Privacy notice
This notice explains what personal data the Jumi Creative customer portal (this website) processes, why, and what your rights are under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.
1. Who is responsible
The data controller is Visualsofjulius Oy (Business ID 2941901-6), Lempinkuja 5, 21380 Aura, Finland. Contact: hello@jumimedia.co.
2. What this portal is
The portal gives customers access to digital products (courses, sky packs, brushes, guides) they bought earlier from Jumi Creative (formerly Visualsofjulius), through our Kajabi store or our earlier Stripe and PayPal checkouts. It does not sell anything and does not process payments.
3. What data we process and why
| Data | Source | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Email address | Your original purchase (Kajabi, Stripe or PayPal records); the sign-in form | Identify you, send the sign-in link, show the products you own, and send one-time service emails about access to your purchases (such as the move to this portal) | (b) performance of a contract |
| Name, country | Your original purchase (Kajabi, Stripe or PayPal records) | Show your account details and receipts | (b) contract; (c) legal obligation (bookkeeping) |
| Purchase history (product, amount, currency, date, order and receipt numbers, payment provider) | Kajabi, Stripe and PayPal payment records | Prove entitlement; provide receipt copies; comply with Finnish bookkeeping and VAT law | (b) contract; (c) legal obligation |
| Sign-in events, IP address, browser type | Generated when you use the portal | Keep accounts secure, prevent abuse, fix technical errors | (f) legitimate interest in security |
We do not use your data for marketing from this portal, we do not profile you, and we do not sell personal data.
4. Cookies
The portal sets only strictly necessary cookies: the Supabase authentication cookies (names beginning with sb-) that keep you signed in after you click the sign-in link. They are first-party, expire when the session ends or you sign out, and are required for the service to work. We use no analytics, advertising or tracking cookies, so no consent banner is needed (ePrivacy Directive art. 5(3) exemption; Finnish Act on Electronic Communications Services §205).
5. Who processes data on our behalf
- Supabase (database and sign-in), hosted in the EU (AWS Frankfurt, Germany).
- Vercel (website hosting and server logs). Vercel Inc. is a US company; transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Backblaze B2 (file storage for downloads), EU region (Amsterdam, Netherlands). Download links are short-lived and contain no personal data.
- Bunny.net (video streaming for courses), Slovenia, EU, with a global content delivery network.
- Amazon Web Services EMEA SARL (Amazon SES) sends sign-in links and service emails from its EU region (Stockholm, Sweden). It processes your email address and, in service emails, your first name and product list. AWS belongs to a US group; transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.
Each provider acts as a processor under a data processing agreement and may only use the data to provide the service to us.
6. How long we keep data
- Purchase records (incl. name, email, country, amounts): 6 years from the end of the financial year in which the purchase was made, as required by the Finnish Accounting Act (kirjanpitolaki 1336/1997, ch. 2 §10) and VAT rules. Which products you bought, and when, is kept for as long as your licence lasts, because it proves your access.
- Account and access data: for as long as you hold a licence to at least one product. Our licences are lifetime, so this is until you ask us to close the account.
- Security and server logs: up to 90 days.
7. Your rights
You can ask us to access, correct, delete, or export your personal data, to restrict processing, or object to processing based on legitimate interest. Write to hello@jumimedia.co from the email address on your account; we answer within one month.
If you ask us to delete your account, we remove your sign-in and profile data and revoke access to the products. We must keep the purchase records for the bookkeeping period in section 6, and we then delete them.
You also have the right to complain to the Finnish supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki, tietosuoja.fi.
8. Security
Access is by emailed one-time link, so there are no passwords to leak. Every database query is restricted by row-level security so a signed-in customer can only read their own rows. Data is encrypted in transit and at rest by our providers.
9. Children
The portal is for customers aged 18 and over. We do not knowingly process data of children.
10. Changes
We update this notice when our processing changes and show the date at the top. Material changes are announced on the account page.