Privacy Policy
Last updated: 8 October 2026
1. Data Controller Identity
Jolv is published by Olifin B.V., a Dutch company registered in the Netherlands (KvK 94570779), High Tech Campus 5, Eindhoven, 5656 AE. When using the service, Olifin B.V. acts as a Data Processor on behalf of its Clients (the Investment Funds), who remain Data Controllers.
Olifin B.V. holds a professional indemnity insurance policy with Hiscox SA.
2. Data Security and Isolation
Confidentiality is at the core of Jolv's architecture:
Isolation (Multi-tenancy)
Each Client organisation is strictly isolated through row-level security policies on the PostgreSQL database and on each storage object. No portfolio data can be accessed by a user belonging to another organisation. This isolation is enforced by the database itself, not by the application interface.
Encryption
AES-256 at rest (database and document storage) and TLS 1.2+ in transit for all communications between your browser and our services.
Hosting
The database and document storage are operated by Supabase in the eu-central-1 region (Frankfurt, AWS). The frontend and application API routes are operated by Vercel in the cdg1 region (Paris, AWS). Both providers are SOC 2 Type II and ISO 27001 certified and operate under a Data Processing Agreement (DPA) signed with Olifin B.V. Olifin B.V. itself is not SOC 2 or ISO 27001 certified at this time.
3. Use of Artificial Intelligence
Scope of AI processing
Jolv uses third-party AI models for specific features (contract term extraction, financial statement extraction, valuation comment generation, the Jolv AI assistant, sector classification, decision-support research). All calls are triggered by user actions and operate on the scope your user has access to. No data is sent to an AI provider in the background without user action.
Non-training and data residency
No client data is used to train third-party AI models. For AI workflows processing sensitive documents (contracts, financials, valuation), calls are operated on Google Cloud Vertex AI in the europe-west4 region (Netherlands) under a Google Cloud DPA with non-training and European residency commitments. For non-sensitive workflows (chat, classification, web search), calls may use services outside the European Union (Google AI Studio, Anthropic) under Standard Contractual Clauses; no confidential client data is transmitted to these services.
4. Data Retention
Data is retained for the entire duration of the subscription. Upon termination, Olifin B.V. commits to returning the full dataset in a structured format (CSV or JSON) upon request, and to deleting production copies within 30 days. Supabase backups are retained for 14 days and then automatically purged.
5. Cookies
Jolv uses cookies to ensure the proper functioning of the site and, with your consent, to analyse traffic and improve the user experience.
Essential cookies
Required for the site to function (authentication, session, language preferences). These cannot be disabled.
Analytics cookies
Optional. They help us understand how you use the site (pages visited, session duration) to improve our services. You can accept or refuse them via the consent banner.
You can change your preferences at any time via the "Manage cookies" link in the site footer.
6. Your rights and contact
You can exercise your rights of access, rectification, deletion and portability of your personal data by writing to privacy@jolv.app. Olifin B.V. will respond to any request within a maximum of 30 days. Olifin B.V. is not required (within the meaning of GDPR Article 37) to appoint an external Data Protection Officer; the contact point for all data protection questions is: privacy@jolv.app
Competent supervisory authority: Autoriteit Persoonsgegevens (Netherlands).
7. Subprocessors (GDPR Article 28)
Olifin B.V. relies on the following subprocessors to deliver the Jolv service. The full list with Data Processing Agreements is available on request at privacy@jolv.app.
| Subprocessor | Role | Region | DPA / Compliance |
|---|---|---|---|
| Supabase Inc. | PostgreSQL database, authentication, document storage, serverless functions | eu-central-1 (Frankfurt, Germany) | DPA signed |
| Vercel Inc. | Frontend hosting, API routes, CDN | cdg1 (Paris, France) | DPA signed |
| Google Cloud (Vertex AI) | Sensitive AI workflows (contract extraction, financials, valuation) | europe-west4 (Netherlands) | DPA signed |
| Google AI Studio (Gemini) | Non-sensitive AI workflows (marketing chat, classification, decision support) | United States | Standard Contractual Clauses; no confidential client data transmitted |
| Anthropic | Third-party language models (specific use cases, non-confidential data) | United States | Standard Contractual Clauses; 30-day retention, training opt-out enabled |
| Resend | Newsletter delivery | United States | Standard Contractual Clauses |