This policy explains what personal data Journey Lanes processes, why, and what your rights are. It applies to this website, the Journey Lanes app and the emails it sends.
Who is responsible
the operator of this installation runs this installation of Journey Lanes and is the controller for the personal data of its own customers and visitors: accounts, organizations, billing and support.
the operator of this installation
Email: info@developerlab.nl
For what you bring into Journey Lanes yourself, such as your repositories, flows and the replies of your own systems during a run, your organization is the controller and Journey Lanes is its processor. The data processing agreement covers that part.
What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: name, email address, password (only as an argon2id hash), role, last sign-in | To give you an account and sign you in | Contract | Until the account is deleted. A sign-up that is never confirmed is deleted after 14 days. Someone invited to an organization who never sets a password stays listed there until an owner removes them. |
| Sessions: a random token (only its SHA-256 is stored), and when it started | To keep you signed in | Contract | 14 days after the last use; immediately when you sign out or change your password |
| One-time links for invitations, sign-up and password reset (only their SHA-256 is stored) | To confirm it’s you | Contract | They work for 1 hour (password reset), 1 day (sign-up) or 7 days (invitation), and are deleted a day after they were used or expired |
| Organizations, memberships and roles; projects and who is in them | To decide who sees and does what | Contract | Until removed |
| IP address and email address of sign-in, sign-up and password reset attempts, and the IP address of payment notifications | To limit attempts and protect accounts against guessing | Legitimate interest (security) | Counters expire within an hour |
| Billing details: name, invoice email, address, country, VAT number or tax ID | To charge the right VAT and make out invoices | Contract; legal obligation | As long as the organization exists |
| Payments and invoices: amounts, dates, plan, the billing details at the time of payment, Mollie’s payment and customer references. The payment method on file (such as “Visa •••• 4242”) is shown from Mollie when you open Billing and invoices; Journey Lanes doesn’t store it. | To run the subscription and keep the accounts | Contract; legal obligation (tax) | Invoices 7 years after the end of the year they were issued in, as Dutch tax law requires; they stay that long even after the organization is deleted |
| Feedback and requests you send from the app, optionally with what you had open (project and flow names and ids, the view and the page address) | To answer you and improve the product | Legitimate interest | 2 years after it was last updated. If you delete your account before then, the message stays without your name. |
| Server logs: what the server reports while it works, such as errors and the ids of organizations whose payments or runs it handled | To keep the service running and secure, and to investigate incidents | Legitimate interest (security) | They rotate with the containers and aren’t archived |
| Database backups, when the operator makes them | To restore the service after a failure | Legitimate interest | Encrypted, and kept at most 30 days; what you delete disappears from them when they expire |
We don’t sell personal data, show advertising, or use tracking or analytics tools. Journey Lanes doesn’t make decisions about you by automated means that have legal or similarly significant effects.
What you bring in
When you use Journey Lanes, it processes data on behalf of your organization: repositories you connect (their contents are read; what’s kept is what was found in them, such as endpoints and roles, not the files), flows, credentials of test accounts for your environments, and what your systems answer during runs, audits and load tests. Some of that can be personal data of your own users. How it’s protected:
- Passwords, keys, tokens and two-factor secrets (not usernames) are stored encrypted (AES-GCM) and never sent back to the browser. Sign-in tokens to your environments stay in server memory only and are never stored.
- On live environments, run history keeps only the shape of each reply (field names and types) unless a project owner turns on full replies for that environment; those are then masked: email addresses keep only their domain, and fields such as IBAN, salary, address, phone, citizen service number, keys, tokens and sessions are hidden, also inside lists and in query strings. Other fields, such as names, stay readable. Of the headers, only harmless ones such as the content type are kept: never cookies or credentials.
- Live runs and audits are deleted after the environment’s retention: 30 days unless the project owner sets another period (1 to 365 days). Other run history, load tests, alert history and deploy checks are kept until you delete them, or the flow, project or organization they belong to.
Who receives it
| Recipient | What for | Role |
|---|---|---|
| The hosting provider of this installation | Runs the servers and the database. All data on this page is stored there, in the European Union unless stated otherwise. | Processor |
| The email provider of this installation | Delivers the emails Journey Lanes sends: invitations, sign-in links, invoices, alerts. | Processor |
| Mollie B.V., the Netherlands | Handles payments and subscriptions. We give Mollie the billing name and email and an internal organization id, to create a customer record; card and bank details are entered in Mollie’s own fields (in the checkout, loaded from js.mollie.com) and never reach Journey Lanes. The customer record is deleted when the organization is. | Payment service provider: independent controller for the payments themselves, under its own legal obligations |
| European Commission (VIES) | Checks an EU VAT number you enter, so the right VAT is charged. | Recipient (public service) |
| GitHub, Inc., United States | Only when you connect a repository: Journey Lanes reads it with the token you give, to find endpoints, roles and pages. | Service you choose to connect |
| jsDelivr (CDN), worldwide | Only the API reference at /docs: its viewer is loaded from there, so opening that page sends your IP address and browser details to jsDelivr. | Content delivery network |
Platform administrators of this installation can see accounts, organizations, plans and usage, and feedback with who sent it, but not the contents of projects: they get no access to flows, runs or environments unless an organization invites them.
Outside the European Economic Area
Recipients outside the European Economic Area are named in the table above. Transfers to them rely on the EU-U.S. Data Privacy Framework where the company is certified, and on the European Commission’s standard contractual clauses otherwise.
Security
How accounts, credentials and run history are protected is described on the security page. If a personal data breach occurs, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, unless it is unlikely to put anyone at risk, and we tell you without undue delay if it is likely to put you at high risk.
Your rights
Under the GDPR you can ask to see your personal data, have it corrected or deleted, receive it in a portable form, restrict its processing, or object to processing based on legitimate interest. In the app you can:
- change your name (account menu → Your data) and your password (account menu → Change password);
- download your account data as JSON (account menu → Your data): your account, organizations, projects, sessions and feedback. Owners download invoices under Billing and invoices;
- delete your account (account menu → Your data). Your account, sessions and memberships are deleted, and organizations only you own go too if they’re empty. What stays: feedback you sent (without your name, the text as written), invoices and the billing details on them (for tax law), and backups until they expire. Mollie keeps payment records as its own legal obligations require. If you’re the only owner of an organization with other people or projects in it, make someone else owner or delete it first.
For anything else, write to info@developerlab.nl. We answer within one month. You can also complain to the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority, or the authority where you live.
Changes
When this policy changes, the date at the top changes too. We tell account holders by email about changes that matter to them before they apply.