Privacy notice
Last changed 6 October 2026.
How JustAppSec Limited ("we", "us") uses personal data on the JustAppSec website and service (the Service). A Business account means a Business or Business Plus account.
1. Who we are, contact and complaints
JustAppSec Limited is registered in England and Wales, company number 16602827, at 4th Floor, 14 Museum Place, City Centre, Cardiff, CF10 3BH, and with the ICO (ico.org.uk) under reference ZC068280. Contact us about privacy at [email protected] or through our contact form.
If you think we have got something wrong with your personal data, complain to us the same way. We acknowledge a complaint within 30 days of receiving it, look into it, and tell you the outcome. You can also complain to the ICO or, in the European Union, to your local supervisory authority.
2. Who controls your data
We are the controller of your personal data, except your assessment and team records on a Business account. The organisation that holds that account controls those, and we process them for it under our data processing agreement. This notice calls that organisation your employer, whether it employs you or engages you. Your role, seat and group on that account come from your employer, and so do your name and work email address where it invites you or connects an identity provider or directory. Your employer is responsible for telling you about that.
3. What we collect, why and for how long
| What | Source | Purpose and lawful basis | How long |
|---|---|---|---|
| Account: email address, name, sign-in records | You, or your employer | To provide your account: contract | While the account exists |
| Training: challenges, findings, scores, hints, and your requests to the AI help | You | To provide the training, including aggregate figures that compare your results with other reviewers: contract. To create anonymised statistics about how the Service is used: legitimate interest | While the account exists |
| Business account records: role, seat, group, assessments, results, and a log of what was done on the account | Your employer, its directory, and you | For your employer, on its lawful basis | As your employer instructs while the account exists, then as section 9 says |
| Payment: billing contact, address, VAT number, purchases. Card details go to Stripe, not to us | The buyer, through Stripe | To take payment under our contract with your organisation: legitimate interest. Tax records: legal obligation | Six years after the contract ends |
| Messages and reports you send us, and a question about an answer key that the AI help passes to us | You | To reply and act on them: legitimate interest | While the matter lasts. Correspondence with a customer, six years after the contract ends |
| Waitlist: work email address, company name | You | One email when the paid product opens: consent | Until you leave the list, and twelve months at most |
| Product events, such as a demo started, sometimes with your account identifier | Our own records | To run and improve the Service: legitimate interest | Twelve months |
| Technical data: your IP address and request details | Your browser | To run, secure and improve the Service: legitimate interest | Logs and error records, for a fixed period set on each store, long enough to investigate a fault or an attack. Records we use against abuse, up to two days |
| Addresses we must not email | Our email provider, or you | To stop emailing them: legitimate interest | After a bounce, twenty four months. After a complaint or unsubscribe, while needed |
You need an email address to hold an account, and billing details to buy a plan. The waitlist email is marketing, sent with your consent. Product and account notices are not marketing.
4. What your employer can see
On a Business account, what colleagues see about you depends on their role and on the visibility level your organisation sets. Aggregate figures are shown only for groups large enough to protect the people in them. Administrators and auditors can also see the account's log.
Your own training is not reported to your employer. Only work under an assessment assigned to you appears in its reports.
If you are the employer, you are responsible for telling your staff about this processing. This notice and the data processing agreement say what we hold for you and why.
5. AI and automated decisions
We use AI tools to run the business. Microsoft Copilot, Anthropic and OpenAI work on our business mail and on messages you send us. We do not send them assessment records.
With a seat on a paid team, you can use AI help on training challenges. It runs through Vercel's AI Gateway, which passes each request to Anthropic. It receives the code under review and what you selected and wrote.
We make no decision about you by solely automated means that has a legal or similarly significant effect. Any decision your employer makes using a result is its own.
6. Cookies and measurement
These cookies are needed to provide the site: sign-in cookies set by Clerk, our sign-in provider; security cookies set by Cloudflare, against bots and attacks; and short-lived cookies of our own that carry a team invitation through sign-in.
Vercel, our hosting provider, counts page views and measures page speed with two scripts served from our own address. They set no cookie and are not designed to identify you. We use the figures only to improve the site, under the statistical purposes exception in the Privacy and Electronic Communications Regulations. You can turn this measurement off below, which sets a cookie of our own to remember the choice, and it stays off in a browser that sends the Global Privacy Control signal. There are no advertising cookies.
7. Who we share it with
These providers process personal data for us under contract. The data processing agreement lists those that process a Business account's records and says how the organisation is told of a change to that list.
| Provider and contracting company | What it does for us | Where it processes | Data processing terms |
|---|---|---|---|
| VercelVercel Inc. | Application hosting, and the AI Gateway the in-product AI help runs through. It also counts page views and measures page speed. | The application runs in London. Static assets are served from its global network. | Vercel data processing addendumVercel Data Privacy Framework statement |
| NeonDatabricks, Inc. | The database, run by Neon, a Databricks company. It holds account and organisation records. | London, United Kingdom. | Databricks data processing addendumDatabricks privacy notice, international transfers |
| ClerkClerk, Inc. | Authentication and session management. | Wherever Clerk or its subprocessors have facilities, including the United States, under the UK extension to the EU-US Data Privacy Framework or, failing that, the UK addendum to the EU standard contractual clauses. | Clerk data processing agreementClerk Data Privacy Framework notice |
| StripeStripe Payments Europe, Limited | Checkout, subscriptions, invoices and the billing portal. Card details go to Stripe, not to us. | The United States, and other countries where its affiliates and subprocessors operate, under the UK extension to the EU-US Data Privacy Framework or the UK addendum to the EU standard contractual clauses. | Stripe data processing agreementStripe Data Privacy Framework policy |
| CloudflareCloudflare, Inc. | Domain name service, the network in front of the application, bot protection on our forms, and storage for our database backups and error records. | Its global network, with metadata processed in the United States and Europe, under the UK addendum to the EU standard contractual clauses. | Cloudflare customer data processing addendumCloudflare GDPR and Data Privacy Framework page |
| GitHub | Our source code and build pipelines, which also run our database backups. | The United States or any other country where GitHub or its subprocessors operate, under the UK extension to the EU-US Data Privacy Framework and the UK addendum to the EU standard contractual clauses. | GitHub Data Protection Agreement |
| Microsoft | Microsoft 365, which we run the company on, including Copilot, which works on our business mail and files. It holds our business mail and files, and the messages you send us. | The United States or any other country where Microsoft or its subprocessors operate, under the UK addendum to the EU standard contractual clauses and the UK extension to the EU-US Data Privacy Framework. | Microsoft Products and Services Data Protection AddendumMicrosoft privacy statement, storage and processing of personal data |
| AnthropicAnthropic Ireland, Limited | Drafting, review and analysis in the course of running the business, through Claude. It sees our business mail and support correspondence. We do not send it assessment records. It also answers the in-product AI help, through Vercel's AI Gateway. | The United States, under the UK addendum to the EU standard contractual clauses. | Anthropic data processing addendum |
| OpenAIOpenAI OpCo, LLC | Drafting, review and analysis in the course of running the business. It sees our business mail and support correspondence. We do not send it assessment records. | The United States, under the UK addendum to the EU standard contractual clauses. | OpenAI data processing addendum |
| Amazon Web ServicesAmazon Web Services EMEA SARL, with Amazon Web Services, Inc. | Email through Simple Email Service, and the bounce and complaint feedback behind our suppression list. | London (eu-west-2). AWS does not move the data out of that region except to provide the service or comply with the law, and any transfer is under the UK addendum to the EU standard contractual clauses. | AWS service terms, including the data processing addendumAWS Data Privacy Framework page |
Microsoft, Anthropic and OpenAI process under their business terms, which exclude training on the data.
We also share personal data with our professional advisers and insurers where we need to, where the law requires it, and with a buyer or prospective buyer of all or part of the business.
8. International transfers
Some providers process personal data outside the United Kingdom. For each one, the table says where it processes and the basis for the transfer, or links the provider's terms that state them: the UK's adequacy regulations for that country, the UK addendum to the EU standard contractual clauses, or the UK extension to the EU-US Data Privacy Framework. Sending data from the European Union to us needs no further safeguard: the European Commission has found the United Kingdom's protection adequate.
9. When an account ends
You can delete your account in your settings, and your training data is deleted with it. Assessment results you hold on an employer's account stay in its records with your identifier replaced by a placeholder, which is still personal data your employer controls. If you leave a team but keep your account, your results stay in its records.
When a Business account ends, its records can be read and exported for 90 days. We then delete them, unless your employer set an archive of up to seven years, in which case we delete them when it ends. We may keep them longer where the law or legal process requires it.
We keep our contract with a customer, invoices and accounting records, and correspondence for six years after the contract ends, for tax and in case of legal claims, and a count of what we delivered to each customer, with no person named. Deleted data leaves our backups within 30 days.
10. Your rights
Under the UK GDPR, and the EU GDPR where it applies, you may ask to see, correct or delete your personal data, to restrict how we use it, and to take a copy elsewhere.
You may object at any time to our use of your personal data for direct marketing, or to a use we base on our legitimate interests.
Where we rely on consent, you may withdraw it at any time. Write to [email protected]. Requests and complaints about assessment records on an employer's account go to your employer, and we pass on any we receive.
11. Security, children and changes
Our responsible disclosure policy says how to report a weakness.
Accounts are for people aged 18 or over. We may close one we believe belongs to someone younger.
We may update this notice. The date at the top shows when it last changed.
JustAppSec® is a registered trade mark of JustAppSec Limited, UK trade mark number UK00004239907. JustAppSec Limited is registered in England and Wales, Company No. 16602827. VAT registration number GB 519 8772 42. ICO registration ZC068280. Registered office: 4th Floor, 14 Museum Place, City Centre, Cardiff, CF10 3BH.