This notice explains how Jaapi AB (a Swedish company, org. no. 559387-9421) handles personal data about people who visit jaapi.com, book a demo, meet us, or try one of the stores we run to show the service. For all of it, Jaapi is the controller.
If you use a store we host for your employer, a different document applies: the platform privacy policy. There your organization is the controller and Jaapi processes data on its instructions.
Visiting jaapi.com
Hosting. The site is served by Vercel (US), which keeps its edge request logs (your IP address, the page requested and your browser's identification string) under its own retention. Images and fonts come from our content delivery network, fronted by Cloudflare (US), which sees the requesting IP address in transit.
Cookies and analytics. On your first visit a banner asks what you allow. Until you choose, the site sets no cookies. Our tag manager loads Google Analytics and Google Ads in consent mode, which means that before you choose they receive the address of the page and your IP address, but no cookies and no identifier that follows you between visits. If you allow statistics, Google Analytics sets its cookies to measure how the site is used. If you allow marketing, the LinkedIn Insight tag and the Google Ads conversion tag set theirs to measure whether our advertising works. The banner is run by Cookiebot (Usercentrics, Denmark), which keeps a log of your choice for twelve months. You can change your choice at any time under cookie settings or through the banner's "Show details".
Wishlist. The wishlist keeps the products you pick in the page address, so it travels with the link you share. A long list is stored on our servers as a product list under a short code. Neither carries personal data.
Booking a demo
The booking page embeds Calendly (US). Calendly collects your name, email address, the time you choose and anything you write in the note, and places the meeting in our calendar in Google Workspace (EU). We use it to hold the meeting and to follow up.
Sales meetings
We record sales meetings with Fathom (US), which transcribes them and drafts a summary. The recorder joins the call as a visible participant. If you prefer not to be recorded, say so and we stop the recording. The recording, transcript and summary are used to prepare a proposal for your company and are kept while we are in contact with you or your company.
Proposals and follow-up
What we learn about your company and the people we meet there (names, roles, email addresses, what was discussed, the proposal we made) is kept on our sales board, hosted with Hetzner in Germany, and discussed internally in Slack (US) and Google Workspace (EU). A proposal page on proposal.jaapi.com asks for your email address before it opens and records that it was opened, so that we know the proposal reached you.
Demo stores
We run stores of our own to show the service. When you accept a gift or place an order in one of them, your data is handled as the platform privacy policy describes, with one difference: Jaapi is the controller, and our sales team is told so that it can follow up with you.
Legal basis
Non-essential cookies are set only with your consent, which you can withdraw at any time. Everything else in this notice rests on our legitimate interest in presenting and selling the service (GDPR Article 6(1)(f)). You can object to that processing at any time, and we stop unless we have compelling grounds to continue. Once your company becomes a customer, its contract with us applies, as the platform privacy policy describes.
How long we keep information
| Data | Kept |
|---|---|
| Prospect records: contacts, meeting notes, recordings, transcripts, proposals | While we are in contact with you or your company |
| Consent choice | Twelve months, then the banner asks again |
| Website request logs | Under the hosting provider's retention |
| Analytics and advertising data | Under the retention configured with Google and LinkedIn |
Transfers outside the EEA, the UK and Switzerland
Vercel, Cloudflare, Google, LinkedIn, Calendly, Fathom and Slack are in the United States. Each transfer is covered by the European Commission's standard contractual clauses or an adequacy decision; for visitors in the United Kingdom the clauses carry the UK International Data Transfer Addendum, and for visitors in Switzerland the amendments the Swiss commissioner requires. The current provider register, with each one's location and what it holds, is at trust.jaapi.com/vendors.
Your rights
You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to withdraw a consent, and to receive the data you gave us in a portable format. Email lynn@jaapi.store; we answer within one month. You can lodge a complaint with the supervisory authority in the country where you live or work. The authority for Jaapi is Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection, at imy.se.
Contact
Lynn Smeria, our Security Officer, is the data protection contact: lynn@jaapi.store. Jaapi has not appointed a data protection officer, as the conditions of Article 37 GDPR do not apply to us.
Jaapi AB, Swedish organization number 559387-9421, Asplyckevägen 32, 41729 Gothenburg, Sweden.
Updates to this notice
We revise this notice when our practices or the law change. The date at the top shows the latest revision.