Privacy policy.

This translation is provided for information only; only the French version is legally binding.

Data controller

The data controller is DEVINTECH, a French simplified joint-stock company (SAS) with share capital of €1,000, registered office at 41 rue de Rochechouart, 75009 Paris, France, registered with the Paris Trade and Companies Register (RCS) under number 894 124 155. The Jsonpage service is published under the Jsonpage brand.

For any question about your personal data or to exercise your rights, use the contact form and choose the “Personal data (GDPR)” topic.

Data we process

• Account: email address, password hash and API key hashes. Passwords and API keys are never stored in plain text. On the Pro plan, the list of allowed IP addresses you save, used to reject requests from other addresses.
• Session: a strictly necessary session cookie used for sign-in, which expires after seven days.
• Partner link: if you follow a link of the form jsonpage.com/?ref=code, the site remembers that code for 90 days in a cookie ("jp_ref") so that your sign-up can be attached to the partner who recommended the service. The cookie only holds the code, is set only when you follow such a link and accept it on the privacy panel ("Partner link"), and is read only when an account is created. Each visit through a partner link is counted per code and per day, with no IP address or visitor identifier. For the partner, we keep its code, its e-mail address and the commissions calculated from the payments of the attached accounts.
• API usage: the number of requests per day and per account, to apply your plan and show your usage.
• Request log: for each API request, the date, the requested path with its parameters, the status code and the processing time, linked to your account. It is used to show the request log in the dashboard and to help you when you contact support. Response contents are not kept.
• Monitoring: the list of identifiers of the companies you monitor, with their last known state, the detected events, your webhook URL and its signing secret, and the history of delivery attempts (date, status code, error). This data is stored on our server in France.
• Email alerts: the email addresses of the recipients you enter and the sending mode and language you choose, used to send monitoring alerts. This data is stored on our server in France.
• File enrichment: the identifier column you send (only the chosen column leaves your computer, not the rest of the file) and the completed file, stored on our server in France so that you can download it.
• Company lists: the number of rows exported per calendar month, used to apply the plan quota. The criteria and the content of downloaded lists are not kept.
• Server technical logs: IP addresses and technical request information, for security and troubleshooting.
• Contact form: your name, email address, topic and message.
• Billing: payment details are entered into and held by Stripe. We only keep the Stripe references of your customer record and subscription.
• Bot protection: technical information processed by Cloudflare Turnstile.
• Audience measurement: visit and performance statistics collected by Cloudflare Web Analytics if you allow it.

Purposes and legal bases

Account, session, usage, request log, monitoring, email alert, enrichment, company list and billing data are used to provide the service, authenticate sign-ins, apply your plan and manage your subscription: they are necessary to perform the contract. Invoices and payment records are kept to meet our accounting obligations. Technical logs and the bot check protect the service against abuse, which is our legitimate interest. Contact form messages are used to answer you. Audience measurement relies on your consent.

Account and deletion

Account data is stored in a PostgreSQL database hosted by Neon. You can delete your account at any time from the dashboard (Settings) with the “Delete my account” button. This immediately cancels your Stripe subscription and erases the account, its API keys, its usage counters, its request log, its allowed IP addresses, its enriched files and its monitoring data (monitored companies, events, webhook, email alert recipients and delivery attempts).

Bot protection

Public signup, sign-in and contact forms use Cloudflare Turnstile. The security check loads a Cloudflare script and sends Cloudflare the technical information needed to distinguish people from bots. Our server validates the token before processing a form. This check protects the service and is not used for audience measurement. Cookie pre-clearance is disabled.

Audience measurement and cookies

The site measures its audience with Cloudflare Web Analytics. This tool sets no cookie and does not track you across other sites. It loads only if you allow it in the preferences panel. Declining does not block access to the site or the API. You can change or withdraw your choice at any time through “Manage cookies” at the bottom of every page; after withdrawal, the measurement script stops loading once the page reloads.

Your choice is stored in your browser's local storage for six months. The strictly necessary session cookie expires after seven days. A customer file diagnosis started without an account sets a cookie, also strictly necessary, that keeps access to the file to your browser; it expires after eight days. Language and theme preferences remain in local browser storage until cleared; they support site features you request. The partner link cookie ("jp_ref") is set only if you follow a partner link and accept it on the privacy panel; it expires after 90 days, is used only to attach a sign-up to that partner and can be deleted at any time in your browser settings.

Company data served by the API

Company records come from the official company registers (France, Belgium, Switzerland, Norway, Finland, Latvia, Ireland, Sweden, Estonia, Lithuania, Australia, Singapore, Japan, United Kingdom) and published legal notices. They may include data about natural persons who run a business, such as sole traders (entrepreneurs individuels). For entrepreneurs who have asked not to appear in public distribution, names and addresses are removed. Names of natural persons mentioned in legal notices are not stored. You can object to the processing of data about you through the objection form or the contact form (topic "Personal data (GDPR)").

Public company directory and list export. The public search and company pages and the company list export are provided by DEVINTECH, the data controller. Their purpose is to inform about companies and to allow business partners to be checked. They rely on our legitimate interest, whose balance with the rights of the people concerned has been weighed and documented. The categories of data are the identity of the company, its address, status, legal form, activity and, for companies, the surname, first name and role of their directors. This data comes from public registers named in the legal notice. It is not collected from you: this notice informs you of it.

• Non-disclosure: we respect the register's diffusion status. If you are not publicly listed at the source, your page shows no personal data. Under partial diffusion, the fields the source masks (name, first name, address) are neither displayed nor exported. A change of status is applied within 24 hours.
• Sole traders: their page shows only the town and the department, does not carry their name in its address or title, is not indexed by search engines and cannot be found by a search on the name: only an exact SIREN or SIRET leads to it. They are excluded from exports.
• Indexing: only companies are indexed by search engines.
• Directors: only the surname, first name and role are shown. There is no page per director and no link from a director to their other companies, and directors are not in the exports.
• Reinforced right to object: the dedicated form is reachable from the footer and from each company page. We acknowledge receipt immediately and reply on the substance within one month at most (two more months if the request is complex, with notice within the first month). A removal takes the person off the pages, the search, the API and future exports, returns a 410 code on the page address and leads to a de-indexing request to search engines. An objection from a director applies to every company where they appear. If we refuse it for compelling legitimate grounds, we explain why and inform you of your right to complain to the CNIL.
• Recipients: buyers of exports, who only receive data about legal entities, and our host.

Files uploaded for the customer file check, with or without an account, may contain personal data of your own customers. For this service we act as a processor: we only use the file to produce the check, delete it after 7 days (or at once with the "Delete now" button) and neither reuse it nor link it to an advertising profile.

Persons with significant control (United Kingdom)

For British companies, the API provides, as published by the official British companies register, the data of persons with significant control: name, nationality, country of residence, month and year of birth and nature of control. Addresses and the day of birth are never included, and only persons whose control is current are served.

This processing provides company information for business partner verification and due diligence; it relies on our legitimate interest and that of our customers. The data follows the British register's publications: a removal or correction made at the source is reflected promptly. A person concerned can exercise their rights through the contact form; a correction must also be made at the source, with the British companies register.

Retention periods

• Account, email address and API keys: as long as the account exists; erased immediately when it is deleted.
• Request counters: 13 months.
• Request log: at most 90 days; the dashboard shows 7 days on Discovery, 30 days on Standard and 90 days on Pro; erased immediately when the account is deleted.
• Enriched files and customer file check files: 7 days, then deleted; erased immediately when the account is deleted.
• Company records: as long as the company is in the source; a deregistered company is reduced to its identity, without directors, after 12 months.
• Access logs of the public pages: IP addresses kept 90 days at most, then deleted; no file content is logged.
• Log of list exports: account, date, criteria, number of rows and acceptance of the conditions, 12 months.
• Register of objection, erasure and rectification requests: 3 years after the request is closed. The exclusion list of removed pages is kept as long as needed for the removal to stay effective.
• Exported row counters: as long as the account exists; erased when it is deleted.
• Allowed IP addresses and email alert recipients: as long as you keep them; erased immediately when the account is deleted.
• Monitoring: the list of monitored companies and the webhook URL and secret for as long as you keep them; detected events and their delivery attempts, 90 days; all erased immediately when the account is deleted.
• Server technical logs: 30 days.
• Contact form messages: 3 years after the last exchange.
• Invoices and payment records: 10 years, under accounting obligations; they are kept by Stripe.
• Cookie choice: 6 months.
• Partner link cookie: 90 days; visit counts per code and per day with no personal data; attachment of an account to a partner for as long as the account exists; commissions, 10 years under accounting obligations.

Processors and recipients

• OVH SAS (hosting): server located in France.
• Neon Inc. (account database): data hosted on AWS in Frankfurt, Germany.
• Stripe Payments Europe Ltd (payments): Ireland.
• Cloudflare Inc. (Turnstile CAPTCHA and audience measurement).
• Our email delivery provider: delivers contact form messages and monitoring email alerts.
• European Commission: EU VAT numbers are sent for verification.
• Federal Statistical Office (Switzerland): Swiss VAT numbers are sent for verification.

Transfers outside the European Union

Some providers may process data outside the European Union, in particular in the United States: Cloudflare and, where applicable, Stripe and Neon's parent company. These transfers rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.

Your rights

You may request access to, correction or erasure of your data, restriction of processing and data portability, and you may object to processing. To exercise these rights, use the contact form. You may also lodge a complaint with the CNIL, the French data protection authority.