Free adult accounts, organisation connections and text contributions

Version: adult-free-2026-10-27-v1

1. Who is responsible

Joournals is operated by UTDANNINGSKONSULENTENE AS, Norwegian organisation number 935 934 915, Nattlandsveien 21, 5093 Bergen, Norway. In this notice, “we” means this company. We determine how personal data are used to operate these Joournals account, membership and publication services.

Privacy questions and requests: privacy@joournals.com

Account and content support: hello@joournals.com

This notice covers adult registration and sign-in, requests to connect to a school or organisation, and text contributions submitted through Joournals. A school or organisation may separately use information about its staff or representatives for its own purposes; ask that organisation about those uses.

2. What information we use and where it comes from

Account information: your email address, Memberstack account identifier, email-verification and account-safety status, and the information needed to sign you in. You enter your password into the Joournals sign-in or registration form for authentication through Memberstack. Our Joournals application database does not store that password. The service records whether an account has completed adult setup and whether its access is active or suspended. Adult setup is a declaration, not an independent identity or age check.

Organisation information: the organisation name and country you provide or select; your connection to it; your membership role and status; and organisation requests and decisions. An organisation request also records the requesting account, the proposed administrator’s email address, the request time and, when approved, the reviewer and review time. If someone proposes you as an administrator, we obtain that email address from the person making the request. It does not itself give you administrator access.

Contribution information: the project, title, description and relevant project details, such as an item count or age-group description; your private account identifier; the organisation; each saved revision; submission confirmations and their time and rules version; review records; publication status; and withdrawal information. Please describe activities without identifying individual people.

Security and support information: a per-account request counter and time window used to limit excessive requests; information you send to our support or privacy contacts; and technical information processed by our website, authentication and hosting providers, such as IP addresses, device/browser information and service logs. The exact website technologies and any optional analytics are described in our Cookie and website technology information.

3. Why we use information and our legal grounds

Providing the account and contribution services you request: we use the account identifier, email authentication, verification status, adult setup, your requested organisation connection, your text contributions and their status to provide and administer the free service under the Terms of use. Our ground is performance of our agreement with you, including steps you ask us to take before that agreement, under GDPR Article 6(1)(b). This covers information objectively needed for the requested service; accepting the Terms is not a general privacy consent.

Checking organisational authority and protecting access: we use nominated-administrator details, membership and review records, account-safety information and proportionate security information to prevent false organisational claims, restrict private access and investigate misuse. Our ground is legitimate interests under Article 6(1)(f): protecting the accounts, organisations and people using Joournals and maintaining reliable approval records. We consider the effect on individuals and limit access and information to what those purposes require. You may object to processing based on legitimate interests.

Handling privacy rights: we use the information needed to verify and answer a rights request to comply with our obligations under GDPR Articles 12–22, relying on Article 6(1)(c). Where a specific law requires another disclosure or retention, we use Article 6(1)(c) only to the extent that law applies.

Optional analytics or marketing are separate purposes. They are not necessary to obtain a free account and are not covered by the contractual ground above. Any such processing needs its own information and applicable choice or other lawful ground.

4. Who can receive information

Organisation membership reviewers receive pending membership information for the organisation they are authorised to review, including the verified email address where available. Joournals platform reviewers receive organisation requests and the proposed administrator address. Authorised organisation and Joournals reviewers see submitted text and the information needed for their review. Support and privacy handlers receive the information needed to address a request.

Approved organisation names and countries are available in the organisation directory to verified account holders. A published text contribution is available to anyone, with the organisation name and country. The public contribution response does not include account email addresses, private author identifiers or reviewer records. Text itself becomes public, so do not put personal details in it. A third party may copy public material; withdrawal cannot guarantee removal of copies outside our control.

We use Memberstack for authentication, Supabase for the private application database and service, and Framer to serve the website. These suppliers and their authorised service providers process information required for the relevant service. Their own customer-account and business operations may involve separate processing described in their notices.

We may disclose information where a specific legal obligation requires it or where necessary and lawful to address a particular security incident or legal claim. This does not give organisations general access to other organisations’ private data.

5. Processing locations and international transfers

Memberstack publicly states that its service is hosted on AWS in the United States. Our current Supabase primary project database is in Frankfurt, Germany. A database region does not locate every processing activity: support, operations, logs and other supplier infrastructure can involve processing elsewhere. Framer also describes possible transfers outside the European Economic Area. We do not promise that all processing stays in the EU or EEA.

The suppliers’ published data-processing terms describe safeguards for relevant international transfers, including standard contractual clauses and, where applicable to the recipient, adequacy decisions. Ask privacy@joournals.com for information about the safeguards applicable to our service and how to obtain a copy. Our Cookie and website technology information identifies the additional services actually used on the website.

6. How long information is kept

We keep account and membership information while it is needed to provide your account and current organisation access. When an account is closed or a connection ends, we assess what can be deleted and whether a limited record is still needed for a particular unresolved access, security or legal issue. We do not treat an ended connection as permission to keep all account information indefinitely.

Pending organisation and membership requests are needed while the request is being considered. When a request is decided, withdrawn or no longer being pursued, retention depends on whether a limited decision record is still needed to explain current access or address a particular dispute.

Drafts and revisions are kept while needed for your ongoing contribution and its review. Published contributions remain public until withdrawn or removed. Withdrawal removes the contribution from the Joournals public response; it does not by itself erase private revisions, confirmations or review records. Those records are assessed separately for the continuing review, security or legal purpose that justifies keeping them.

Technical logs and recovery backups have separate retention arrangements. Deletion from the active service does not necessarily mean immediate removal from a recovery backup. Contact privacy@joournals.com for the retention information applicable to your records and any remaining restrictions on their deletion.

7. Your choices and rights

You may ask for access to your personal data, correction, deletion, restriction of processing and, where applicable, a portable copy. You may object to processing based on legitimate interests. If a separate activity relies on consent, you may withdraw that consent without affecting earlier lawful processing. These rights depend on the applicable legal conditions; a refusal must be explained.

Email privacy@joournals.com. We may ask for proportionate information to confirm that a request concerns you. Do not send passwords, identity tokens, confidential school records or identity documents unless a secure and necessary verification method has been agreed. A request to close an account can be made by email; signing out alone does not close it.

We respond without undue delay and normally within one month of receiving a rights request. Where GDPR permits an extension for complexity or number of requests, we explain the reason and extension within that first month. If we cannot act on your request, we explain why and how you may complain.

You may complain to the Norwegian Data Protection Authority, Datatilsynet, or another competent supervisory authority, including where you live or work. Information: https://www.datatilsynet.no/en/about-us/contact-us/how-to-complain-to-the-norwegian-dpa/

Email authentication and verification are needed for private account access. Organisation and membership information is needed for the connection you request. You can choose not to submit a public text contribution. We use automated verification and access checks, but the organisation/membership approvals and contribution publication reviews described here are human decisions. If you believe a check or decision is wrong, contact hello@joournals.com.

8. Changes to this notice

We will update this notice when these services or their processing change. A materially new purpose or optional feature will receive the information and choices it requires before that processing begins. The version and publication date will be shown on the published notice.