Privacy policy

Who decides what happens to your data

When an organization shares a document through Jandshake, that organization decides what to share and with whom, and owns the viewing analytics for its documents. For those analytics we act on the organization's behalf (as a processor). For your own account, billing and our service emails, we decide (as a controller).

We never sell personal data, and we never use one organization's engagement data for another organization. Any future cross-organization benchmarks will be opt-in, aggregated and anonymous.

What we collect

• Account details: your name, email address, the organizations you belong to and your role in them.
• Documents you upload, and what we derive from them to show and measure them: page images, extracted text, page sections and versions. When AI features are on, also a search index of the text (see below).
• Viewing analytics for shared documents: which pages were viewed, for how long, and when; your browser's identification string (its name, version and device type); and your email address only if the link asks for it.
• Your IP address, never in readable form: we keep a keyed one-way hash of it, and a device code derived from that hash and your browser string, to count unique viewers and spot abuse. These are still personal data, and we protect them as such.
• Billing details: plan, invoices and payment status. Card numbers go straight to our payment provider; we never see or store them.
• Security and audit records: sign-ins, changes to links and settings, and access to documents.

Viewer choices

• If your browser sends Global Privacy Control or Do Not Track, only anonymous page counts are recorded.
• Signed-in evaluators can turn on privacy mode in settings to the same effect.
• If you gave your email address when viewing a document, you can erase your viewing record at any time from the “Erase my viewing data” page; we send a code to that address to confirm it's yours. Two records are kept: any NDA you accepted, and the security log of access to the document. Views where you didn't give an email address can't be linked to you.

How we use it

• To run the service and provide what our customers signed up for: show documents, measure engagement for the organization that shared them, send the alerts and digests people ask for, and handle payments (contract).
• To keep it safe: prevent abuse, investigate security events and protect accounts (legitimate interests).
• To improve it: we look at aggregate, non-identifying usage to fix problems and plan features (legitimate interests).
• To keep records the law requires, such as invoices (legal obligation).
• Where we ask for your consent, such as optional emails, you can withdraw it at any time.

AI features

Jandshake's AI features (such as deal reviews and section detection) send the relevant document text to our AI providers to produce a result. When AI features are switched on for the service, we also send the text of each processed document to an AI provider once, to build a search index (embeddings) that those features use. We don't use customer documents to train our own models, and we use AI providers under terms for business customers. AI results can be wrong; treat them as a starting point, not advice.

Who helps us run Jandshake

• Fly.io: application hosting (United States).
• Supabase: database (United States).
• Cloudflare: document storage (R2).
• Resend: email delivery (United States).
• Stripe: card payments (United States).
• Mercury: invoices and banking (United States).
• Anthropic and OpenAI: AI features and search indexing, as configured for the service (United States).

Each provider processes data only to provide its service to us. We'll update this list before adding a provider that handles personal data.

Cookies

We use only cookies the service needs, and no advertising or third-party tracking cookies:

• Your sign-in session, and the organization you're working in.
• Your language, theme and time zone, so pages look right.
• For people viewing a shared document: a cookie that keeps that viewing session together, and (if you chose “remember me”) your verified email address for that link.

How long we keep it

• Raw viewing events: 400 days by default. Each organization can choose a shorter or longer period, within the limit of its plan.
• Summaries of viewing sessions: as long as the document exists.
• Documents and accounts: until the organization or person deletes them. Deletion starts with a short grace period, so a mistake can be undone, and then removes the data.
• Backups: kept for a limited time for disaster recovery, then overwritten.

Your rights

Depending on where you live (including under the GDPR, the UK GDPR and California law), you can ask to access, correct, export or delete your personal data, or object to how we use it. Organization admins can export their data and delete their organization in settings. For anything else, email joshua@turnrow.solutions. We'll confirm it's you before acting, usually by email; someone you authorize can also ask for you. If a request is about an organization's analytics, we'll pass it to that organization and help it respond.

We won't treat you differently for using your rights. You can also complain to your local data protection authority.

California residents

We don't sell personal information, and we don't share it for cross-context behavioral advertising. The categories we collect are the ones listed under “What we collect”, from you, your organization and your browser, for the purposes under “How we use it”.

Where your data is

Jandshake runs in the United States. If you use it from elsewhere, your data is transferred to and stored in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses for these transfers.

Children

Jandshake is for business use and isn't meant for anyone under 16.

Changes

If we change this policy in a way that matters, we'll update the date above and tell account holders by email before the change takes effect.

Contact

Questions or requests: joshua@turnrow.solutions.