Privacy policy

1. Who is responsible for your data

The data controller is Souleymane Bah, sole trader and publisher of Jalona, established in Conakry (Guinea). Jalona is aimed in particular at people in the European Union: the General Data Protection Regulation (GDPR) applies to this processing, in addition to Guinean personal data protection law.

For any question or to exercise your rights: contact@jalona.io. Jalona has not appointed a data protection officer; this address is read by the person responsible.

When a company uses Jalona for its teams, it decides how the company's workspaces are used: for that data the company is the controller and Jalona acts as its processor.

2. The data we process

We only collect what the service needs:

• Account: email address, username, password (stored only as a bcrypt hash), language, plan. With Google sign-in: your Google identifier, display name and profile picture address. With SSO: the email and name sent by your company's identity provider.
• Security: two-factor secret (encrypted) and backup codes (hashed), sign-in sessions, IP address and browser linked to sessions and sign-in attempts.
• Content: workspaces, tasks, subtasks, due dates, reminders, categories, comments and mentions, attachments, files imported from other tools, emails you forward to your task creation address.
• Collaboration: email addresses of the people you invite, roles, activity history of company workspaces.
• Company: name, logo, website, number of seats, contract, testimonials and, with your consent, display of your logo on our website.
• Billing: customer identifier and subscription status at Stripe. Card details are processed by Stripe alone.
• Devices: the mobile app's notification token, if you allow notifications.
• Messages: what you send us through the contact form, an Enterprise request or by email.
• Technical: server logs.

Jalona shows no advertising, never sells or rents your data, does no profiling and does not measure its visitors' audience.

3. Why, and on what legal basis

• Providing the service (account, workspaces, tasks, notifications, sync, service emails): performance of the contract.
• Collecting subscriptions and keeping accounts: performance of the contract and legal obligation.
• Securing the service (sign-in attempt limits, abuse detection, logs, backups): legitimate interest in protecting accounts and the service.
• Rejecting compromised passwords: legitimate interest. Only the first 5 characters of a hash of your password are sent to the Have I Been Pwned service; the password itself never leaves our servers.
• Answering your requests (support, contact, Enterprise request): pre-contractual steps or legitimate interest.
• Showing a company's logo or testimonial on our website: consent, which can be withdrawn at any time from the company settings or by email.

4. Who can access your data

Inside Jalona, members of a shared workspace see its content according to their role; a company's owner and administrators see the company's members and activity.

We use the following providers, bound by confidentiality and security commitments:

• OVH SAS (France): hosting of servers, database, files and backups, in the European Union.
• Mailgun Technologies (United States, European sending region): sending emails and receiving forwarded emails.
• Stripe (Ireland and United States): payment and billing.
• Google: only if you choose Google sign-in.
• Expo (United States), Apple and Google: delivering notifications to the mobile app.
• Have I Been Pwned: anonymous check for compromised passwords.
• your company's identity provider, if it enabled SSO, and the addresses to which it configured webhooks or uses the API.

Your data may also be disclosed to authorities where the law requires it.

5. Transfers outside the European Union

Your data is hosted in the European Union. As the publisher is established in Guinea, the service is administered from Guinea: such access is limited to what is needed for operation, security and support. Some providers are based in the United States or may access data from there; these transfers rely on the EU-US Data Privacy Framework adequacy decision where the provider is certified, or otherwise on the European Commission's standard contractual clauses.

6. How long we keep it

• Account and content: as long as the account exists. When the account is deleted, identification data is erased immediately; content left in shared workspaces stays with the team, no longer linked to your identity.
• Backups: daily copies kept 14 days and weekly copies kept 8 weeks, then overwritten.
• Sessions: 15 minutes for the short session, at most 30 days for the renewable session.
• Sign-in attempts: 30 days.
• Invitations: they expire after 7 days without an answer.
• Webhook delivery history: 30 days.
• Billing data: 10 years, the legal retention period for accounting records.
• Contact and Enterprise requests: up to 3 years after the last exchange.

7. Security

Encrypted connections (HTTPS), passwords hashed with bcrypt, two-factor authentication available to everyone and mandatory for Jalona administration, encrypted two-factor and SSO secrets, API keys stored as hashes, sessions in cookies that JavaScript cannot read and that can be revoked, sign-in attempt limits, daily backups.

If a data breach puts your rights at risk, we notify the competent supervisory authority within 72 hours and inform you where the law requires it.

8. Cookies and local storage

Jalona only uses strictly necessary trackers, which do not require consent:

• a session cookie (15 minutes) and a session renewal cookie (30 days), used only for authentication and unreadable by JavaScript;
• in the browser's local storage: your chosen language and a signed-in flag.

No advertising or audience measurement cookies. Fonts are served by jalona.io, without calling any third-party service.

9. Your rights

You have the following rights over your data:

• Access and rectification: most of your information can be viewed and changed in your settings; for the rest, write to us.
• Erasure: the "Delete my account" button in your settings, or on request.
• Portability: export of your tasks from the app with the Premium plan, or free of charge on request whatever your plan.
• Objection and restriction for processing based on legitimate interest, and withdrawal of consent at any time.
• Instructions on what happens to your data after your death.

Write to contact@jalona.io from your account's address. We reply within one month, extendable by two months for a complex request, and may ask you to prove your identity if in doubt.

If you believe your rights are not respected, you can lodge a complaint with the data protection authority of your country of residence, for example the CNIL in France (cnil.fr).

10. Children

Jalona is intended for people aged 15 or over. If you think a younger child has given us data, write to us so we can delete it.

11. Changes

This policy may change as the service evolves. The update date is shown at the top of the page; any significant change is announced by email or in the app before it applies.