Updated October 19, 2026
This privacy policy explains how JRNY handles your personal data and the rights you have under GDPR and CCPA.
The primary database is hosted on Supabase in the EU (AWS eu-north-1, Stockholm). Each workspace's data is isolated from other customers with PostgreSQL row-level security, and data is encrypted in transit with TLS and at rest. New API keys, and the stored sign-in tokens for connected Gmail, Drive and LinkedIn accounts, are encrypted (AES-256-GCM). BetterQA staff with administrator access can access workspaces for support and operations. Supabase holds a SOC 2 Type 2 report; that is Supabase's certification, not JRNY's.
You can export your Hot, Cold and Signed companies, with their contact details, to Excel. To have your data deleted, email [email protected]; under GDPR Article 17 you have the right to ask for erasure. For workspaces where the nightly backup is switched on, a CSV backup copy is kept in a private GitHub repository and earlier copies stay in its history, so older backup copies may persist after a deletion request.
JRNY keeps the sender, name, subject and a short snippet of every incoming message in your inbox for about 30 days (a daily job deletes them) to match replies to your companies. For incoming messages it matches to your companies, the sender, name, subject and snippet are also kept in your workspace, along with the text of emails logged as interactions. For messages you send to people outside your organisation, matched to a company or not, JRNY keeps the recipient, subject and a short snippet in your workspace, with no automatic deletion.
Supabase (database and authentication; the database is in the EU), Railway (web application and workers), Cloudflare (network layer), GitHub (CSV backup copy for workspaces with the nightly backup switched on, US company), Slack and Telegram (BetterQA's internal channels, which receive: a notification for each new signup or failed signup attempt (email, name, user ID and, for failures, the error); BetterQA's own alerts about its own clients (renewals, signed-client follow-ups and the daily brief); operational alerts about connected mailboxes and sending domains (the mailbox address or domain and the workspace ID); job summaries (counts and workspace IDs); and error reports, which can include an email address or company name involved in the failure; not a customer or campaign channel), Stripe (billing), Brevo (service emails), Google (Gmail and Drive if you connect them; Google Analytics only if you accept cookies), and OpenRouter with the AI providers your own key routes to. A backup copy and some of these may be outside the EU.
Built by BetterQA.