a code by email, we create a six-digit code that works once, for 10 minutes. We don’t store the code itself, only an encrypted derivative (a hash) that lets us check whether a code is right. With it we store your email address, when the code was made and when it expires, whether it was used, the number of attempts and which product you were signing in to.

Emails we send

Sign-in codes and invitations come from noreply@mail.dejouwer.com. Emails our products send you go through the same system. For every email we keep what kind of email it was, when and to which address it went, and whether it was delivered. A sign-in code is only ever stored there encrypted. If you have chosen in a product which emails you want to receive, we store that choice.

Sessions and cookies

On account.dejouwer.com we only set cookies that are needed to sign in. They are not for statistics or advertising, which is why we don’t ask for consent.

• __Host-backbone_session: remembers that you are signed in. Valid for 12 hours, and that time starts again as long as you use the account.
• __Host-backbone_external: only while you sign in with Google or Microsoft, for at most 10 minutes.
• backbone_af: protects the forms on the sign-in page against misuse.
• backbone_lang: your language, only if you choose one yourself. Valid for one year.

After you sign in, the account gives the product proof that it is you, with your account id, email address, name, language and time zone, and the organization you work in with your role. That proof is valid for 15 minutes and is renewed while you are signed in. The product sets its own session cookie for this, on its own address.

What happens in an organization

We keep a log of what changes in an organization: who invited someone or changed a role, which products the organization may use, whether an email was delivered, and when. Our products can record what happened there too. The log says who did it (an account id) and what changed, so we can work out what happened when something goes wrong.

Technical data

To deliver the sign-in page and keep attacks out, our servers and the AWS firewall process technical data such as your IP address and browser type. We count per IP address how often a code is requested, to stop misuse; that count is kept in memory and not stored. Our servers write technical logs, which are deleted automatically after 30 days.

Why we do this

• Your profile, your organizations, the sign-in codes and the emails are needed to let you sign in and use our products, as agreed with you (performance of a contract).
• The organization log, the technical data and the limits on attempts protect your account and our products (legitimate interest).

We don’t sell your data and don’t use it for advertising.

Who processes your data for us

• Amazon Web Services (AWS), in Frankfurt, Germany (region eu-central-1): the servers and database of the account, and sending email with Amazon SES. Requests to account.dejouwer.com pass through Amazon CloudFront, the AWS network that delivers pages.
• Google or Microsoft, only if you choose to sign in with them. That service then sees that you are signing in to De Jouwer. What Google or Microsoft does with your data is covered by their own privacy statements.
• Cloudflare: DNS for dejouwer.com and delivering this website.
• Resend: sending the messages from the contact form on this website.

AWS, Cloudflare and Resend process your data only on our behalf. Some of these companies are American. Where data may leave the European Union as a result, the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework apply.

How long we keep it

• Your profile and the ways you sign in: as long as your account exists.
• Organizations, memberships, invitations and the log: as long as the organization exists. Your membership goes when you leave the organization.
• Sign-in codes and sent emails: a code works for 10 minutes. We don’t clean up the records about them automatically yet. Until we do, we delete them together with your account, or sooner if you ask.
• Cookies: as listed for each cookie above.
• Technical logs: 30 days.
• Automatic database backups: 14 days.

Deleting your account

Email us at hello@dejouwer.com from the address of your account. We delete your account within a month and let you know when it’s done. If you are the only owner of an organization, we first agree with you what happens to that organization.

This website

• dejouwer.com sets no cookies, not even functional ones.
• No statistics, analytics or other tracking.
• Fonts and images come from dejouwer.com itself, not from third-party services.

The website is delivered through Cloudflare. To deliver a page to you and keep attacks out, Cloudflare processes technically necessary data such as your IP address and browser type. We keep no visitor logs ourselves.

The contact form

The form asks for your name, your email address and your message, and if you like your company name and phone number. We use them only to reply to you.

The form stores nothing. Your message reaches our mailbox as an email, with your address as the reply-to. We send it with Resend (Resend, Inc., an American company). To prevent misuse, Cloudflare briefly counts how many messages come from one IP address; that count is not kept.

The legal basis is our legitimate interest in answering messages. We keep your message as long as needed to deal with your question, and delete it afterwards.

If you email us

If you email hello@dejouwer.com, we use your email address, your name and what you write in the same way and on the same basis. Mail to dejouwer.com arrives at Apple’s iCloud Mail.

Your rights

You can ask us which data we hold about you, and have it corrected or deleted. You can also object to its use, have its use restricted or ask for a copy to take with you. Email hello@dejouwer.com; we reply within a month. If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If anything changes in what the account or this website processes, we update this statement and the date at the top.