What we process, why we process it, and the rights you have. Written to be read.
Last updated: 23 September 2026
JustDoable is the data controller for this website. If you have any question about this policy or your data, reach us through the contact page — we answer personally.
When you create an account we process your name, email address, and a securely hashed password, plus session data that keeps you signed in. We process this to provide the service you signed up for.
Experts additionally have a public profile: display name, bio, crafts, price, profile photo, and links to their own channels. Posts from those channels can also be shown on the profile itself — see the section on embedded content. Profiles are public by design — that is what they are for. Profile photos are stored with our hosting provider.
If you connect your expert profile to Instagram, we store an encrypted access token, your Instagram account ID, an app-specific ID Instagram itself uses to identify the connection, your username, and the times the token was issued and expires. If you choose to import a post through the connection, we only store the post's public link, together with which Instagram account it came from — never the photo, video, or caption itself. All of this is so you can see your own recent Instagram posts and pick which ones to show on your JustDoable profile.
We only request the instagram_business_basic permission — read-only access to your own account and your own posts. We never post on your behalf, read your messages, or see anyone else's data.
If you disconnect Instagram from your profile, or remove JustDoable under Instagram's Apps and Websites settings, we immediately delete the access token, the connection, and the posts you imported from Instagram to your profile. Links you added by hand stay — they are yours. If you ask Instagram to delete all your data with us, we do the same deletion, and you also get a status page that shows what was removed, along with a confirmation code.
A connection whose token has expired without being renewed is deleted automatically after seven days, and the connection is also removed if you stop being an expert. While the connection is active we refresh the token automatically (Instagram tokens last around 60 days at a time).
If you write to us through the contact form, we keep your message and email address so we can reply.
If you express interest in becoming an expert, we store your email, craft, message, and the time you gave consent — only so we can get back to you about it. This is based on your explicit consent, which you can withdraw at any time by asking us to delete the signup.
We send account email — verification, password reset, and similar — through Brevo, our email processor. We do not send marketing email without asking you separately first.
To protect the service against abuse we count requests per IP address in short-lived rate-limit records that expire and are cleaned up automatically (rolling windows of about an hour). Administrative actions on the platform are recorded in an internal audit log.
We use Vercel Web Analytics — a cookieless service that gives us aggregate page statistics. It does not track you across websites and does not store identifiers on your device.
Expert profiles can contain posts from YouTube and Instagram. Nothing loads from those companies until you choose to show the posts on the profile page.
If you choose to show them, the content is fetched directly from YouTube or Instagram. That company then receives your IP address and may set its own cookies on your device — for that processing it is the data controller.
The choice applies to that page view only. We don't store it, in a cookie or otherwise, so you choose again next time.
We only set cookies that are needed: your sign-in session and your language preference. No advertising cookies, no tracking of our own across sites. If you choose to show embedded posts on an expert profile, YouTube or Instagram may set their own cookies — see the section on embedded content above.
The service runs on Vercel and stores data in a Neon PostgreSQL database located in the United States (AWS us-east-1). For transfers outside the EU/EEA we rely on the EU Standard Contractual Clauses and the providers' equivalent safeguards.
Account data is kept while your account exists. Contact messages and interest signups are kept as long as they are needed for follow-up. You can ask us to delete your data at any time.
Under the GDPR you can request access to your data, have it corrected or deleted, restrict or object to processing, and receive a copy in a portable format. Contact us and we will help.
You also have the right to lodge a complaint with IMY, the Swedish Authority for Privacy Protection (imy.se).