Privacy notice
Last changed 21 October 2026.
About us
JustAppSec Limited runs the JustAppSec website and service. We decide how your information is used. If you are on a team account, the organisation that pays for that account decides how your team information is used.
JustAppSec Limited is registered in England and Wales under company number 16602827. Our registered office is 4th Floor, 14 Museum Place, City Centre, Cardiff, CF10 3BH. Our ICO registration is ZC068280.
For privacy questions or complaints, email [email protected]. We acknowledge complaints within 30 days.
Your rights
You can ask to see, correct or delete your information, limit or object to how we use it, or take a copy elsewhere. Where we rely on your consent, you can withdraw it at any time. Email [email protected]. For your team records, ask your organisation. You can also complain to the Information Commissioner's Office (ICO) or, in the European Union, to your local data protection authority.
Information outside the UK
Some providers process personal information outside the UK. The table above shows where. The provider terms it links to set out the safeguard for each transfer: the UK's adequacy regulations, the UK addendum to the EU standard contractual clauses, or the UK extension to the EU-US Data Privacy Framework. Transfers from the EU to us rely on the European Commission's adequacy decision for the UK.
Your account
We use your name and email address to create your account, keep you signed in and send you account emails, such as assessment and billing notifications, under our contract with you. We also record when you accepted the terms. Without an email address, you cannot have an account.
Your organisation can also give us your name and email address when it invites you or connects its sign-in system or user directory.
When you delete your account in Settings, we delete these details and the sign-up record of accepting the terms. Copies may remain in invoices, messages you sent us and team records. Your email address stays on our do-not-email list only if you unsubscribed from invitations, marked one of our emails as spam, or an email we sent you could not be delivered. If you bought a team account, your acceptance of the terms at checkout stays with its invoices.
If your organisation manages your account, you cannot delete it yourself: see Team records.
Payment details
A buyer must give billing details to buy a team account. The buyer gives us the billing contact, address, VAT number and purchase details through Stripe. Stripe handles all card details.
We use billing details to take payments and manage subscriptions, invoices and the billing portal, on the legal basis of legitimate interest. The law requires us to keep them as tax and accounting records. We keep customer contracts, invoices and accounting records for six years after the contract ends, to meet tax law and deal with legal claims.
Training
We use your training records to provide training and show your progress under our contract with you. These records include the challenges you do, your findings, notes and scores, the hints you open and the fixes you choose. We compare your results with anonymised totals from other reviewers.
We also make anonymised statistics from training records about how the service is used, on the legal basis of legitimate interest. We keep the statistics indefinitely.
We delete your training records when you delete your account in Settings.
AI help is part of the training. When you use it, we send the challenge code, the lines you selected and your message to an AI model. We keep the AI's second opinion with your review. If the second opinion agrees with you, it passes your case to us, and we keep your message and the AI's reasons as a report.
Team records
Team records are what a team account holds about its members: invitations, directory details, membership, roles, assessment licences, groups, assigned assessments, your work and results, reports, exports and the log of who did what and when. The organisation that holds the account decides how they are used. We handle them on its instructions under our data processing agreement, and it is responsible for telling you how it uses your information.
Your organisation gives us your role, assessment licence and group. If it connects its user directory (Microsoft Entra, Okta or similar), we also receive your name, organisation email address and groups from it, and keep them while the directory lists you.
An invitation holds your email address, who invited you and the role offered. We keep it while you can accept it and for 90 days after it expires or is cancelled.
Administrators and auditors can see your name, role and assessment results. Your organisation chooses how much they see. Other members cannot see your results.
Deleting your account
If your organisation verified your email domain for single sign-on, or added you through its user directory, it manages your account and you cannot delete it yourself. Ask its administrator. Anyone else can delete their account in Settings.
When you leave a team, your results and the record of your assessment licence stay with it. The team keeps your name as a former member until an administrator erases it or the team's records are deleted. The owner of a team account hands ownership to someone else before leaving.
When you delete your account, a placeholder replaces your name in the team's records, and the team's administrators are emailed.
Your free training is yours, not a team record, and you can erase it yourself. A new account after deletion starts empty, even with the same email address.
After a team account ends
After a team account ends, its records remain available for 90 days, or until the end of an archive the organisation set, which can be up to seven years. We then delete them and keep only an anonymised count of the assessments we delivered. We may keep records longer where the law requires it.
Messages
When you write to us, we keep your name, email address and email message. If you are signed in, we also keep your plan and organisation details. We use these to reply to you using the legal basis of legitimate interest. We keep these details for up to six years, even after you delete your account. To have them deleted sooner, email [email protected].
If you think a review was marked wrongly and you choose to send us a report, that report is kept indefinitely on the legal basis of legitimate interest.
Emails we send you
Our sign-in provider, Clerk, emails you sign-in codes. These are required to access the service.
Security emails (security news, security research and vulnerability updates) are part of the service, under our contract with you. You can toggle these on or off in the settings menus or with a link found in each email. If your organisation manages your sign-in, it can manage security emails on behalf of its members. If it turns them on, we send them on its instructions.
We send marketing emails only with your consent, which is given by ticking the box at sign-up or in the settings menus. Every marketing email has an unsubscribe link, and you can withdraw consent in Settings or by emailing [email protected]. Your organisation cannot consent to marketing emails on your behalf.
We keep a record of your marketing email choices while your account exists. If you ever turned marketing emails on, we keep that record for six years after you delete your account, to show we had your consent, on the legal basis of legitimate interest.
Team account emails (assessments, billing and running the account) are not considered marketing emails, and have no unsubscribe link. Invitations to join a team have an unsubscribe link, unless the inviting organisation has proved it owns your email domain or sent your details from its user directory. Unsubscribing stops invitations from every organisation.
We stop sending to an email address, on the legal basis of legitimate interest, when our email provider tells us you marked one of our emails as spam, or that our emails to it cannot be delivered. We keep spam reports and invitation unsubscribe events until you ask us to remove them. We keep delivery problems while your account exists. Sign-in codes are still sent.
Site records
We keep two kinds of site record on the legal basis of legitimate interest. Logs and error records, which hold your IP address and request details, are kept for up to 90 days, to run the service and investigate faults and attacks. Product events, such as a review being submitted, are kept for twelve months, to improve the service. If you delete your account, your identifier in them is replaced with a placeholder. Backups hold deleted information for up to 30 days. Our providers keep their own records for the periods in their terms.
Automated decisions
We make no decisions about you by computer alone that have legal or similarly significant effects. Your organisation is responsible for any decision it makes from an assessment result.
JustAppSec® is a registered trade mark of JustAppSec Limited, UK trade mark number UK00004239907. JustAppSec Limited is registered in England and Wales, Company No. 16602827. VAT registration number GB 519 8772 42. ICO registration ZC068280. Registered office: 4th Floor, 14 Museum Place, City Centre, Cardiff, CF10 3BH.