Privacy Policy
Last updated: 2026-10-22
1. Who we are (data controller)
This website is operated by Just A Dev Company ("we", "us", "our"), an indie AI development studio. For the purposes of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and the UK GDPR, we are the data controller of personal data processed via this website and the services described below.
Establishment: [EU member state — to be confirmed before publication]. Until that placeholder is replaced, the contact email below is the authoritative channel for all privacy matters.
General contact: info@justadev.company
Privacy / data-subject requests: privacy@justadev.company
2. What we collect and why
We process the following categories of personal data. Each row identifies the data, the purpose, the legal basis under GDPR Article 6, and the retention period.
| Data | Purpose | Legal basis / location | Retention |
|---|---|---|---|
| Contact form: name, email, phone (optional), company (optional), message | Respond to your enquiry, prepare a proposal, follow up about the project you described | Art. 6(1)(b) – steps taken at your request prior to entering a contract; Art. 6(1)(f) – our legitimate interest in operating a sales pipeline | 24 months from last contact, then deleted from Firestore; if a client engagement starts, retained for the contractual relationship + 6 years (tax/audit) |
| AI Architect demo: project description, business email, generated analysis | Generate the AI architecture preview and gate access behind a business email so the live Gemini API is not abused | Art. 6(1)(b) – delivery of the service you requested; Art. 6(1)(f) – preventing abuse of our paid API quota | 12 months in Firestore, then deleted |
| FactCheck gate: email, attempted article URL, request mode, browser user-agent, IP address, referer, timestamp | Run the live fact-check, prevent automated abuse of our paid AI APIs, send the operator a notification of new leads, and audit misuse | Art. 6(1)(b) – delivery of the service; Art. 6(1)(f) – preventing abuse and securing our infrastructure | Lead record in Firestore: 12 months. Operator notification email: retained in our mailbox per normal email-retention practice (max 24 months). |
| Google Analytics: pseudonymous cookie ID, page paths, button clicks, form events, truncated IP | Understand which pages and CTAs are useful so we can improve the site | Art. 6(1)(a) – your explicit consent via the cookie banner. Not loaded at all unless you click "Accept". | GA4 default: 14 months from last activity, then auto-deleted |
| Server / hosting logs (Netlify): IP address, request path, timestamp, response code | Security, abuse detection, debugging | Art. 6(1)(f) – legitimate interest in operating a secure service | Per Netlify retention policy (typically 30 days) |
3. Cookies and similar technologies
The Other Tab resource downloads offer a newsletter signup from JustADev. If you choose to subscribe, we save your email, consent time and version, and the resource you requested in our Firebase contacts list. Newsletter signup does not grant analytics consent. You can ask to unsubscribe or delete that record by emailing privacy@justadev.company.
After signup succeeds, justadev_resources_newsletter_session_v1 in sessionStorage remembers that downloads are unlocked for this tab’s session. It stores only an unlock flag, not your email. Resource analytics measure views, previews, link clicks, copying and download starts when you accept analytics; they do not include signup email, copied content or text entered into previews.
We use two categories of storage in your browser:
- Strictly necessary – your FactCheck session token (
factcheck_gate_tokenin sessionStorage, cleared when you close the tab), and your cookie-consent choice itself (justadev_analytics_consentin localStorage). These do not require consent under ePrivacy Article 5(3) because they are strictly necessary to deliver a service you explicitly requested. - Optional analytics – Google Analytics 4. The GA script is not loaded until you click "Accept" on the cookie banner. We configure GA with IP anonymisation,
allow_google_signals: false, and ad-personalisation disabled.
You can change your choice at any time: .
4. Service providers (processors) we share data with
We share data with the following processors strictly for the purposes listed above. Each operates under a Data Processing Agreement and, where data leaves the EEA, EU Standard Contractual Clauses ("SCCs") plus supplementary measures as described in their respective Trust Centers.
| Data | Purpose | Legal basis / location | Retention |
|---|---|---|---|
| Netlify, Inc. | Static hosting + serverless functions (/api/factcheckGate, /api/analyzeProject) | United States · SCCs in place | See Netlify Privacy Policy |
| Google LLC (Firebase Firestore + Analytics) | Lead storage (contacts, simulations, factcheck_leads) and optional analytics | United States · SCCs in place; Google Ads Data Processing Terms | Per our retention table above |
| Google LLC (Gemini API) | Generating the AI Architect specification | United States · per Google AI usage terms | Google does not use API content to train models on the paid tier; see Google AI Studio terms |
| Resend, Inc. | Transactional email — sending us a notification when a FactCheck lead is captured | United States · SCCs in place | Per Resend retention policy |
| n8n.io (self-hosted on Railway) | Orchestrating the FactCheck workflow + web search | EU / US depending on Railway region · SCCs where applicable | Workflow execution logs per our n8n configuration |
5. International data transfers
Some of our processors (Netlify, Google, Resend) are based in the United States. Where personal data is transferred outside the EEA / UK, we rely on the European Commission's Standard Contractual Clauses (2021/914) together with the supplementary technical and organisational measures published by each processor. You may request a copy of the SCCs that apply to a specific transfer by emailing privacy@justadev.company.
6. Your rights under the GDPR
If you are in the EU, EEA, UK, or are otherwise a data subject under the GDPR, you have the following rights regarding your personal data:
- Access (Art. 15) – obtain a copy of the personal data we hold about you.
- Rectification (Art. 16) – have inaccurate data corrected.
- Erasure (Art. 17) – ask us to delete your data (a.k.a. "right to be forgotten").
- Restriction (Art. 18) – ask us to pause processing while a dispute is resolved.
- Portability (Art. 20) – receive your data in a machine-readable format.
- Object (Art. 21) – object to processing based on legitimate interests (we will then stop unless we have overriding grounds, which we will set out in writing).
- Withdraw consent (Art. 7(3)) – withdraw analytics consent at any time via the cookie banner. Withdrawal does not affect processing already performed.
- Lodge a complaint – with your national supervisory authority. If you are in the EU member state where we are established [to be confirmed before publication], you may also lodge a complaint with that country's data protection authority.
To exercise any of these rights, email privacy@justadev.company. We will respond within 30 days (Art. 12(3)) and may ask for proof of identity before disclosing data.
7. Children
The website and its services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please email privacy@justadev.company and we will delete it.
8. Security
Personal data is encrypted in transit (TLS 1.2+) and at rest on our processors' infrastructure (Firebase, Netlify). Server-side secrets (API keys, Resend tokens) are stored in Netlify environment variables and never exposed to the browser. The FactCheck email gate exists specifically to make automated abuse of our paid APIs harder. No system is perfectly secure; if you believe you have found a security issue, please email privacy@justadev.company before disclosing publicly.
9. Automated decision-making
The AI Architect and FactCheck features produce automated outputs from your input. These outputs are informational only: they are not used to make decisions with legal or similarly significant effects on you within the meaning of GDPR Art. 22. A human (the operator) reviews every lead and every client communication.
10. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced via a banner on the homepage for 30 days.
11. Contact
Questions, complaints, or data-subject requests: privacy@justadev.company
General enquiries: info@justadev.company