Privacy policy
Last updated: 27 July 2026
This document explains what personal data we process when you use JointLib, why we process it, who we share it with and what rights you have. It should be read together with the Terms and conditions and the Cookies policy.
CONTENTS
1.Who the controller is
The controller of the data processed through the JointLib platform is [TO BE COMPLETED: legal name, company registration number, registered address]. For anything concerning your data you can write to [TO BE COMPLETED: data protection e-mail address] or use the contact form.
We have not appointed a data protection officer (DPO), as our activity does not fall within the cases requiring one under Article 37 GDPR. Your requests are handled directly by the controller.
2.What data we collect
We collect only the data needed to provide the platform, grouped as follows:
Account and profile data
Your e-mail address, your password (stored only as a hash, never in clear text), your public name and username, and — if you choose to fill them in — your profile picture, biography, occupation and links to other sites. If you sign in with Google, we receive your e-mail address and account identifier from Google, but never your password.
Content you create
Calculation inputs, the tools and workflows you build or publish, posts, comments, uploaded images, and the files you send to the AI assistant. This content contains personal data only if you enter it yourself.
Payment data
The history of credit purchases and of tools bought or sold, together with amounts and currency. We never receive or store card numbers — payments are processed entirely on Stripe's infrastructure and we keep only the transaction identifiers.
Technical data
IP address, date and time of access, browser type, pages visited, application errors, and AI usage logs (number of actions, tokens consumed, credits charged). If you use the desktop agent, we also record the agent session name and the commands sent to it.
We do not use advertising cookies and we do not build behavioural profiles for marketing purposes. The full cookie inventory is in the Cookies policy.
3.Purposes and legal bases
Every processing operation has a defined purpose and a legal basis under Article 6 GDPR:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account, signing in, company membership | Account and profile | Performance of a contract — Art. 6(1)(b) |
| Saving your calculations, tools and posts; publishing them if you choose to | Content you create | Performance of a contract — Art. 6(1)(b) |
| Generating tools and answers with the AI assistant; metering credits | Content sent to the assistant, usage logs | Performance of a contract — Art. 6(1)(b) |
| Processing payments, issuing accounting documents, paying tool authors | Payment data, account data | Contract — Art. 6(1)(b) and legal obligation (tax and accounting) — Art. 6(1)(c) |
| Service e-mails: address confirmation, password reset, account notifications | E-mail address | Performance of a contract — Art. 6(1)(b) |
| Sending the newsletter with platform news | E-mail address | Consent — Art. 6(1)(a), withdrawable at any time |
| Platform security, abuse and fraud prevention, error diagnosis | Technical data | Legitimate interest — Art. 6(1)(f) |
4.Who we disclose data to
We do not sell data to anyone. We disclose it only to the providers that help us run the platform, each under a data processing agreement and only for the stated purpose:
| Provider | Role | Place of processing |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | European Union |
| Resend | Delivery of service e-mails | United States |
| Stripe | Payment processing and author payouts | EU and United States |
| Intuit Mailchimp | Newsletter delivery | United States |
| Anthropic | The language model behind the AI assistant | United States |
| Sign-in with a Google account (only if you choose it) | EU and United States |
We may also disclose data to public authorities where the law requires it, or to our advisers (accountant, lawyer), who are bound by confidentiality. If you publish a tool or a post, that content becomes visible to other users — that is your choice, not a disclosure made by us.
5.Transfers outside the EU
Some of the providers listed above are established in the United States. Transfers to them are made on the basis of the standard contractual clauses adopted by the European Commission and, where the provider is certified, under the EU–U.S. Data Privacy Framework. You may request a copy of the applicable safeguards at the contact address in section 1.
6.How long we keep data
We keep data only for as long as it is needed for the purpose it was collected for:
| Category | Retention |
|---|---|
| Account and profile data | For the lifetime of the account, plus at most 30 days after deletion (backup cycle) |
| Content you create (calculations, tools, posts) | Until you delete it or until the account is deleted |
| Payment records and accounting documents | 10 years, as required by accounting legislation |
| Technical, security and AI usage logs | 12 months |
| Address subscribed to the newsletter | Until you unsubscribe |
7.The AI assistant and uploaded files
When you use the AI assistant, the text, images and documents you send are transmitted to Anthropic, the provider of the language model, in order to generate the answer. Under that provider's commercial terms, content submitted through the programming interface is not used to train models. We keep the conversation and the resulting tools in your account, plus a usage log needed to charge credits.
Please do not enter other people's personal data into the assistant (client names, addresses, project contact details) or any kind of sensitive data. The assistant's output is a working aid, not an automated decision producing legal effects for you: verifying and taking responsibility for any calculation remains with the engineer, as set out in the Terms and conditions.
8.Your rights
As a data subject, you have the following rights:
- Access — to find out what data we hold about you and receive a copy.
- Rectification — to correct inaccurate data; you can edit most of it yourself from your account settings.
- Erasure — to ask us to delete your data, within the limits of our legal archiving obligations.
- Restriction of processing — to ask us to suspend processing while a challenge is being verified.
- Portability — to receive your data in a structured, machine-readable format.
- Objection — to object to processing based on our legitimate interest.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand.
You can exercise your rights by writing to the contact address in section 1. We reply within one month of receiving the request at the latest. You can also delete your account directly from your account settings.
If you believe we have infringed your rights, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro) or with the supervisory authority of the country where you reside.
9.Data security
Traffic to the platform is encrypted with TLS. Passwords are stored only as hashes, and your account can be further protected with two-factor authentication. Access to the production server is limited to the people who administer the platform, and database backups are taken regularly. No system is absolutely secure, however; should a security breach occur that may affect your rights, we will inform you in accordance with Article 34 GDPR.
10.Children
The platform is aimed at engineers and construction professionals and is not intended for people under 16. We do not knowingly collect data from children. If you become aware that a child has provided us with data, write to us and we will delete it.
11.Changes to this policy
We may update this policy when we add new features or change providers. The date of the last update is shown at the top of the page, and we will announce significant changes by e-mail or through an in-platform message before they take effect.