Privacy policy

The data controller is Sorana Ventures LLP, a limited liability partnership registered in India, Bengaluru, Karnataka, India. For privacy questions or to use your rights, write to privacy@junction.co.

Two roles matter. For information about our website visitors, sales enquiries and account holders we are the controller. For the business data in a customer’s own systems that our service reads on the customer’s instruction, we are a processor acting for the customer, who is the controller. Section 4 and our data processing terms (available on request) cover that second role.

When you visit the website. Our hosting provider records technical data needed to serve the page and keep it secure: IP address, browser type, the page requested and the time. We do not currently run advertising or analytics cookies or trackers on the marketing site. If that changes, we will update this policy and ask for consent where the law requires it.

When you contact sales. The form collects your name, work email address, company, the systems and AI tool you use, and anything you write. We use it to reply to you and to understand demand for the systems we support.

When you create an account. Your email address and a password (stored only as a salted hash by our authentication provider), your company name and role, the people you invite, and the settings you choose. If you choose to sign in with Google, Google tells us your name, email address and profile picture (we use the email address and name; we do not receive your Google password or other Google data). If you subscribe, our payment provider handles your card details; we receive only a customer reference, plan and payment status, never the full card number.

When you use the service. We keep an audit log of who used which tool, system and kind of data, the result (success, refused or error), the number of rows and the time. The log contains names and counts, not the values you asked for or the data returned. We also keep technical logs for security and reliability.

Connection details. If you give us database logins or API credentials so we can read your systems, we store them encrypted, and we do not display them back to you or to anyone else.

• To provide the service and respond to you (performance of a contract, or steps you ask us to take before one).
• To secure and improve the service, prevent abuse and keep records (our legitimate interests in running a safe, reliable product).
• To bill you and meet tax and accounting duties (contract and legal obligation).
• To tell you about the product where you have asked to hear from us or where the law allows it, with an easy way to opt out (consent or legitimate interests).

We do not sell personal data. We do not use your data or your customers’ business data to train AI models, and we do not run an AI model ourselves.

When a customer connects an accounting or project system, we read from it only what is needed to answer a question that a person in that customer’s company asks their AI tool. The service is read-only. Payroll and personal records are excluded by default. The results pass through our servers in transit to the customer’s AI tool and are not kept, except that: (a) for systems read through the customer-side agent, a working copy is kept on the customer’s own machine; and (b) for scheduled reports a customer emails to us, the rows of the report are stored in that customer’s own area so they can be queried.

What happens to results after they reach Claude, ChatGPT or another AI tool is governed by the customer’s agreement with that provider, not by us. Customers should check that agreement before connecting sensitive data.

We use the following providers to run the service. Each is bound by a contract that limits its use of the data.

• Vercel: hosts the website and customer portal.
• Supabase: account sign-in and the portal’s database (sales enquiries, companies, memberships).
• Railway (or the cloud host we name in our data processing terms): runs the connector service and its database.
• Google: optional “Sign in with Google” (processed through Supabase).
• Stripe: subscription billing and payment processing.
• Resend: sends the email notifications for sales enquiries and invitations.
• Postmark: receives emailed reports, for customers who use that feature.

We will update this list before adding a provider that handles personal data, and give customers notice as our data processing terms require. Ask privacy@junction.co for a copy of the list with locations.

Our providers may process data in the United States and other countries. Where personal data leaves the UK or European Economic Area, we rely on an adequacy decision or on standard contractual clauses and, where needed, additional safeguards.

Sorana Ventures LLP is based in India. For personal data of people in India, and wherever else the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) applies, we act as a data fiduciary for the data described in section 1 and follow it:

• Notice and consent. This policy is our notice. We process personal data for the purposes in section 3, on your consent or for the “legitimate uses” the Act allows (such as performing a contract you asked for, or meeting a legal obligation). You may withdraw consent at any time; withdrawal does not affect what was done before, and may mean we can no longer provide the service.
• Your rights. You may ask us for a summary of the personal data we process and with whom we share it, to correct or complete it, to erase it (unless we must keep it by law), and to have your grievances addressed. You may also nominate another person to exercise these rights for you if you die or become unable to.
• Grievance redressal. Our contact for grievances is the Grievance Officer at privacy@junction.co, Sorana Ventures LLP, Bengaluru, Karnataka, India. We will acknowledge a grievance promptly and respond within 30 days, or sooner if the law requires. If you are not satisfied, you may complain to the Data Protection Board of India, after first using this process.
• Transfers outside India. We may transfer personal data to our providers in other countries, except to any country the Central Government restricts by notification.
• Reasonable security. We maintain reasonable security safeguards (section 9) to prevent personal data breaches, and will notify the Board and affected people as the Act requires.
• Children. We do not process personal data of children (under 18) and do not knowingly offer the service to them.

• Sales enquiries: up to 24 months after our last contact, then deleted.
• Account and company data: while the account is open, then deleted within 90 days of closure, except what we must keep for tax and legal reasons.
• Audit log: 400 days by default, then deleted. Customers may ask for a different period.
• Sign-in and access tokens: short-lived, and removed when they expire or are revoked.
• Website server logs: kept by our host for a short period, normally no more than 30 days.

We encrypt data in transit; store passwords only as salted hashes and our access tokens only as hashes; encrypt connection credentials at rest; separate each company’s data and enforce that on the server for every request; and record administrative actions. No system is perfectly secure, so we will tell affected customers promptly if we find a breach that affects them. Our security page describes the design in more detail.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, to withdraw consent, and to complain to your data protection authority (in the UK, the Information Commissioner’s Office). California residents have rights to know, delete and correct, and to opt out of the sale or sharing of personal information; we do neither. Email privacy@junction.co and we will respond within one month. If your request concerns a customer’s business data, we may refer you to that customer.

The marketing site sets no non-essential cookies. After you sign in to the portal we set the cookies our authentication provider needs to keep you signed in; they are essential to the service and are not used for tracking.

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

We will post changes here and change the effective date. For material changes affecting account holders we will also notify you by email or in the portal.