Privacy policy
1. Who we are
Compliance Monitoring by J23 ("the system") is provided by J23 ("we", "us"). This policy explains what personal data we handle when you visit this website, request a demo, buy a subscription or use the system, and the choices and rights you have. You can reach us at any time through the contact form.
2. Two roles: website and your organisation's data
For this website, demos, accounts and billing, J23 decides how the data is used (we are the "controller").
For the records your organisation keeps in the system — incidents, inspections, training, people, photos and files ("Customer Data") — your organisation is the controller and J23 handles that data only on its instructions to run the service (we are the "processor"). Your organisation's own privacy notice, published inside the system, explains how it uses that data; questions about it go to your organisation first.
3. What we collect
- Contact and demo requests: name, company, e-mail, phone, country and your message.
- Questions to the website assistant: the questions you type, so that a person can follow up.
- Subscriptions: organisation name, billing contact, plan and invoices. Card and wallet payments are handled by the payment provider — we never see or store full card numbers.
- Accounts in the system: name, user name, e-mail, role, sign-in times, security events and device notification tokens (for live notifications on phones).
- Technical data: the network address and browser type in server logs, kept for security and to stop abuse.
4. No tracking
This website uses no advertising or tracking cookies and no third-party analytics. The system itself uses one essential sign-in cookie (or a sign-in token in the phone app) so that you stay signed in.
5. Why we use it
- To answer you, run demos and provide the subscribed service.
- To bill, keep accounts and meet legal and tax obligations.
- To keep the service secure — sign-in protection, abuse prevention, backups and audit trails.
- To improve the system using overall usage figures, never by selling or renting your data.
The legal bases are: taking steps at your request or performing our contract, our legitimate interest in running and securing the service, legal obligations, and your consent where it is required (you can withdraw it at any time).
6. Who helps us
We use carefully chosen service providers, each bound by contract to protect the data and use it only for us:
- Cloud hosting and database (Render) and network protection and file storage (Cloudflare).
- Payments (Stripe and PayPal), when you pay online.
- E-mail delivery, for messages the system sends.
- Phone notifications (Google Firebase Cloud Messaging) — only a device token and the notification text.
- AI features — only when your organisation switches them on and chooses the AI provider; then the text or photo you ask about is sent to that provider.
We do not sell personal data. We disclose it to authorities only when the law requires it.
7. Where the data is kept
Our providers may store or process data in other countries. When data leaves the country where it was collected, we rely on the safeguards that country's law requires — for example adequacy decisions or standard contractual clauses. An organisation can also keep its data on its own computers or in its own database.
8. How long we keep it
Website enquiries: up to 2 years after the last contact. Billing records: as long as tax law requires. Customer Data: for the subscription, then it is returned or deleted at the organisation's request (backups are overwritten in their normal cycle). Each organisation can set its own retention rules inside the system.
9. How we protect it
Encrypted connections (HTTPS), two-step sign-in, encrypted backups, each organisation kept apart from the others, role-based access, a full audit trail and regular updates. No system is perfectly secure, but we act quickly and inform the people affected and the authorities as the law requires if a breach happens.
10. Your rights
Depending on where you live (for example under the EU and UK GDPR, the UAE PDPL, Saudi Arabia's PDPL, the Philippine Data Privacy Act, California's CCPA/CPRA and similar laws), you can ask to access, correct, delete or receive a copy of your data, object to or restrict its use and withdraw consent. Contact us through the contact form; for data your organisation keeps in the system, contact your organisation. You may also complain to your data protection authority.
11. Children
The website and the system are for organisations and are not directed at children under 16.
12. Changes
We may update this policy; the date below shows the latest version. Important changes are announced on this website or inside the system.