This notice explains how Juniper Enterprises Holdings Limited uses personal data for Juniper OS. It is written for the UK GDPR.
Who we are
The controller for your account data is Juniper Enterprises Holdings Limited, registered in England and Wales (company number 15631236). Registered office: Cn House, Brooks Drive, Cheadle Royal Business Park, Cheadle, Cheshire, United Kingdom, SK8 3TD. We are UK-based.
When you store personal data about your own clients in Juniper OS, you are the controller for that client data and we are your processor. The Data Processing Addendum covers that work.
Questions: use the contact form. We do not publish an email address on this site.
Data we collect
From you: name, email, password hash, business name, the seat you pick, and what you type into Talk or forms. Stripe holds card details. We see a token and billing status, not the full card number.
From your use: sign-in records, consent records, the audit log of Approves and Holds, and technical logs needed to keep the product up (IP address, device, error traces).
From your file, if you add it: client names and contacts, invoices, quotes, jobs, and data pulled from tools you connect. We do not collect your clients from any other source.
From the launch list, if you join it: name, email, business details you give, and the time and IP of your consent.
Why we use it, and the lawful bases
To run your account, take payment, and provide Talk, Today and the file: contract.
To keep an audit log, record consent, stop abuse, and meet tax or accounting rules: legal obligation or legitimate interests (keeping a secure, accountable product).
To email you about launch or product news you asked for: consent. You can withdraw through the unsubscribe link or the contact form.
We do not sell personal data. We do not use it for advertising networks.
Processors
We use other companies to run Juniper OS. They process data on our instructions. The live list is also on the Data Processing Addendum.
| Processor | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | Ireland, EU (eu-west-1) |
| Vercel | Application hosting | Global edge. Not UK-only |
| Anthropic | Model replies for Talk and related calls | Outside the UK |
| OpenAI | Model replies when that provider is used | Outside the UK |
| xAI | Model replies when that provider is used | Outside the UK |
| Voyage AI | Text embeddings for search over your file | Outside the UK |
| Stripe | Subscription payments | Outside the UK, with UK/EU options |
| Resend | Transactional email | Outside the UK |
| Twilio | WhatsApp and SMS when you enable those channels | Outside the UK, with UK/EU options |
| Companies House | Public company lookups you ask us to run | UK |
| Sentry | Error monitoring that is strictly needed to keep the product secure and running. It can run without an analytics cookie. | Outside the UK, with EU options |
| PostHog | Product analytics and session replay, only after you accept analytics cookies. EU host. | EU (eu.i.posthog.com) |
Model providers process prompts under their API terms. Published API policies for Anthropic, OpenAI and xAI say they do not train on API customer data unless you opt in. We do not opt in. Policies: Anthropic Commercial Terms; OpenAI API data controls; xAI Enterprise FAQ.
What we send to model providers
When you use Talk, we send the text of that conversation and the company context needed to answer. When you connect a tool, we send the data you asked us to pull from that tool. You choose which tools to connect. We do not claim a separate filter that strips data before a model call.
International transfers
The database is in Ireland, EU (Supabase, eu-west-1). The app is hosted on Vercel, which is not UK-only. Model providers and some email and payment processors sit outside the UK. Where we send personal data outside the UK we rely on the UK addendum to the EU standard contractual clauses, or on an adequacy regulation, or on the processor's own lawful transfer tool.
How long we keep it
Account and file data: for as long as the account is open, then through the 30-day recovery window after you ask us to close it. After that we delete what we can.
Invoices and payment records: up to 7 years where tax or accounting law requires it.
Audit logs and consent records: kept as evidence, up to 7 years.
Launch-list contacts: until you unsubscribe or ask us to erase them.
The retention schedule lists the same windows by class.
Your rights
You can ask for access, correction, erasure, restriction, portability, or to object to processing that relies on legitimate interests. You can withdraw consent where we rely on it. Use the contact form. Some rights do not apply to data we must keep for law or for the audit trail.
Signed-in export and deletion tools live under account settings when those screens are available for your seat.
Complaints
You have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would welcome the chance to resolve a concern first.
Cookies
We use cookies that are needed to sign you in and keep the session. A first-party cookie also stores your Accept or Reject choice so we do not ask every time. We do not set advertising cookies.
Analytics (PostHog, EU host) loads only after you Accept. The cookie banner gives Accept and Reject equal weight, and links to this notice. You can change that choice later from Cookie settings in the footer. More detail is on the Cookies page.
Sentry is error monitoring we use to keep the product secure and running. It is strictly needed for that purpose, so it can run without an analytics cookie. It is set not to collect personal data. We also scrub emails, phone numbers, tokens and Authorization headers from messages, breadcrumbs and URLs before anything is sent.
Related pages: Terms, Refunds policy, Data Processing Addendum.