1. Controller and scope
The controller is JAPAP MESSENGER TECHNOLOGY LTD, at the address above. Processing is subject to the UK GDPR and the Data Protection Act 2018 and, for people located in the European Economic Area, Regulation (EU) 2016/679 (GDPR), as well as other applicable laws.
This policy describes the processing of personal data through the JAPAP Messenger application and https://japapmessenger.com, for the features available according to your country and the service configuration.
2. Data we process
Depending on the features you use, we process:
- Account and profile: first name, last name, username, email address, phone number, profile and cover photos, biography, date of birth and gender if you provide them, optional professional information, language and preferences.
- Location: the country and city in your profile. If you use “Use my location”, your device provides an approximate position that the device geocoding service converts into a city and country; only the city and country are saved. The country derived from your IP address is used to suggest the default language and currency and for security.
- Communications and content: messages, attachments, voice messages and their transcription, posts, comments, Reels, videos, interactions and technical information needed for calls. When a participant starts recording a call (a feature offered depending on the service configuration), the recording, its transcript and its summary are stored.
- Contacts: phone numbers from your address book are sent to find JAPAP members only if you start synchronisation and grant the permission. They are matched in memory and are not stored.
- Services and Pages: requests, proposals, projects, deliverables, documents, team roles, reviews and professional information you provide.
- Wallet and financial operations: balances, reserved funds, transactions, wallet addresses, payment references and information needed for the available operations.
- Games: scores, results and rewards of the free games (Wheel, Tap, solo Quiz, Daily Challenge), and the history of past entries, kept with the financial records.
- Verification: identity details, supporting documents and photographs (including a selfie) submitted for personal or organisational verification.
- Technical and security data: IP address, device, browser and app information, sessions, notification tokens, diagnostics and errors, usage events, sign-in attempts and security logs.
- Support: requests, communications with support, including the automated assistant, and attachments.
3. Visibility
Information you publish may be visible according to the audience and privacy settings you choose (public or private profile, post visibility). Your email address, phone number and identity documents are not shown on your public profile.
4. Purposes and legal grounds
We use this data to:
- provide the service, manage accounts and deliver communications — performance of the contract;
- process requested financial operations and keep accounting records — performance of the contract and legal obligation;
- verify identity, prevent fraud and abuse, and secure access — legal obligation and legitimate interests;
- rank content, deliver advertising campaigns and measure their performance — legitimate interests, or consent where the law requires it;
- provide support and improve the platform — performance of the contract and legitimate interests;
- send marketing emails — consent, which you can withdraw at any time through the unsubscribe link or in your settings.
5. Features using artificial intelligence
Some features send the necessary data to AI model providers (OpenAI, Anthropic, Google Gemini) through the Emergent platform that hosts the service:
- translation of a message when you request it; transcription and summary of voice messages;
- transcription and summary of recorded calls;
- pre-screening of identity verification documents: it flags anomalies to the verification team, but the decision is always made by an authorised person;
- the support assistant; AI photo filters when you apply them;
- writing and targeting assistance for advertisers’ campaigns; generation of quiz questions, without personal data.
6. Permissions and choices
The app asks, only when you use the relevant feature, for: the camera and microphone (calls, photos, videos, voice messages, identity verification), contacts (optional synchronisation), the photos and media you select, approximate location (to fill in your city) and notifications.
You can refuse or withdraw these permissions in your device settings; the relevant features then become unavailable. The app does not request background location.
7. Recipients and service providers
Data may be disclosed to:
- users and recipients you select;
- our technical providers: Emergent (application hosting), Neon (PostgreSQL database), Cloudflare (R2 media storage, Stream video, Turnstile bot protection), Resend (email), Google Firebase Cloud Messaging (Android notifications), OneSignal (web notifications), Agora and LiveKit (audio and video calls, recording);
- the AI providers listed in section 5;
- payment providers when you use them: NOWPayments (cryptocurrency and, through Banxa, card payment) and the payment operators offered in your country (Orange Money, MTN MoMo, Wave, Paystack; Hubtel when enabled);
- authorised JAPAP personnel for verification, moderation, security, accounting and support;
- authorities or other recipients where required by law or a valid request.
8. Independent providers, blockchain and no sale
A payment provider may act as an independent controller for its own processing (for example its own checks), in which case its privacy policy applies. Transactions recorded on a public blockchain and the related addresses may remain accessible independently of JAPAP and cannot be erased by JAPAP.
We do not sell or rent your personal data.
9. Advertising and measurement
Sponsored content is labelled as such. Campaigns are delivered by JAPAP, without third-party ad networks. Targeting uses the settings chosen by the advertiser, such as country and age range (calculated from your date of birth if you provided it), and interactions with ads for measurement and frequency limits. Advertisers receive aggregated statistics, not your contact details.
The contents of your contacts, private messages, camera or microphone are not used for advertising. Any new use requiring separate notice or consent will be presented to you before it takes place.
10. Retention
We keep data for the life of the account and as long as necessary for the stated purposes and applicable obligations. After an account is finally deleted, only the following categories are kept, under the account’s internal identifier, with restricted access:
- financial operations and transactions: 10 years (accounting obligations); at the end of that period, contact details linked to the operations are erased and the amounts remain in the accounting ledger;
- identity verification (KYC) data: 5 years after the end of the relationship (anti-money laundering);
- moderation decisions, sanctions and support requests related to the deletion: 1 year;
- security and fraud detection logs: 365 days;
- marketing data: until consent is withdrawn or the account is deleted.
11. Internal identifier and backups
Data kept under an internal identifier remains personal data where it can be linked to a person. At the end of the period, it is erased automatically or irreversibly anonymised.
Database backups, managed by our hosting provider, are used only for disaster recovery and expire according to their rotation cycle.
12. Account deletion
You can request deletion: in the app or on the website (Profile → Settings → My account → Delete my account); at https://japapmessenger.com/delete-account, without the app; or through support if you no longer have access to your email address.
We verify that the request comes from the account holder: a code sent by email is required and, in the app or where funds are involved, the account password if the account has one.
JAPAP currently provides a 30-day cancellation period; the applicable date is displayed when you submit the request. Signing in does not cancel the request: cancellation requires an explicit action before final deletion.
The request is recorded even if funds or commitments remain. Completion is then deferred while a balance, position, pending operation or administration responsibility must be settled. The reason, the steps and the support option are explained. Deletion does not confiscate any funds and does not trigger any automatic transfer.
On completion, the profile and the relevant personal data are deleted and sessions are closed. The content of sent messages is replaced with a deletion notice (“Message supprimé”). Copies already received, saved or exported by other people may remain outside our control. The retention described in section 10 continues to apply.
13. Security
We implement appropriate technical and organisational measures: encryption of network communications (HTTPS/TLS), passwords and codes stored in hashed form, access control and two-factor authentication for administration, attempt limits and bot protection, access logging and restriction of sensitive data to authorised personnel.
No system guarantees absolute security. JAPAP communications are not end-to-end encrypted. In the event of a data breach presenting a risk, we notify the competent authority within 72 hours and inform the people concerned where the law requires it.
14. International transfers
Our providers may process data in other countries, including the United States and the European Union. Where required by law, these transfers are covered by appropriate safeguards, such as standard contractual clauses or the UK International Data Transfer Addendum. You may contact us for information about the safeguards that apply.
15. Cookies and local storage
The website uses essential cookies and local storage: session, security, bot protection and preferences (language). We do not use advertising cookies or third-party audience measurement tools.
16. Your rights
Depending on your circumstances and applicable law, you may request access, rectification, erasure, restriction or portability of your data, object to certain processing, including direct marketing, or withdraw consent without affecting earlier processing.
Write to contact@japapmessenger.com. Proportionate identity verification may be required. We reply within one month, which may be extended where the law allows. You may also complain to the Information Commissioner’s Office in the United Kingdom (https://ico.org.uk) or to the data protection authority of your country of residence.
17. Children
The service is not intended for people under 18. If you believe a minor is using the service, please contact us: the account will be reviewed and, where appropriate, deleted.
18. Changes
We may update this policy. The published version displays its revision date. Significant changes are communicated appropriately and, where required, fresh consent is requested.
