Privacy Policy

1. What data we process

Depending on how you use the platform, we process:

• Account data: your email, your display name, your password in encrypted form, and the language you use the app in. If you sign in with Google or Apple, the identifier that provider returns to us.
• Platform activity: the activities you book, save or review, and the ones you publish if you organise.
• Payment data: the amount, the currency, the status of the transaction and the identifier the processor returns. Your full card details never pass through our systems and we do not store them.
• Location: the coordinates the app uses to search for activities nearby, used to answer that search. If you check in to a class from your phone, we store how far from the venue you were at that moment.
• Attendance and plans: whether you attended the classes you booked and, if you are a member of a plan, the plan’s status, your dues, your payments and anything you owe.
• Refunds handled by an organiser: what they owe you, your notices that you got no answer, whether you confirmed receiving it, and the rating and comment you leave on how they handled it.
• Your age statement: that you are 18 or older, or between 16 and 18 with permission, and when you made it.
• Communications: the messages you send us and the record of the notifications we send you.
• Technical data: device information and usage and error logs, needed to run the service and detect faults.
• Content you upload: photos, video and text for your activities or your profile.
• Requests to conversation mode: if you organise and use it, the text of what you ask for, already stripped of the personal data that is detected (section 11), and what was done with each request.

2. What we use it for, and on what legal basis

To provide the service: create and maintain your account, show you activities, process your bookings and payments, and apply cancellation policies. Legal basis: performance of the contract between you and us.

For conversation mode: understanding what you ask for, putting together the proposal, carrying out what you confirm and enforcing its Usage Policy. Legal basis: performance of the contract and, to prevent abuse, our legitimate interest in running a safe service.

To tell you what affects you: confirmations, reminders, changes and cancellations for the activities you booked. Legal basis: performance of the contract.

To meet legal obligations: keeping accounting and tax records, and responding to requests from competent authorities. Legal basis: compliance with a legal obligation.

To keep the platform safe and usable: preventing fraud and abuse, moderating reported content, diagnosing errors and improving the product from usage data. Legal basis: our legitimate interest in running a safe, working service, weighed against your rights.

For marketing communications, if we ever send any: only with your consent, which you can withdraw at any time without affecting anything done before.

3. Who we share it with

With the organiser of the activity you book, so they can receive you and manage their capacity: they see your display name, your bookings with them and your attendance, including how far from the venue you were if you checked in from your phone. If you are a member of one of their plans, they also see the plan’s status, your dues, your payments and anything you owe. If they owe you a refund, they see your email while it is pending, your notices, whether you confirmed receiving it, and your rating and comment on how they handled it. They do not receive your password or your card details.

With anyone who uses JOUNA: the reviews you leave on a class are shown with your display name.

With your phone’s map service (Google on Android, Apple on iOS), when you open the map with the address of a place already typed: your phone looks it up with that service, which receives the address and, if it names no city, the location of your venue or work area.

With providers who process data on our behalf and under contract, solely to provide their service to us. The list of providers, with each one’s country, role and the data it receives, is at www.jouna.app/ar/en/providers. They are:

• Mercado Pago, to process payments.
• Google and Apple, if you sign in with an account from either, to confirm your identity.
• Cloudflare, to store uploaded images and video.
• The email provider that delivers our email notifications.
• Expo, which delivers push alerts to your phone’s notification service (Apple or Google).
• Fly.io, where the application runs, and the provider that hosts the database.
• Sentry, the error diagnostics service.
• Language-model providers, which process requests to conversation mode. Only their paid services are used, and those do not use the data to train models. Each one is named on the list of providers.

4. International transfers

The application and its database are hosted on servers in São Paulo, Brazil.

Some of those providers are outside the European Economic Area and outside Argentina. Where that involves transferring data, we rely on the safeguards the applicable rules provide: adequacy decisions where they exist, or standard contractual clauses.

Language-model providers process requests to conversation mode in the United States and, in Google’s case, also in other countries where it has data centres. Those transfers rely on the safeguards in this section: each provider’s data processing agreement, with standard contractual clauses.

If a language-model provider detects that a request breaches its usage policies, it may keep it longer than usual to review it: Anthropic, for up to 2 years. Each one’s period is on the list of providers.

You can ask us for a copy of the safeguards that apply.

5. How long we keep it

Account data, for as long as the account exists.

Booking and payment records, for the period accounting and tax rules require, even if you close your account.

Technical and error logs, for short periods — as long as needed to diagnose faults.

Notifications you have read, 12 months. App usage data, 13 months. Messages you send us through the contact form, 12 months. Invitations to an organisation or a class, 90 days after they are accepted, declined, revoked or expire.

The text of requests to conversation mode, 30 days. The record of each request without its text (when it was made, what action it asked for and how it ended), 13 months.

After those periods, data is deleted or anonymised so that it can no longer be attributed to you.

6. Your rights

You can ask us to access your data, correct it, erase it, restrict its processing, object to it, and receive it in a portable format. Where processing is based on your consent, you can withdraw that consent at any time.

To exercise them, write to hola@jouna.app. We respond within the deadlines the applicable rules set.

If you think we handled your request badly, you can complain to the supervisory authority in your country: in Spain, the Agencia Española de Protección de Datos; in Argentina, the Agencia de Acceso a la Información Pública.

You can exercise the right of access free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner, under article 14(3) of Law 25,326.

The Agencia de Acceso a la Información Pública, as the supervisory authority under Law 25,326, has the power to deal with complaints and claims from anyone whose rights are affected by a breach of the rules in force on personal data protection.

7. What happens when you delete your account

You can delete it from the app, in Profile. Before you confirm, the app shows what happens to your bookings, plans and credit. If you no longer have the app installed, write to hola@jouna.app from your account’s email.

Deleting it removes your notifications, the activities you saved, your sign-in details, the registration that lets us send alerts to your phone, and the invitations sent to your email.

Your bookings for classes that have not started are cancelled under each class’s cancellation policy, as if you cancelled them yourself. Your plans end at the end of the current month. Any credit you have with an organiser is lost. Refunds an organiser still owes you remain their responsibility, but you can no longer follow them in the app.

If you are the only person in charge of an organisation, you need to close it first.

Your bookings and reviews are not deleted: they are detached from your account and stop showing your name. Keeping them is what lets an organiser retain the record of what happened in their activities, and keeps their rating from changing because someone closed an account. From that point they can no longer be attributed to you.

Payment records are kept for the legal period, as explained above.

8. Security

Passwords are stored encrypted and never in plain text. Traffic between the app and our servers is encrypted. Internal access to personal data is limited to what running the service requires.

No system is infallible. If a breach affects your data and poses a risk to you, we notify you and we notify the supervisory authority where the rules require it.

9. Children

The service is not intended for anyone under 16, and we do not knowingly collect their data. If we find an account belonging to someone below that age, we close it and delete their data.

If you are a parent or guardian and believe a child in your care gave us their data, write to us and we will sort it out.

10. Automated decisions

We do not make decisions producing legal effects on you based solely on automated processing, and we do not profile you for that purpose.

Conversation mode proposals are put together by an artificial intelligence service, but they decide nothing: they are carried out only if the organiser confirms them.

11. Conversation mode

If you organise, conversation mode lets you ask, in your own words, for what you want to do in your organisation. Proposals are put together by an artificial intelligence service, and the app says so the first time you use it.

Before a request goes to a provider, the personal data that is detected is removed from it: identity documents, tax IDs, phone numbers, emails, bank accounts, cards and health terms, and the names of the organisation’s members and of the people who book. They are replaced with markers, and the app tells you when that happens.

The provider receives the text filtered this way, counts about the organisation (for example, how many classes it has) and the names of its activities, venues, plans and team when the request needs them. It never receives data about members or about people who book, nor data about other organisations.

Providers process that data on our behalf and solely to process the request. Only their paid services are used, and those do not use the data to train models.

JOUNA keeps the text of each request, already filtered, for 30 days, with access limited to those who review compliance with the conversation mode Usage Policy (www.jouna.app/ar/en/usage-policy). Within that period, a person at JOUNA may review the requests the filters flag.

If you are a member or you book a class, conversation mode does not send your data to language-model providers. If an organiser writes your name in a request as it appears on your account, it is replaced with a marker before it leaves.

You have the same rights over this data as in section 6. When you delete your account, the text of your requests is deleted too.

12. Changes to this policy

If we update it, we publish the new version on this page with its number and date. Where a change is material, we tell you and ask you to accept it again inside the app.

13. Contact

For anything about this policy or about your data, write to hola@jouna.app or to [RAZÓN SOCIAL], [DOMICILIO LEGAL].