Sign in

Privacy Policy

Last updated: October 8, 2026

Who we are and our two roles

Justwon is a business-to-business post-sales platform: customers connect their business systems (such as CRM, email, chat and documents), and our AI agents help their customer-success teams run onboarding, renewal and expansion work. Under the GDPR we have two roles, and your rights depend on which applies:

  • Controller for the data we collect ourselves: account, billing, support, enquiry, website and usage data (Part A).
  • Processor for the content customers connect to or create in Justwon. The customer is the controller and we act only on its instructions, under a Data Processing Agreement (DPA) or, until one is signed, the data-protection terms in the Terms of Use (Part B).

Justwon ApS, registration no. DK46667816, Ekkodalen 13, 3450 Allerød, Denmark. Contact for everything in this policy: legal@justwon.ai

Part A: Data we process as controller

We collect your name, work email, company and role; sign-in data (such as magic link, passkey or single sign-on with Google or Microsoft); billing and subscription details; messages you send us, including demo requests and support requests; usage and device data from the product; and website data as described in our Cookie Policy. Most of it comes from you. Your organization's administrator may also give us your name and email when inviting you, and Google or Microsoft shares your name and email when you sign in with them.

We use it for these purposes:

  • Providing your account and the service, and answering enquiries. Contract (or steps before one), Art. 6(1)(b).
  • Billing and accounting. Contract, Art. 6(1)(b), and legal obligation (bookkeeping and tax), Art. 6(1)(c).
  • Security and abuse prevention. Our legitimate interest in keeping the service and our customers' data safe, Art. 6(1)(f).
  • Improving the product from usage telemetry. Our legitimate interest in understanding how the platform is used, Art. 6(1)(f). We use usage and operational data only, never customer content (see Part B).
  • Marketing emails. Your consent, Art. 6(1)(a), which you can withdraw at any time.

You do not have to give us this data, but without account and contact details we cannot provide the service. We do not deliberately collect special categories of personal data (Art. 9); please do not send us any.

Part B: Data we process on our customers' behalf

Customer content can include personal data about the customer's employees, customers, prospects and other contacts. We process it as a processor, on the customer's documented instructions, under a DPA (or, until one is signed, the data-protection terms in the Terms of Use). The customer, as controller, decides why it is processed, holds the lawful basis and informs the people concerned.

If your data is in a customer's workspace, send access, correction and deletion requests to that customer. If you write to us, we pass your request on and help the customer answer it.

How AI is used. Our AI extracts, organizes, summarizes and assesses the connected content, which may include profiling of business contacts under Art. 4(4), as the customer instructs. The customer sets how far each agent may act alone, and agent activity is logged. We make no solely automated decisions with legal or similarly significant effects on individuals. We do not use customer content to train AI models, ours or our AI provider's.

Recipients

We do not sell personal data. We share it with a small set of service providers (sub-processors) that help us run the platform, under data-processing terms: database hosting, application hosting and file storage, AI inference and dictation, background jobs, caching, and transactional email (Databricks/Neon, Vercel, Google Cloud, Inngest, Upstash and Mailgun). On request at legal@justwon.ai we provide the current register with each provider's role and location, and customers get advance notice of sub-processor changes under the DPA.

We disclose personal data to public authorities only where the law requires: we check each request is valid, disclose no more than required, challenge overbroad requests where reasonably possible and, unless prohibited, tell the affected customer first. If Justwon is sold or merged, the data moves with the business and this policy continues to apply.

Transfers outside the EU

By default, unless a different region has been agreed with the customer in writing, customer data is hosted in the EU: databases and application compute in Frankfurt, file storage and caching in EU regions, and AI processing and dictation in the EU. Our background-job provider is hosted in the United States and receives identifiers, closed values and workspace names, with job data encrypted under a key we hold.

For customer content, personal data leaves the EU only as the customer's DPA instructs. For data we hold as controller, and for support access by our service providers in the United States to data held in the EU, we rely on the EU transfer clauses (Commission Implementing Decision (EU) 2021/914) or the EU-US Data Privacy Framework in each provider's data-processing terms.

How long we keep data

  • Account, billing and enquiry data: for the life of your account or relationship, and afterwards only as long as the law (such as bookkeeping law) requires.
  • Sign-in and security records: 210 days.
  • Customer content (Part B): for as long as the customer's workspace exists, or less if the customer instructs us to erase it. When a subscription ends, Justwon sets a termination date, and the customer can ask for its data back, in a structured, commonly used, machine-readable format, for 30 days from that date. A seven-day grace window follows, in which the customer can cancel the deletion (in Justwon while it has access, and for a suspended workspace by asking Justwon in writing). Then the customer's dedicated database (or, where it has none, its rows in the control database) and its stored objects are destroyed, and on request a written deletion certificate is issued, stating what it does and does not cover. Control audit records are kept up to 210 days, the security incident register is kept five years after closing, and sub-processors' own copies are outside the certificate.

Security

We use a dedicated database per customer for stored workspace content once the workspace is set up, EU hosting by default (above), encryption in transit and at rest at the storage layer, application-layer encryption of integration credentials with per-organization keys, and access authorized on every authenticated call. Justwon does not currently hold ISO/IEC 27001 or SOC 2 certification; both are planned. If a personal data breach affects you or your organization, we will notify affected customers without undue delay, as our contracts and the law require.

Your rights

For Part A data you have the right to access, rectification, erasure, restriction, portability and objection (including to legitimate-interest processing and to direct marketing), under GDPR Arts. 15 to 21. Where we rely on consent you can withdraw it at any time. Write to legal@justwon.ai; we answer within one month. For Part B data, these rights are exercised against the customer that controls it (see Part B).

You can complain to the Danish Data Protection Agency (Datatilsynet) or to your local supervisory authority (list).

California residents have the CCPA/CPRA rights to know, delete and correct personal information and to non-discrimination. Justwon does not sell or share personal information as defined there. Use the same contact.

Changes

We update this policy when needed and revise the "Last updated" date. Material changes affecting customers' data are also notified under the DPA.