Privacy policy

Data controller

[à compléter] ([à compléter]), [à compléter], is the controller of the processing described here.

Contact for any question about your data: infos@jamaa.network.

Data we process

• Account: email, password (encrypted by Google Firebase, never readable by JAMAA), username, first name, last name, country.
• Profile: photo, occupation, skills, biography, phone, location, sectors, experience, availability, visibility zones.
• Community of origin and clan: only with your consent (see below).
• Content: posts, comments, private messages, service requests, job applications, article proposals, reviews.
• Library and Research: works, projects and publications you share (private PDFs, only read in the built-in reader), named co-authors. Researcher profile: declared status (Professor, PhD or researcher), thesis, university, title or rank, institution and ORCID; no diploma or document is requested. Professor and PhD statuses are approved by administrators from this information. The profile is deleted with the account.
• Payments: amount, plan, date, reference and status. Card and mobile-money numbers are entered at Stripe or YengaPay, never at JAMAA.
• Technical data: IP address and request ID in security logs, presence status (online), language and notification preferences.
• Audience measurement: only after you agree in the cookie banner (Google Analytics).

Purposes and legal bases

• Performance of the contract (terms of use, membership): account, directory, connections, messaging, Marketplace, jobs, events, membership and payment.
• Consent: community of origin and clan, card visible to non-registered visitors, AI analysis of your photo, audience measurement. You can withdraw each consent at any time from your profile or the cookie banner.
• Legitimate interest: security, abuse and spam prevention, content moderation, log of administrative actions, service improvement.
• Legal obligation: retention of accounting records, answering the authorities.

Community of origin and clan

This information may reveal an ethnic origin, a special category of data protected by Article 9 GDPR. It is optional and only stored with your explicit consent, given through a separate checkbox at sign-up or in your profile.

It is only used to connect you with members and content of that community, according to your visibility settings. It is never sold or used for advertising.

Unticking the box in your profile withdraws your consent and erases this information when you save.

Artificial intelligence

When the service is enabled, JAMAA uses the OpenAI API for two purposes:

• automatic moderation of published texts and messages (hate speech, harassment or spam detection), for community safety;
• analysis of your profile photo (professional or not, inappropriate content), only if you have not refused it in your profile.

OpenAI acts as a processor: data sent through the API is not used to train its models and is deleted after a short period set by OpenAI. No decision with legal effects is taken solely on the basis of these analyses: blocked content can be challenged with support.

The in-app JAMAA assistant works without sending your messages to an external AI service.

Recipients and processors

Your data is visible to members according to your visibility settings (your contact details only after a connection request is accepted), and to the administrators of your territory for moderation.

Technical processors:

• Google (Firebase Authentication, Firestore, Storage; Google Analytics with your consent);
• DigitalOcean, LLC (application hosting);
• Stripe and YengaPay (payments);
• OpenAI (moderation and photo analysis, see above);
• Resend (sending emails);
• Upstash (rate limiting and cache, no profile content).

Some are based outside the European Union, in particular in the United States. These transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

JAMAA never sells or rents your data.

Retention periods

• Account and profile: until the account is deleted, then a 30-day cancellation period before permanent erasure.
• Notifications and security log: 1 year.
• Content proposals: 2 years.
• Messages sent to support: 3 years.
• Accounting records (payments): 10 years, even after account deletion (French Commercial Code, art. L123-22).
• Audience measurement cookies: 13 months at most.

These periods are applied automatically by expiry rules in the database.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent and to set instructions about your data after your death.

• Download your data or delete your account: Settings → My personal data.
• Correct your profile: My profile → Edit.
• For any other right: infos@jamaa.network. We answer within one month.

You can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

Minimum age

JAMAA is for people aged 18 and over. An account created by a younger person is deleted as soon as we become aware of it.

Security

Encrypted connections (HTTPS, HSTS), server-side access control, contact details hidden without authorisation, log of administrative interventions, rate limiting and error monitoring. In the event of a data breach presenting a risk, we notify the CNIL within 72 hours and the people concerned.

Changes

Any significant change to this policy is announced in the app and by email before it takes effect. The version date is shown at the top of the page.