Privacy

Babylon Optima B.V. is the controller for Jappoe, Aelbrechtskolk 45B, 3025 HB Rotterdam, Chamber of Commerce 91102421, VAT NL865552174B01. For privacy questions, write to hello@jappoe.com.

For organisers we process account data such as email address, name, language and session data. Participants can enter through a shared link without a regular account; we then keep a limited participant session and the data they provide for that trip. We also process trip data, preferences and consent records, programme items, expenses, email delivery data, Cloudflare Turnstile security signals, technical logs and, only after consent, Google Analytics events. Automatically generated summaries are derived from the submitted trip preferences.

Some categories qualify as special personal data under GDPR article 9: dietary restrictions, mobility needs, medical notes, alcohol preferences, and photo participation. We only process these when you explicitly opt in through your privacy settings. Sensitive fields are stored encrypted at rest with key separation. You can withdraw consent at any time from your settings, and historical data tagged to that category is removed within thirty days.

We rely on consent (GDPR art. 6.1.a and art. 9.2.a) for special category data and Google Analytics, performance of a contract (art. 6.1.b) for organising a trip, and legitimate interests (art. 6.1.f) for necessary security, fraud prevention and limited technical logs.

The primary database and storage are configured with Supabase in the EU. Cloudflare processes traffic through a global network; we only claim EU-only processing when the Data Localization Suite and production configuration demonstrably enforce it. Resend can send email from Ireland, but stores account data and logs in the United States according to its documentation.

We use Supabase for database, authentication and storage, Cloudflare for hosting, network security and Turnstile, Resend for transactional email, Anthropic for automatically generated summaries, and Google Analytics for consent-controlled usage measurement. Anthropic processes commercial API data as a processor and does not use it for model training. Current locations and purposes are listed on the sub-processors page.

Trip data is retained for 24 months after the trip end date, and you can delete it earlier at any time. Audit log entries are kept for 24 months. Account data is kept while your account is active and removed within thirty days after you delete the account. Sensitive personal data is removed within thirty days after you withdraw the relevant consent. Anonymised aggregates may be retained longer for product metrics.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. You also have the right to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. To exercise these rights, write to hello@jappoe.com. We respond within thirty days. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Jappoe is not directed at children under sixteen. We do not knowingly collect personal data from minors without parental consent. If you believe a minor has provided data without that consent, contact us and we will remove it.

Resend, Anthropic, Google Analytics and potentially Cloudflare can process data outside the EU/EEA. Where required, we use the transfer mechanisms in their processing terms, including Standard Contractual Clauses, together with data minimisation and contractual restrictions.

We use a small set of strictly necessary cookies to keep you signed in and to remember your language and currency preferences. We do not set advertising cookies. Usage statistics are measured with Google Analytics, and only after you explicitly agree through the cookie banner. You can change your choice at any time via the Cookie preferences button at the bottom of the page.

We may update this notice. Material changes will be announced through the app and via email to active accounts at least thirty days before they take effect. The version label at the top of this page shows when the current text became effective.

You can export your data from your account settings, and you can delete your account from the same place. For anything that needs human review, write to hello@jappoe.com.

Babylon Optima B.V., Aelbrechtskolk 45B, 3025 HB Rotterdam, Chamber of Commerce 91102421, VAT NL865552174B01. For formal privacy questions: hello@jappoe.com.