Privacy policy for the cjis.io service

Who is responsible for your data

The controller of personal data processed through cjis.io is the administrator of the cjis.io service. You can reach us about any privacy matter at [email protected].

What data we process

We process only the data needed to provide the service.

Account data: your email address and a hash of your password, never the password itself
Readiness answers: the answers you give in the readiness check and the score calculated from them
Compliance records: controls, tasks, policies, personnel register entries such as names, roles, access levels and training and background check dates that you enter
Evidence files: documents and screenshots you upload, which must not contain criminal justice information
Billing data: plan, billing period and payment status, while card details are handled by our payment processor and never reach us
Usage logs: IP address, browser type, pages requested, time of requests and security events

Cjis is not designed to store criminal justice information (CJI). Do not upload or enter CJI. If we find CJI, we may remove it.

Why we process data and on what basis

To create and run your account and workspace, and to send sign-in codes and service emails, because it is necessary to perform our contract with you
To process payments, issue invoices and keep accounting records, because of our contract with you and our legal obligations
To keep the service secure, prevent abuse and fix errors, based on our legitimate interest in a safe and working service
To answer messages you send to [email protected], based on our legitimate interest or on steps you ask us to take before a contract
To comply with legal requests and protect our rights, based on legal obligations and our legitimate interest

For visitors and users in the European Union and the European Economic Area, the legal bases are Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) GDPR for legal obligations and Article 6(1)(f) GDPR for legitimate interests. Where we rely on legitimate interests, you can object, as described below.

Who receives data

We do not sell personal data and we do not share it for advertising. We share data only with service providers that process it on our behalf and under our instructions, in these categories:

A hosting provider in the United States that stores the service and its data
A payment processor that handles card payments and subscription billing
An email delivery provider that sends sign-in codes and service emails

We may also disclose data when the law requires it or to protect the rights and safety of users and the service. Data of users from outside the United States is transferred to the United States, and for EU and EEA users such transfers rely on appropriate safeguards such as standard contractual clauses.

How long we keep data

Account data and workspace content: for as long as your account is active, and up to 90 days after it closes so you can export it, unless you ask for earlier deletion
Readiness answers from a check without an account: in your browser session only, and with your account once you sign up
Billing and invoice records: as long as tax and accounting laws require
Usage and security logs: for a limited period needed for security and troubleshooting, then deleted or anonymized
Messages to [email protected]: as long as needed to handle the matter and any follow-up

Your rights

Depending on where you live, you have the right to access your data, to correct it, to delete it, to restrict or object to processing, to data portability and to withdraw consent where processing is based on consent. You can export your workspace data at any time from your account. To exercise any right, email [email protected] from the address on your account. We answer within the time the law requires. In the EU and EEA you can also lodge a complaint with your local data protection authority, and in the United States you may have additional rights under the law of your state.

Cookies

cjis.io sets only strictly necessary cookies.

A session cookie that keeps you signed in
A CSRF cookie that protects forms against forged requests
A preferences cookie that remembers settings such as the monthly or yearly price view

We do not use advertising cookies, ad pixels or cross-site tracking. Because we use only strictly necessary cookies, we do not show a cookie banner.

How we protect data

Data is hosted in the United States, encrypted in transit and at rest, and access is limited to people who need it to run the service. More detail is on our security page.

Children

The service is meant for organizations and their staff. It is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us data, email [email protected] and we delete it.

Changes to this policy

We may update this policy when the service or the law changes. We post the new version on this page with a new date, and for material changes we also notify account holders by email before they take effect. See also our terms of service.