Privacy policy
Last updated 27 September 2026. This policy covers the website jourier.dev, the sign-in and registration service at hub.jourier.dev, the onboarding workspace at app.jourier.dev, every customer workspace at an address ending in jourier.dev, the Atlas company register at atlas.jourier.dev, and the AI API at api.jourier.dev.
Who is responsible
Jourier Oy, business ID 3620860-4, Helsinki, Finland. Contact: aleksi.stenberg@jourier.com.
For the data in your own workspace, your company is the controller and Jourier is the processor acting on its instructions. The data processing agreement between us governs that data. For everything else in this policy, Jourier is the controller.
What we collect and why
Your account
When you sign in with a Microsoft or Google work account we receive your name, your e-mail address, the identifier your provider uses for you, and the organisation you belong to. If you sign in with your e-mail address instead, we send you a one-time code and you choose a password; the password is stored only as a salted hash, on our own servers in Finland. We use this to sign you in, to place you in the right workspace, and to tell your workspace administrators who has access.
Legal basis: performance of the contract with your company.
Registration
When a company registers we ask for the company name, business ID, company size, your role, the systems you use, what you hope to solve, and how you heard of us. At activation we collect invoicing details: legal name, VAT number, billing e-mail, e-invoice address and operator, postal address, and a reference. Marketing consent is asked separately and is optional.
While you fill in the registration we keep a draft under a random cookie so you can continue later. Drafts that are never completed are deleted after 90 days.
Outside opening hours you can leave your e-mail address to receive a sign-up link. We keep the address, and the module you came for, until the link is sent when the platform opens.
Legal basis: steps prior to a contract, and the contract itself. Marketing: your consent, which you can withdraw at any time.
Technical records
At sign-in and during registration we record the time, your IP address and your browser identifier. We also record which registration steps you completed and how long each took. We use these to keep accounts secure, to block abuse, and to see where the registration flow fails. The sign-in trail is kept for 180 days.
Legal basis: our legitimate interest in the security and improvement of the service.
Your workspace data
Your workspace reads data from the systems your company connects, such as an accounting system or a CRM, using credentials your company provides. That data includes personal data about your company's employees, customers and suppliers. It is stored in a database used only by your company, hosted in Helsinki. The credentials are stored in a vault that only your workspace can read.
Your company decides what is connected, who may see it, and when it is deleted. Jourier staff open a workspace only to operate and support the service, after a fresh multi-factor sign-in, and every such action is logged.
Legal basis: your company's instructions under the data processing agreement.
AI features
The workspace assistant and the research features send your question, and the workspace data needed to answer it, to an AI model provider under our data processing agreement, which returns the answer. No provider may use your data to train models, and we do not use your data to train models ourselves.
The AI API at api.jourier.dev runs on our own GPU servers in Finland. Prompts and responses pass through memory only and are never stored. We record the key used, the time, token counts, response time and status, to enforce limits and to invoice.
Legal basis: the contract.
Atlas
Atlas is a register of Finnish companies built from public sources: the Finnish Trade Register, company websites, public procurement notices, news, and public company pages on LinkedIn. It includes the names and roles of people that a company itself presents publicly, such as board members and management. We process this so that our customers can research companies, understand their market, and monitor competitors, customers and suppliers.
If you are named in Atlas and want your details corrected or removed, write to aleksi.stenberg@jourier.com. We answer within a month.
Legal basis: our legitimate interest, and that of our customers, in information about companies that is already public.
Your own front end
If your company connects a GitHub repository to run its own interface, we receive the repository name, branch, commit history and the installation details from GitHub, and we write the interface into that repository. GitHub's own terms apply to the repository.
Support
When you write to us we keep the message and our reply for as long as needed to resolve the matter and to show what was agreed.
Cookies
jourier.dev sets no cookies and uses no analytics or advertising trackers.
hub.jourier.dev and the workspaces set only the cookies the service needs to work. All of them are first-party, marked HttpOnly and Secure, and are not shared with anyone:
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session | Keeps you signed in | 8 hours |
| Sign-in state | Protects the sign-in redirect | 10 minutes |
| Step-up | Records a fresh multi-factor sign-in for administrative actions | 10 minutes to 1 hour |
| Registration draft | Lets you continue a registration later | 90 days |
| Connection flow | Protects the flow when you connect an integration | minutes |
Because none of these cookies track you across sites, we do not show a cookie banner.
Where your data is processed
Everything runs in Finland, on servers in Helsinki:
- Your workspace: its database, files and secrets, on our own servers in a Helsinki data centre.
- Backups: taken nightly, with a copy kept off the platform in a second data centre in Helsinki.
- The AI API: our own GPU servers in Helsinki. Prompts and responses are never stored.
- E-mail sign-in: our own identity service, on the same servers in Helsinki.
If you sign in with Microsoft or Google, that provider handles the sign-in itself, under its own terms.
The service providers we use, and the contractual basis for each, are listed in the data processing agreement and are available on request.
How long we keep data
| Data | Kept |
|---|---|
| Your account and workspace data | For as long as the workspace exists |
| Registration drafts never completed | 90 days |
| Sign-up link requests | 30 days after the link is sent; 14 days if it cannot be sent |
| Sign-in and security trail | 180 days |
| Invoicing details | As long as accounting law requires, at least six years after the financial year |
| Deletion receipt | Permanently, containing counts only, no names or addresses |
A workspace is deleted on your company's request or when a trial ends without activation. Deletion is done in stages: the workspace is first archived, which is reversible; a deletion order then waits 24 hours and can be cancelled; after that the database, the files, the secrets and the accounts that belong to no other workspace are destroyed and cannot be recovered. Details are on the security page.
Your rights
You can ask us what personal data we hold about you, have it corrected or deleted, restrict or object to its processing, and receive a copy in a machine-readable form. Where processing is based on consent you can withdraw it at any time. Write to aleksi.stenberg@jourier.com; we answer within a month.
If the data is in your company's workspace, your company decides on the request and we help it comply.
You can also complain to the Finnish Data Protection Ombudsman, Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, tietosuoja.fi.
Security
How the platform is built, isolated, backed up and deleted is described on the security page. If you find a vulnerability, write to aleksi.stenberg@jourier.com with "security" in the subject line.
Changes
We update this policy when the service or our providers change. The date at the top tells you which version you are reading. For material changes we notify workspace administrators by e-mail before the change takes effect.