This policy explains what Juna Dev ("we", "us") collects about you, why, how long we keep it, and the choices you have. It covers this website, the services we provide to clients, and the messaging channels we operate on their behalf, including Facebook Pages, Instagram and WhatsApp through Meta's platforms.
Questions about any of it go to hello@junadev.com.
Junadev (Private) Limited, trading as Juna Dev, is a company limited by shares incorporated in Pakistan under the Companies Act 2017 (SECP corporate unique identification number 0279495; National Tax Number F803530-1). Registered office: Plot No 1939/55 VII, Baghdad-ul-Jadid Road, Anwarabad Colony, Bahawalpur, Punjab, Pakistan. Domain: junadev.com.
We build and run CRM, monitoring, DevOps and AI automation for businesses. For this website we are the data controller. Where we process messages and contact details for a client's business, we do so on that client's instructions and they are the controller; this policy describes what happens to the data either way.
Our lawful bases are the contract or enquiry you are party to, your consent where we ask for it, and our legitimate interest in running a reliable service.
We use a small number of providers to run our service: cloud hosting, an email delivery provider, a telephony provider for SMS and calls, and AI model providers that generate suggested replies. Each processes data only on our instructions and only to provide that service. Message content sent to an AI provider is used to produce the reply and is not used to train their models under our agreements.
Where you contact a business through Meta's platforms, Meta also processes that data under its own privacy policy. We do not sell personal data to anyone.
Our servers are in the United Kingdom, operated by Contabo GmbH. Some of the providers behind the service process data elsewhere: Meta for the messaging platforms, and the AI model providers that generate suggested replies.
Juna Dev is established in Pakistan, so our own staff access data from outside the UK and the EEA. Where personal data moves between the EEA, the United Kingdom and Pakistan, the transfer relies on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved, and on each provider's own published transfer terms. Ask us and we will send you the clauses that apply to you.
Conversation and contact records are kept for as long as the business you contacted has a relationship with you, and then for up to 24 months so that a returning enquiry is recognised, unless you ask us to delete them sooner. Website analytics are kept for 13 months. Backups are kept for 30 days.
Traffic to and from the platform is encrypted in transit with TLS. Credentials, channel access tokens and other secrets are encrypted with a separate key rather than stored as readable text. Access is granted per person and per role rather than per team, and privileged actions are written to an append-only audit log that cannot be edited or deleted from inside the application. Backups are taken nightly, kept for 30 days, and restores are tested rather than assumed.
These are the measures we consider appropriate under Article 32 of the GDPR for the data we hold. They are reviewed when what we process changes, and we will tell a client before a change reduces them.
If a breach puts personal data at risk, we notify the relevant supervisory authority within 72 hours of becoming aware of it, and we tell the people affected without undue delay where the risk to them is high. Where we are processing on a client's behalf, we notify that client immediately so they can meet their own obligation. We keep a record of every breach, including the ones that did not require notification.
You can ask us to delete everything we hold about you at any time. Either:
We will confirm within 7 days and complete the deletion within 30 days, including from our messaging records and from the business's CRM. Data held by Meta itself is deleted through your Facebook or Instagram settings, which also let you remove any app's access to your account.
If you are in the UK or the European Economic Area, the UK GDPR and the GDPR give you the right to:
Write to hello@junadev.com. We answer within one month, and tell you if we need longer because the request is complex. There is no charge. We may ask you to confirm who you are before we act.
You can also complain to your own data protection authority, or to the Information Commissioner's Office in the UK, without coming to us first.
An AI assistant may write the first reply in a conversation, and our software may score or categorise an enquiry to route it to the right person. Neither produces a decision with a legal or similarly significant effect on you, and neither is the last word: ask for a person and you get one. If you would like to know how a particular enquiry was categorised, ask and we will tell you.
We are not a HIPAA covered entity and we do not hold ourselves out as HIPAA compliant. We do not ask for health information and the platform is not designed to store it. Where a client in the United States needs us to handle protected health information, we do so only under a signed Business Associate Agreement setting out the required safeguards, and only for that client.
Under the GDPR, health data is a special category and we do not process it without an explicit lawful basis agreed with the client in writing beforehand. Please do not send medical details through a public messaging channel.
This site sets only what it needs to work: a session cookie if you log in, and a first-party analytics identifier that is not shared with anyone else. No advertising cookies.
Our services are for businesses and are not directed at anyone under 16. We delete any such data as soon as we learn of it.
This policy is governed by the laws of Pakistan. Where we act for a client in another country, that country's data protection rules also apply to their data, and we follow whichever is stricter.
When this policy changes, the date at the top changes with it. Material changes are announced on this page before they take effect.