Privacy

Who we are

jtakeit is the panel your website is edited in and the hosting that serves it. Your website itself was built by a developer or a studio, and they remain the people who change how it is built. Write to us at hello@jtakeit.com.

jtakeit is operated by Brumy GmbH, c/o ExpertFid & Audit AG, Zweigniederlassung Zürich, Strehlgasse 2, 8001 Zürich, Switzerland, which is responsible for what this page describes. The rest of what the law asks us to say about the company is on the legal notice.

Signing in

There are two ways in: with Google, or with a link we email you.

With Google, Google tells us these things, and only these:

• your name;
• your email address, and whether Google has confirmed it is yours;
• the number Google uses for your account — not your address, a number.

We are not given your mail, your files, your contacts or your calendar, and we cannot send anything as you. The permissions asked for are the three Google calls openid, email and profile, and Google shows you exactly them on the screen before you agree. The number is what we recognise you by, because an address can be reassigned to somebody else and a number cannot.

With an email link, we keep your address and a fingerprint of the link — never the link itself — so that it can be checked when you open it. The link works for fifteen minutes and once.

What else we keep about you

• Your account: your name and email address, the language you use the panel in, when the account was made and when you last signed in.
• A record of sign-in attempts. The time, the IP address the attempt came from, the account or address it was for, and whether it worked. It is what stops somebody guessing their way into your website, and it is deleted after fourteen days.
• A cookie in your browser, so that you are not asked to sign in on every page. It lasts two weeks, it cannot be read by anything running on a page, and signing out removes it. While you sign in with Google a second cookie lives for ten minutes, to check that Google's answer belongs to the request you started.
• A record of what was changed and by whom — which is there so that when two people look after one website, both can see what happened. It stays with the website's history.
• No cookie on this website, jtakeit.com. The language you read it in travels to the panel in the address of the link you follow, so the panel can open in it.

What you put in yourself

The words, the photographs and the prices of your website, and anybody you invited to help with it. That is the point of the panel, and it is kept for as long as your website is with us.

If you pay us, you pay on Stripe's own page, which asks for your billing address and, if you have one, a tax number. We are told whether a subscription is paid and never see a card number. A studio that bills its own clients through us gives us each client's name and email address, so the invoice reaches them.

The people who visit your website

This is the part most policies are vague about, so it is the part written most plainly. For what your visitors write to you, we act for you: you decide what is asked for, and we keep it and pass it on. The page your website links them to says the same to them, at jtakeit.com/processing.

• An enquiry from your form — what the form asked for, usually a name, a way to reach them and a message, and which page it was sent from — is sent to you by Telegram, by email or into your panel, whichever you chose. We keep it for ninety days so that nothing is lost if a notification goes astray, then delete it; you can delete it sooner. A test message you send yourself is kept for thirty.
• A booking keeps what the booking form asked for — usually a name, a way to reach them, the service and any note — for three years after the appointment, because it is your record of who came when. Confirmations and reminders go to them by email and, if they chose it, in Telegram. An online payment goes to your own Stripe account, not through ours.
• Visits are counted without identifying anybody. We record which page was opened, which country it was opened from — the country only, never a city — which website sent the visitor, and whether it looks like a person, an AI assistant or a robot. The detail is kept for about three months; daily totals per website stay so you can compare one month with another.
• No cookie is placed on your visitors, and their IP address is not stored.It is used, in passing, to stop one connection sending a form again and again, and the booking form is checked by Cloudflare Turnstile, which sees it for that check. We cannot tell one visitor from another, or the same one twice. That is a limit we accept rather than one we have to explain.

Who else handles any of it

• The developer or studio who built your website, because they look after it and hold the code it is built from. They can see your enquiries and bookings as far as you allow them in the panel.
• DigitalOcean, which runs our servers and the database, in Frankfurt.
• Backblaze, which keeps our encrypted backups, in Amsterdam.
• Cloudflare, which delivers the pages, stores the files and photographs, counts the visits, and runs the check on the booking form.
• GitHub, which holds your website's code and its published content.
• Resend, which sends our emails: sign-in links, enquiries, and booking confirmations and reminders.
• Telegram, only when you or a visitor choose to receive notifications there — new enquiries, bookings and reminders. Signing in with Telegram is not offered.
• Google, at the moment you sign in with it, and not afterwards.
• Stripe, for payments: ours, and your visitors' to you.

Outside Switzerland and the EU. Our servers, database and backups are in the EU. Some of the companies above are in the United States: Cloudflare, Google, Stripe, GitHub, DigitalOcean and Backblaze are certified under the EU–US and Swiss–US Data Privacy Frameworks, and Resend is bound by the standard contractual clauses in its data processing agreement. Telegram is based in the United Arab Emirates, which has no such arrangement; a message goes there only because you or your visitor asked to be told there, and only to deliver that message.

We sell nothing to anybody, there is no advertising, and none of this is used to build a profile of you or of the people who visit your website.

How long things are kept

• Sign-in attempts: fourteen days.
• Your signed-in session: two weeks.
• Enquiries: ninety days; test messages, thirty.
• Bookings: three years after the appointment.
• Visit detail: about three months; daily totals, for as long as the website is with us.
• Your account, your website's content and its history: for as long as the website is with us.

Backups. An encrypted copy of the database is taken every day and kept for thirty-five days, and one a month is kept for four hundred. Something deleted from the database can therefore remain in a backup until that backup is deleted in turn. Backups are there to recover from a failure.

Seeing it and removing it

Your enquiries and bookings can be downloaded from the panel as a spreadsheet at any time, and an enquiry can be deleted there. A booking is kept for its three years; to have one removed sooner, write to us.

To see what we hold about you, or to have your account and what is attached to it removed, write to hello@jtakeit.com. Taking a website off the internet does not by itself delete it — it is kept so that it can come back — so say if you want it deleted for good. The code of your website lives in the repository your developer holds, so ask them about that half — and if they are no longer reachable, ask us.

Changes

If this changes, the date at the top changes with it, and anything that materially affects you is said in the panel rather than only here.