Privacy Policy
Last updated: October 16, 2026
This Privacy Policy describes how Joinways SAS collects, uses, stores and protects your personal data when you use our Service. It applies to all users of the Service, whether they use the Free plan or a paid subscription.
1. Data Collected, Purposes and Legal Basis
| Data | Purpose | Legal basis | Required |
|---|---|---|---|
| Name, email, password | Account creation and management | Contract | Yes |
| Content you create (events, proposals, contacts) | Service provision | Contract | Yes |
| Billing data | Payments and accounting | Contract + legal obligation | Yes |
| IP address, browser, logs | Security and fraud prevention | Legitimate interest | Yes |
| Usage data | Service improvement | Legitimate interest | No |
| Venue search on the homepage (typed text, selected establishment) | Service improvement and prospecting | Legitimate interest | No |
| Notification token, device model, app version, language (mobile app) | Sending notifications to your phone | Contract | No |
| Email (marketing) | Newsletters and communications | Consent | No |
Note: Data marked as required is necessary to provide the Service. Without it, you may not be able to use the Service fully.
2. Recipients and Sub-processors
We do not sell your data.
We share your data only with the sub-processors needed to provide the Service. The main categories are:
| Category | Provider | Location | Safeguards |
|---|---|---|---|
| Hosting / Database | Supabase (AWS) | EU (Paris) | DPF + SCCs |
| CDN / Frontend | Vercel | USA / Global | DPF + SCCs |
| Payments | Stripe | USA / Ireland | DPF + SCCs |
| Electronic signature | SignatureAPI | USA | DPF + SCCs |
| Transactional emails | Resend | USA | DPF + SCCs |
| AI / Automated processing | OpenAI / Anthropic | USA | DPF + SCCs + DPA |
| Phone notifications (mobile app) | Expo, Google (Firebase Cloud Messaging), Apple (APNs) | USA | DPF + SCCs |
Note: This list is updated regularly. Sub-processors are selected for their GDPR compliance and are bound by data processing agreements (DPAs).
2.1 International Transfers
Some of our sub-processors are located outside the European Union, particularly in the United States. These transfers are governed by:
- Data Privacy Framework (DPF): For transfers to the United States
- Standard Contractual Clauses (SCCs): For other third countries
These safeguards ensure an adequate level of protection for your data in accordance with the GDPR.
Full list of sub-processors available upon request: privacy@joinways.app
3. Retention Period
- Account data: duration of contract + 3 years
- Invoices: 10 years (legal obligation)
- User content: duration of contract + 30 days for export
- Connection logs: 1 year
4. Your Rights
GDPR (EU)
- Right of access: Obtain a copy of your personal data
- Right to rectification: Correct inaccurate data
- Right to erasure: Request the deletion of your data
- Right to data portability: Retrieve your data in a structured format
- Right to object: Object to processing on legitimate grounds
- Right to restriction: Restrict processing in certain cases
- Right to withdraw consent: At any time for consent-based processing
CCPA (California)
- Right to know: Know what data is collected and how it is used
- Right to deletion: Request the deletion of your data
- Right to opt out: Opt out of the sale of data (not applicable: we do not sell your data)
- Right to non-discrimination: You will not be discriminated against for exercising your rights
Exercise your rights:
Send your request by email to privacy@joinways.app, stating your identity and the right you wish to exercise.
Response time: We respond within one month of receiving your request. For a request made under the CCPA, this period may be extended to 45 days if the request is complex.
Identity verification: For your security, we may ask for proof of identity to verify who you are before processing your request.
5. Complaints
You may file a complaint with the CNIL (France) or the data protection authority in your country.
6. Security
Your data is protected by TLS/AES-256 encryption, multi-factor authentication (MFA), access controls and encrypted backups. In the event of a data breach, notification is made within 72 hours.
7. Cookies
See our Cookie Policy.
8. Minors
The Service is reserved for professionals aged 18 and over. We do not knowingly collect data from minors.
9. Automated Decisions
We do not use automated decision-making that has legal effects on you.
10. Modifications
We may modify this Privacy Policy to reflect changes in our practices or for legal or regulatory reasons.
If we make a substantial change, we will notify you by email, at the address associated with your account, at least 30 days in advance. The date of the last update appears at the top of this page.
Continued use: Your continued use of the Service after being notified of the changes constitutes acceptance of the new Privacy Policy.
11. Delete Your Account
You can delete your Joinways account yourself, in the web app or, if you use it, in the Joinways mobile app (Android and iPhone). Joinways is published by Joinways SAS.
- In the mobile app: Menu › Profile › Delete my account, then enter the 6-digit code sent to the account's email address.
- On the web: Settings › Security › Delete my account, then enter the 6-digit code sent to the account's email address.
- Without access to your account: Write to privacy@joinways.app from the account's email address. We delete the account within 30 days.
What Is Deleted
- Your account, your profile and your access to all your workspaces, immediately and permanently.
- The workspaces you own, with all their data (inquiries, events, proposals, contacts, files), for all their members. Their active subscriptions are canceled.
- Your phones' notification tokens.
What Is Kept
- Issued invoices: 10 years (legal obligation).
- Connection logs: 1 year at most, then erased.