This policy explains what personal data Journey Lanes processes, why, and what your rights are. It applies to this website, the Journey Lanes app and the emails it sends.
Who is responsible
Developerlab runs this installation of Journey Lanes and is the controller for the personal data of its own customers and visitors: accounts, organizations, billing and support.
Developerlab
Netherlands
Chamber of Commerce 70454140
VAT NL002323188B22
Email: privacy@journeylanes.com
For what you bring into Journey Lanes yourself, such as your repositories, flows and the replies of your own systems during a run, your organization is the controller and Journey Lanes is its processor. The data processing agreement covers that part.
What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: name, email address, password (only as an argon2id hash), role, last sign-in | To give you an account and sign you in | Contract | Until the account is deleted. A sign-up that is never confirmed is deleted after 14 days. Someone invited to an organization who never sets a password stays listed there until an owner removes them. |
| Sessions: a random token (only its SHA-256 is stored), when it started and was last used, whether it came from a password or single sign-on, your browser’s family (such as “Firefox”) and your network (as in the request log), so you can see where you’re signed in (account menu → Your data) | To keep you signed in | Contract | 14 days after the last use and at most 30 days after signing in; immediately when you sign out or change your password |
| Sign-in codes: the code we email after the right password, stored only as a keyed hash, with how often it was tried | To check that whoever signs in also has your email (two-step sign-in) | Contract, and our legitimate interest in keeping accounts safe | 10 minutes, or until it’s used |
| Authenticator app, when you set one up: its key (encrypted), when you set it up, the time step of the last code used (so a code works once), and 10 recovery codes (only their hashes, and whether they were used) | A second sign-in step you chose instead of the email code | Contract, and our legitimate interest in keeping accounts safe | Until you turn it off or your account is deleted |
| Trusted browsers: a random token (only its hash), the browser’s family (such as “Safari”) and when it was trusted and last used | To skip the sign-in code in a browser you chose to trust | Contract | 30 days; earlier when you forget them, change or reset your password, or ask to delete your account |
| A device cookie in your browser: a random id with a signature tied to your account (nothing is stored on our side) | So that when signing in to your account is paused after too many wrong passwords (someone guessing it), you can still sign in from a browser you used before | Legitimate interest (security) | 1 year after you last signed in with that browser; it stays when you sign out. You can delete it in your browser |
| One-time links for invitations, sign-up and password reset (only their SHA-256 is stored) | To confirm it’s you | Contract | They work for 1 hour (password reset), 1 day (sign-up) or 7 days (invitation), and are deleted a day after they were used or expired |
| Organizations, memberships and roles; projects and who is in them | To decide who sees and does what | Contract | Until removed |
| Code host connections an owner or admin makes: the GitHub, GitLab or Bitbucket account name, who connected it and when, GitHub’s installation id, and GitLab’s and Bitbucket’s access tokens (encrypted). GitHub’s tokens are made when code is read and are never stored. | To read the repositories your projects pick from the connection | Contract | Until it’s disconnected or the organization is deleted |
| Invitations to an organization or project: the address it was sent to, the role, and who sent it. The organization sees only that address until you accept. | To let you decide whether to join | Legitimate interest (the organization inviting you), your choice to accept | Until you accept or decline, it is withdrawn, or 30 days have passed |
| Single sign-on an organization owner sets up: its email domains and their DNS check results, the identity provider's addresses, client id and certificate, the client secret (encrypted), how groups map to roles, which owners may still sign in with a password, for each member when they last signed in through it and who they are at the identity provider (its issuer or entity and their subject id), and the ids of SAML answers already used. During a sign-in through it: a random state, nonce and PKCE verifier (the verifier encrypted, the rest only as hashes) | To sign in the organization's people through their own identity provider, and to show owners who stopped using it | Contract with the organization, and our legitimate interest in keeping accounts safe | Settings until an owner removes them or the organization is deleted; a sign-in in progress 10 minutes; used SAML answer ids until they expire. Changes to it, and sign-ins through it, are in the audit log, kept as long as that |
| IP address and email address of sign-in, sign-up and password reset attempts, and the IP address of payment notifications | To limit attempts and protect accounts against guessing | Legitimate interest (security) | Counters expire within an hour |
| Billing details: name, invoice email, address, country, VAT number or tax ID | To charge the right VAT and make out invoices | Contract; legal obligation | As long as the organization exists |
| Why an organization cancelled, when an owner chooses to say: one of a few fixed reasons and an optional short note, with the date | To improve the product | Your choice to tell us (legitimate interest) | As long as the organization exists |
| Payments and invoices: amounts, dates, plan, the price the subscription was bought at, the billing details at the time of payment, Mollie’s payment and customer references. Invoices and credit notes are emailed to the invoice email and, where the operator set one up, copied to its bookkeeping address. Owners also get emails about the plan: before a free trial ends, before a card on file expires, about a price change 30 days ahead, and when a VAT number can no longer be confirmed. A corrected invoice is a new invoice with a credit note for the old one; the old one is kept as issued. The payment method on file (such as “Visa •••• 4242”) is shown from Mollie when you open Billing and invoices; Journey Lanes doesn’t store it. | To run the subscription and keep the accounts | Contract; legal obligation (tax) | Invoices and credit notes 7 years after the end of the year they were issued in, as Dutch tax law requires; they stay that long even after the organization is deleted. An invoice stays as long as a credit note for it does. Payments go with their invoice, and payments that were never paid after the same 7 years, or with the organization. |
| Flow requests: the journeys you ask us to build, your stack, the project and date you choose, and our quote and your answer to it | To quote and deliver the work you ask for | Contract (steps before entering into it) | As long as the organization exists; deleted with it. If you delete your account, the request stays with the organization without your name. |
| Feedback and requests you send from the app, optionally with what you had open (project and flow names and ids, the view and the page address) | To answer you and improve the product | Legitimate interest | 2 years after it was last updated. If you delete your account before then, the message stays without your name. |
| Support conversations: what you ask under Help and support in the app, or through the contact form on this website (then with the name and email address you give), our answers, and a screenshot or a link to a project, flow or run only when you add one (names and ids, no data from it) | To answer you and handle your request | Contract, when it’s about your account or subscription; legitimate interest otherwise | 2 years after the conversation was closed or last updated. If you delete your account before then, it stays without your name. |
| Email you send us (to support, privacy, billing or sales, or a reply to one of our emails): your address, name and what you write, with any attachments | To answer you and handle your request | Contract, when it’s about your account or subscription; legitimate interest otherwise | 2 years after the conversation ends, unless it’s needed longer for an invoice, a dispute or a legal obligation |
| Error reports: the error message and where in the code it happened, from our servers. Email addresses in error messages are replaced before the report is sent. | To find and fix errors | Legitimate interest (a working service) | At most 90 days at Sentry |
| Server logs: what the server reports while it works, such as errors and the ids of organizations whose payments or runs it handled | To keep the service running and secure, and to investigate incidents | Legitimate interest (security) | They rotate with the containers and aren’t archived |
| Request log: for each request to the app’s API, when, which kind of request (the route, not what it contained), the answer’s status and time, your account, the organization or project it was for, your network (your IP address cut to its first three parts, or the first 48 bits for IPv6) and your browser’s family (such as “Firefox”) | To investigate incidents and abuse, such as a misused account or a security breach we must report | Legitimate interest (security) | 30 days; included when you download your data |
| Audit log: changes that matter for security and administration (people invited, removed or given another role; projects, environments, API tokens, alert channels, code host connections and relay agents created, changed or deleted; plan and billing changes; signing in, wrong sign-in codes and trusted browsers), with who made them, when, your network (as in the request log) and your browser’s family. For changed settings it says which fields changed and, for plain settings, from what to what; for passwords, keys and tokens only that they changed, never their values | So an organization’s owners and admins can see who changed what, and to investigate incidents | Legitimate interest (security, accountability) | 1 year, or longer on a plan that says so. An organization’s owners and admins see its entries, and your sign-ins while you’re in it; the people who run this installation see their own actions and sign-ins. Your own entries are included when you download your data; they stay, with your email address as written then, until the period ends, also after your account is deleted. |
| Product statistics: when you signed up yourself, when your organization started a free trial and its first monitored flow, and for each request to the AI model only the number of tokens it used (never what was asked or answered). The people who run this installation see them as totals and per organization; nothing is sent to an analytics service. | To see how the product is used and what it costs, and improve it | Legitimate interest | 13 months; your account’s link to them goes when the account is deleted |
| Database backups, when the operator makes them | To restore the service after a failure | Legitimate interest | Encrypted, and kept at most 30 days; what you delete disappears from them when they expire |
We don’t sell personal data, show advertising, or use tracking or analytics tools. Journey Lanes doesn’t make decisions about you by automated means that have legal or similarly significant effects.
Our emails contain no tracking pixels of our own. Sendinblue SAS (Brevo), France does record, for every email it delivers, whether it was delivered and opened and which links were clicked, and sends links through its own address to do so. It uses that to deliver mail and to stop abuse of its service, and this can’t be switched off on its side. We don’t use that information.
What you bring in
When you use Journey Lanes, it processes data on behalf of your organization: repositories you connect (their contents are read; what’s kept is what was found in them, such as endpoints and roles, not the files, except flow files in a .journeylanes/flows/ folder, which become flows), flows, credentials of test accounts for your environments, and what your systems answer during runs, audits and load tests. Some of that can be personal data of your own users. How it’s protected:
- Passwords, keys, tokens and two-factor secrets (not usernames) are stored encrypted (AES-GCM) and never sent back to the browser. Sign-in tokens to your environments stay in server memory only and are never stored.
- On live environments, run history keeps only the shape of each reply (field names and types) unless a project owner turns on full replies for that environment; those are then masked: email addresses keep only their domain, and fields such as IBAN, salary, address, phone, citizen service number, keys, tokens and sessions are hidden, also inside lists and in query strings. Other fields, such as names, stay readable. Of the headers, only harmless ones such as the content type are kept: never cookies or credentials.
- Live runs and audits are deleted after the environment’s retention: 30 days unless the project owner sets another period (1 to 365 days). Other run history is kept for 90 days. For a monitored flow, passing runs beyond its newest 2,000, and passing runs older than 7 days that changed nothing, are kept only as a count per hour (how many ran and how long they took), so the runs themselves go sooner; failures and the first pass after a failure stay in full; load tests, audits on the mock, alert history and deploy checks for 180 days at most. Deleting a flow, project or organization deletes its history at once.
Who receives it
| Recipient | What for | Role |
|---|---|---|
| Hetzner Online GmbH, Germany | Runs the servers and the database. All data on this page is stored there, in the European Union unless stated otherwise. | Processor |
| Sendinblue SAS (Brevo), France | Delivers the emails Journey Lanes sends: invitations, sign-in links, invoices, alerts. | Processor |
| Your Hosting B.V. (PCextreme), the Netherlands | Receives the email you send us (support, privacy, billing, sales, or a reply to one of our emails) and forwards it to the operator’s own mailbox. | Processor |
| Mollie B.V., the Netherlands | Handles payments and subscriptions. We give Mollie the billing name and email and an internal organization id, to create a customer record; card and bank details are entered in Mollie’s own fields (in the checkout, loaded from js.mollie.com) or on Mollie’s payment page, and never reach Journey Lanes. The customer record is deleted when the organization is. | Payment service provider: independent controller for the payments themselves, under its own legal obligations |
| European Commission (VIES) | Checks an EU VAT number you enter, so the right VAT is charged. | Recipient (public service) |
| Anthropic PBC, United States | Only when you use these features. Drawing a flow from a description sends the description and a summary of the scanned repositories (endpoints, entity and field names, roles, page names). “Help me” sends the step (its path, body and checks), the steps before it, and the source files behind that endpoint. “Explain this failure” sends that step’s result as run history keeps it, the steps before it, the environment’s sign-in type and the source files behind the endpoint, with anything that looks like a credential masked. Anthropic doesn’t use API data to train its models. | Processor (transfer outside the EEA, see below) |
| Functional Software, Inc. (Sentry), United States | Error reports: when something goes wrong in the app or on our servers, the error message and where in the code it happened, so we can fix it. No cookies, request contents, account details or IP addresses are kept with them; an error message can contain names you gave things, such as a project or flow. | Processor (transfer outside the EEA, see below) |
| GitHub, Inc. (United States), GitLab Inc. (United States) or Atlassian (Bitbucket), or your own GitLab or Bitbucket server; or the address of an OpenAPI document | Only the service you connect: Journey Lanes reads a repository with the token you give or through your organization’s connection (read-only), or fetches the OpenAPI document you point it at, to find endpoints, roles and pages. | Service you choose to connect |
Platform administrators of this installation can see accounts, organizations, plans and usage, feedback, support conversations and flow requests with who sent them, but not the contents of projects: they get no access to flows, runs or environments unless an organization invites them.
Outside the European Economic Area
Recipients outside the European Economic Area are named in the table above. Transfers to them rely on the EU-U.S. Data Privacy Framework where the company is certified, and on the European Commission’s standard contractual clauses otherwise.
Security
How accounts, credentials and run history are protected is described on the security page. If a personal data breach occurs, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, unless it is unlikely to put anyone at risk, and we tell you without undue delay if it is likely to put you at high risk.
Your rights
Under the GDPR you can ask to see your personal data, have it corrected or deleted, receive it in a portable form, restrict its processing, or object to processing based on legitimate interest. In the app you can:
- change your name (account menu → Your data) and your password (account menu → Change password);
- download your account data as JSON (account menu → Your data): your account, organizations, projects, sessions, feedback, your support conversations and the flow requests you sent. Owners download invoices under Billing and invoices;
- delete your account (account menu → Your data). Deletion waits 30 days, so you can change your mind: until then you can sign in and keep your account. Subscriptions of organizations only you own stop at once, and the other people in those organizations get an email, so they can ask you to make them owner. On the day, payments still being processed are settled first; then your account, sessions and memberships are deleted, and the organizations only you own go too, with their projects, connected repositories and the access tokens stored for them. What stays: feedback you sent (without your name, the text as written), invoices and the billing details on them (for tax law), and backups until they expire. Mollie keeps payment records as its own legal obligations require.
For anything else, write to privacy@journeylanes.com. We answer within one month. You can also complain to the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority, or the authority where you live.
Changes
When this policy changes, the date at the top changes too. We tell account holders by email about changes that matter to them before they apply.