In short
You upload documents. To turn them into a graph, their text is sent to model providers and to an embedding provider, and a record of what was sent is kept for debugging. Nobody else using JournalIntcan see your projects. You can delete your account, and that removes your documents from every place they are kept, the debugging record included. If you send feedback, your message and some technical details of the page go with it, and it is also posted in the team's chat.
Who is responsible for what
For your content (the documents you upload and everything built from them) you decide what goes in and what it is for. In the language of the GDPR you are the controller and Esteban Sánchez is the processor: it handles that material on your instructions, to run the service, and for nothing else. The terms of that processing are part of the beta terms.
For your account (your email address, your name, and how you use the service) the provider is the controller.
This split matters when you upload documents about other people, which a journalist routinely does. Deciding that is lawful is your call as a journalist, not the service's.
What is held
| What | Where | Why |
|---|---|---|
| Email address, name, profile picture if you sign in with Google, and your plan | Our database and sign-in provider, in the EU | To have an account and sign in |
| Which version of these texts you accepted, and when | Our database, in the EU | To show what you agreed to |
| The files you upload | Our file storage, in the EU, private to you | So you can re-read and download your own sources |
| The text extracted from them, its fragments, and the numeric vectors computed from those fragments | Our database, in the EU | To extract entities and relations, and to find similar passages |
| The entities, the relations and the sentence each one came from | Our databases, in the EU | To draw and query the graph |
| A record of each call to the model: what was sent, including the document text, and what came back | Our observability provider | To debug wrong output and to know what the service costs |
| If you send feedback: your message, your email address and account id, and technical details of the page you sent it from (its address, the ids of what was on screen, your browser and system, and recent errors) | Our database, in the EU. A copy without your email address goes to a private channel of our team chat provider, in the United States | To read it, to answer you, to fix what is broken and to decide what to build next |
| If you join the collaborator programme: a pseudonymous handle, your seat and its history, your points and every movement of them, the perks you reserve, what you contribute (documents, annotations, reviews and definitions) and the version of the programme terms you accepted | Our database, in the EU | To run the programme: seats, points, perks and the review of each other's work |
| If you joined the waiting list: your email, name, role, organisation and how you heard about us | Our database, in the EU | To invite you |
| If you joined the waiting list: your email address and name | Our email delivery provider, which sends from the EU | To email you the answer to your request |
No advertising, no sale of anything, to anyone. One thing is counted about each person: how much feedback they have sent and, for collaborators, how much they have contributed, so that we know who cares most about the product and can ask them what they think. The GDPR calls even this simple counting profiling. Nothing is decided about anyone by it, and you can object to it (see Your rights).
What leaves the service, and what is not done with it
To build a graph, the text of your documents is sent to third parties. Three times, not one:
- To the model providers, which read the text and propose the entities and relations. There is more than one, and each step of the extraction goes to the one that serves it best for cost and performance, so the text of one document can reach more than one of them.
- To the embedding provider, which turns fragments of it into numeric vectors.
- Into the debugging record described above, which keeps what was sent to the model providers.
The terms of every one of these providers, the embedding provider included, prohibit training on this content, and the account used with each is a paid one under those terms.
A message you send as feedback is also posted, with your account id but never your email address, in a private channel of our team chat, so that it reaches the people who act on it. To sort feedback we use an AI assistant from a provider based in the United States: it reads the message, your account id and the technical details, never your email address, and its use of them for training is switched off. The page is built not to send the text of your documents, but what you write is yours to choose: do not put private material, or anything you were asked to keep confidential, in it. The dialog says so, and tells you that technical details go with the message, before you send it.
Your documents are never sent anywhere else, and are never shown to another user. There is no sharing between accounts: a project marked discoverable can be combined only with other projects of your own, and no other account can reach it, through the interface or through the database.
Lawful basis
- Providing the service, and processing your content within it: performance of the contract between you and the provider (Art. 6(1)(b) GDPR), under the terms you accept when registering.
- Keeping the service secure and within its quotas, including the rate limits and the record of calls: legitimate interest (Art. 6(1)(f)).
- Feedback you send: legitimate interest in fixing and improving the service, and in answering you (Art. 6(1)(f)). You start it by sending it, and the dialog tells you that technical details go with the message before you do; they are listed in full in this policy. Counting how much feedback and how many contributions each person sends rests on the same interest.
- The collaborator programme: performance of the programme terms you accept when you ask for a seat (Art. 6(1)(b)). Checking that contributions follow its rules, for example one account per person: legitimate interest (Art. 6(1)(f)).
- The waiting list: your consent (Art. 6(1)(a)), given on the form, withdrawable at any time by writing to us.
Transfers outside the EU
Your account and your documents are stored in the European Union. The text of your documents is sent for processing to the model providers and the embedding provider, which are based in the United States. Those transfers rest on the safeguards in each provider's data processing terms: the EU-US Data Privacy Framework where the provider is certified under it, and the European Commission's standard contractual clauses.
The feedback you send is also posted, without your email address, to a team chat provider based in the United States, on the same safeguards: the EU-US Data Privacy Framework, under which the provider is certified, and the standard contractual clauses in its data processing terms. You can ask us for a copy of these safeguards.
The answer to a waiting list request is sent by an email delivery provider, from the European Union.
The providers that process data for JournalInt, by name, with what each handles and where, are listed for you on request: write to . You are told before a new provider starts processing your content.
How long it is kept
Your content is kept for as long as your account exists. Delete a document and its file, its text, its fragments and its part of the graph go with it. Delete a project and the same happens for everything in it.
When you delete your account, the database rows, the graph and the stored files are removed at once. This is tested, not asserted.
The debugging record goes too. Every entry in it that belongs to you, including the document text that was sent to the model, is removed in the background, normally within the hour. If the provider that holds it cannot be reached, the removal is retried, and completed by hand if it still fails. Only your entries are removed.
Feedback is kept as long as the service runs. When you delete your account, everything in it that leads back to you is removed: your email address, your account id, the details of your account, and the ids that would find the request in our logs. The message and the technical details of the page stay, because they no longer lead to anyone. If the message itself says who you are, ask and we delete it. The copy in the team chat carries your account id and never your email address; once your account is gone, that id leads nowhere. The chat provider deletes it after one year at the latest, and we delete it sooner if you ask.
The collaborator programme: your seat, your points and their history go with your account. What you contributed that other people have already worked on, or that was accepted into the reference set, stays without your handle or your account, as the programme terms explain.
The waiting list is kept until the beta ends or you ask for it to be removed.
Your rights
You may ask for access to your data, for it to be corrected, for it to be deleted, for it to be handed to you in a portable form, and you may object to processing based on legitimate interest. Most of this you can do yourself in the product; for the rest, write to .
Your right to object. You may object at any time to processing based on legitimate interest, including the counting of feedback and contributions described above: write to and it stops for you, unless there are compelling reasons to continue, which we would explain to you.
You may also complain to your national data protection authority.
If there is a breach
If personal data is exposed, lost or reached by someone who should not have it, what happens depends on whose data it is:
- Your account data, for which the provider is the controller: if the breach presents a risk to people, the supervisory authority is notified within 72 hours of the provider becoming aware of it, and you are told directly when the risk to you is high.
- Your content, for which you are the controller: you are told without undue delay, with what is known at the time, so that you can decide whether to notify the authority and the people concerned. The provider helps you do it.
The internal procedure behind this is written down and is not public.
Automated processing and artificial intelligence
The entities, relations and cross-project matches in JournalInt are generated by a language model. They are proposals about what a document says, not verified facts, and the interface marks them as machine-generated wherever they appear.
- Nothing is decided automatically about you. There is no automated decision-making in the sense of Art. 22 GDPR: the software proposes, you decide, and you can edit or delete anything it proposes.
- It gets things wrong, measurably. The product shows what the extraction was measured at on a hand-annotated set, per language and per kind of relation, along with what those figures do not cover. Read it before relying on the output.
- A match between projects is a proposal about names, not a statement that two people are the same person.
- Your content is not used to train anything, ours or a provider's.
Changes
This policy carries a version and a date. When it changes materially you are told in the product before the new version applies, and the version you agreed to is recorded with your consent.
Questions: write to .