This Privacy Policy describes how Jump Technologies, S.L. (“Jump”, “we”) processes personal data through the Jump Auth platform in compliance with the EU General Data Protection Regulation 2016/679 (“GDPR”) and Spanish LOPDGDD 3/2018.

1. Data controller

Jump Technologies, S.L., Madrid, Spain. Data Protection Officer: legal@jumptechnologies.ai.

2. Minimum age

Jump Auth is a business service and is not directed at minors. In accordance with Article 7 of the Spanish LOPDGDD 3/2018, consent-based processing requires users to be at least 14 years old; in any case you must be at least 18 years old (or the age of legal capacity to contract in your jurisdiction) to use the service. We do not knowingly process data of minors; if you believe a minor has created an account, contact legal@jumptechnologies.ai and it will be removed.

3. Categories of personal data

• Identification: email, name, organisation membership, role.
• Credentials: password hash (argon2id) and short-lived, hashed email verification codes.
• Conduct: IP address and user agent during sign-in and sensitive actions, audit logs.

4. Purposes and legal bases

• Providing the authentication and authorisation service (Art. 6.1.b — contract).
• Security, fraud prevention and audit logging (Art. 6.1.f — legitimate interest).
• Compliance with legal obligations (Art. 6.1.c).

5. Data residency

All personal data is processed and stored exclusively in the European Union, in Google Cloud Madrid (europe-southwest1). Backups are stored in the same region with customer-managed encryption keys (CMEK).

6. Sub-processors

We engage the following sub-processors. Each is bound by a Data Processing Agreement (Art. 28).

7. Retention

• Account data: while the account is active. Inactive accounts are warned after 24 months without sign-in and anonymised 30 days later.
• Deletion requests (Art. 17): executed after a 7-day grace period during which you can cancel, and in all cases within 30 days.
• Audit logs: 36 months; IP addresses are anonymised after 12 months. Security-critical audit events are kept for 7 years in a locked-retention archive.
• Database backups: 30 daily backups (~1 month), encrypted with CMEK.

8. Your rights

You may exercise the following rights from your privacy settings or by writing to legal@jumptechnologies.ai:

• Access (Art. 15) and Portability (Art. 20).
• Rectification (Art. 16).
• Erasure (Art. 17).
• Restriction of processing (Art. 18).
• Objection (Art. 21).

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

9. Security measures

TLS 1.3 in transit, CMEK + envelope encryption at rest, MFA available for all users and mandatory for administrators, VPC Service Controls perimeter, edge WAF and rate-limiting via Cloud Armor, daily automated backups with monthly restore testing.

10. Updates

Material changes will be notified via email and via an in-app banner at least 30 days in advance.