Privacy Policy — Participants

Joynery — Last updated: 3 October 2026

How we handle your personal data. Controller: SUPPL FlexCo, Wildgartenallee 19/2, 1120 Vienna. Contact: hello@joynery.at.

What we collect

You give us: email, display name, profile preferences, messages, reviews and optional survey responses. Supabase handles your password; our application database does not store a copy or hash of it.

From payments: Stripe sends us transaction records (amount, date, product). We never see full card numbers.

Automatically: technical information needed to run and protect the Platform. Page and referral analytics are collected only if you opt in.

From Partners: attendance confirmation.

Signing in with Google

If you sign up or sign in with Google, Google shares your name, email address, profile picture and a unique Google account ID with us. We only ask for this basic profile information. We get no access to your contacts, emails, files or any other Google data, and we never see your Google password.

We use this data only to create your Joynery account and sign you in. Your name becomes your display name, which you can change anytime in your profile. Legal basis: Art. 6(1)(b) GDPR.

Supabase stores this data as part of our authentication service, and it is deleted when you delete your account. We do not sell Google user data, use it for advertising, or share it with anyone except the processors listed in this policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Joynery’s access at any time at myaccount.google.com/permissions. Google processes your sign-in under its own privacy policy (policies.google.com/privacy).

Why we process it

To run the Platform (account, bookings, credits) — Art. 6(1)(b) GDPR.

Legal obligations (tax, accounting) — Art. 6(1)(c) GDPR.

To improve & protect (analytics, fraud prevention, service messages) — Art. 6(1)(f) GDPR.

Marketing (newsletters, offers) — only with your consent, Art. 6(1)(a) GDPR. Withdraw anytime.

Who sees your data

Partners receive your display name, booking details and an internal Participant ID when needed to deliver your booked session or use authorised messaging. The Partner roster does not include your email address or payment records. Your display name appears in group chat and with any public review you post. Our processors:

Supabase (database and authentication).

Stripe (payments).

Mailjet (transactional emails and consented newsletters).

Mapbox (geocoding and location search).

OpenStreetMap (map display).

Google (optional sign-in with Google).

If you opt in to analytics, we use a self-hosted instance of Plausible Community Edition. Plausible does not use cookies or persistent identifiers. Analytics data is used only in aggregate to understand Platform usage and improve the service.

We never sell your data. We disclose to authorities only when legally required.

International transfers

Where data leaves the EU (e.g., Supabase’s US parent), we rely on EU Standard Contractual Clauses or adequacy decisions. Request a copy from us anytime.

How long we keep it

Account data: while your account is active. Direct profile data is removed or anonymised when the account is deleted, while transaction and legal records may remain where required.

Transaction data: 7 years from year-end of transaction.

Usage and security logs: for the period needed to operate and protect the relevant system, then anonymised or deleted, unless needed for a legal obligation or claim.

Marketing consent: until you withdraw or delete your account.

Optional account-survey answers are scheduled to be cleared after 12 months, but may remain longer until the approved clearing process is enabled. Deleting your account does not itself delete survey records. Waitlist survey answers currently have no automatic clearing period.

Your rights (GDPR)

Access · Rectification · Erasure · Restriction · Portability · Objection · Withdraw consent

Email us at hello@joynery.at. We respond within one month.

Complaints: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.

Cookies

Strictly necessary cookies and browser storage are used for session and authentication without consent. Analytics requires your opt-in. We do not currently use marketing cookies. Manage analytics preferences anytime via the footer link.

Security

We use encryption, access controls, private storage, data minimisation and audit records to protect personal data. Exact safeguards depend on the deployed services and their current settings. No internet service can guarantee absolute security.

Changes

We will tell you about material changes where required by law.