Data Processing Agreement

1. Parties and how this DPA applies

This Data Processing Agreement is between the business named on the account — you, the controller and, for transfers, the data exporter — and Jeani AI, ABN 72 238 565 706, an Australian business which operates Jeani at jeani.ai: we or us, the processor and, for transfers, the data importer. Our contact point for this agreement, for the Standard Contractual Clauses and for anything else to do with data protection is hello@jeani.ai.

We contract as Jeani AI, ABN 72 238 565 706. Record us with those details in your own register of processors and in Annex I of the Standard Contractual Clauses. This page does not publish a registered street address. You do not need one to serve a notice on us: notices under the Terms and under this agreement are given by email to hello@jeani.ai, under clause 18 of the Terms. You do need one to complete the address line of that annex, to satisfy a register of processors that requires a processor address, or to send us a letter — so ask us for it and we will give it to you in writing, and we write it into any copy of this agreement or of the Clauses that we sign.

It forms part of the Terms. You do not need to sign it. It applies automatically, from the moment you first use Jeani, to every processing of Customer Personal Data we carry out for you where Applicable Data Protection Law applies to you. If your procurement process needs a countersigned copy, write to hello@jeani.ai and we will sign one.

On anything to do with the processing of Customer Personal Data, this agreement takes precedence over the Terms. On everything else — the service itself, credits, support — the Terms govern. Neither is displaced by a purchase order or by your own supplier terms unless we have signed those separately.

2. Definitions

• Customer Personal Data — personal data in the content you upload, import or generate through Jeani, and in the account records of the people you give access to. It is the part of your content that identifies a living individual.
• Processing — anything done with personal data: storing it, reading it, transforming it, transmitting it, deleting it.
• Sub-processor — a third party we engage that processes Customer Personal Data on our behalf. The current list is in clause 7.
• Data Subject — the individual the personal data is about.
• Applicable Data Protection Law — whichever of these applies to your use of Jeani: the EU General Data Protection Regulation, the UK GDPR and the Data Protection Act 2018, the Australian Privacy Act 1988 and the Australian Privacy Principles, and any other data protection law that applies to you as controller.
• Security Incident — a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Personal Data, whether on our systems or on a sub-processor’s. An attempt our controls stopped is not a Security Incident.

3. Roles: you decide, we carry it out

You are the controller of Customer Personal Data and we are your processor. You decide what goes into Jeani and why; we process it to give you the service and for nothing else. If you are yourself a processor for someone else — an agency running a brand’s catalogue, for instance — you confirm you have that party’s authority for everything in this agreement, and references to you include them.

Your documented instructions are these three things, and nothing else:

• the Terms and this agreement;
• the settings you choose — the recipe, who you invite and at what role, and which stores and file destinations you connect;
• the API calls you make with your own API keys.

There is an account-level setting for how long originals are kept — 1 to 3,650 days, or unset to keep them — but no screen for it yet: an owner can set it through the API, or ask us to set it, and as things stand nothing acts on it automatically. See clause 11, Deletion and return.

As controller you may at any time:

• give us further instructions on the processing of Customer Personal Data, so long as they stay within the service described in the Terms — we may charge for anything outside it;
• require us to correct, delete, restrict or give you a copy of Customer Personal Data, through the functionality of the service or, where the service cannot do it, with our help;
• ask us for the information you need for your own record of processing activities under Article 30;
• require us to stop the affected processing if we are in material breach of this agreement and have not fixed it within 30 days of your written notice.

We do not use your content to train models, and we will not enable a model provider that would. We do not sell your content or your users’ details, and we do not use them for our own marketing.

You are responsible for having a lawful basis for what you put in, and for the notices and, where they are needed, the consents that cover people appearing in your images. We cannot judge that for you — we cannot see the context a photograph was taken in.

If, in our opinion, an instruction breaches Applicable Data Protection Law, we will tell you immediately, and we may pause that part of the processing until it is settled.

4. Details of the processing

Jeani is built for product photography. You must not upload special category data within the meaning of Article 9, or criminal offence data within the meaning of Article 10. We do not ask you for it, we have not designed Jeani to handle it, and we apply no additional restrictions or safeguards for it — which is why we exclude it rather than accept it. If your images contain it anyway, the decision whether that processing is lawful remains yours to make as controller, and so does the risk of it.

5. What we commit to

Process only on your instructions

We process Customer Personal Data only on your documented instructions as set out above, including in relation to any transfer of Customer Personal Data to a third country or an international organisation, unless a law we are subject to requires otherwise — in which case we will tell you of that legal requirement before we process, unless that law forbids it on important grounds of public interest.

Keep it confidential

Access to production data is limited to the people who run Jeani, each under a duty of confidentiality, and only for as long as they need it to operate the service or to help you with a problem.

Help with data subject requests

A lot of this you can do yourself: any user can read their own profile through the API, an admin can export the credit ledger and the most recent 5,000 audit entries as CSV — ask us if you need more of the history — and any project can be exported as a ZIP with a manifest listing every file. What the app does not have yet is a self-service way to delete an account or to change a user’s own name and email — those we do by hand. Send a request to hello@jeani.ai and we will act on it, or give you what you need to act on it yourself, within 10 business days where we can pull it out of the app, and within 30 days where it means assembling an account by hand — the same deadline as the privacy page, and early enough for you to meet your own one-month deadline. If a data subject comes to us directly, we will not answer for you; we will point them at you and tell you it happened.

Help with impact assessments

If you have to run a data protection impact assessment or consult a regulator about your use of Jeani, we will give you the information we hold about how the service works, taking into account that we are a small operation and you can only ask us for what we actually know. Most of what an assessment needs is on this page, on security and in privacy.

Delete or return it at the end

When you stop using Jeani, you choose: we give you a copy, or we delete it. The mechanics, the timing and the honest limits are in clause 11, Deletion and return.

6. Security measures

We have implemented, and will maintain for as long as we process Customer Personal Data for you, the technical and organisational measures below. They are the measures required of us by Article 32 of the GDPR and, where the Standard Contractual Clauses apply, they are Annex II to those clauses. We may change a measure, but we will not make a change that materially reduces the overall level of security. The security page has the detail, including the things we do not do.

• Traffic to jeani.ai is HTTPS only, with HSTS and certificates renewed automatically.
• Passwords are hashed with scrypt. Refresh tokens and API keys are stored only as hashes, so we cannot read them back — a key is shown once, when it is created.
• Every request is re-checked against your account, and asking for another account’s project returns “not found” rather than “forbidden”. Roles run from viewer to owner, and a member can be confined to named workspaces.
• Every uploaded file is streamed to a malware scanner before it is processed — the only thing that reads it first is the magic-byte check that confirms the file really is the image type its name claims — and screening is fail-closed: if the scanner is unavailable the upload is refused, not admitted unscanned. Anything above the scanner’s 50 MB ceiling is recorded as unscanned rather than blocked, which the 50 MB per-file upload limit keeps from arising in practice.
• Stored files are checked against their own magic bytes. A file whose extension lies about its contents is deleted and the asset marked failed.
• Jeani never issues a public URL for an image: downloads and previews use signed links that expire after 15 minutes, and every object key is prefixed by workspace and project.
• Credentials for the stores and file destinations you connect are encrypted with AES-256-GCM before they reach the database, and are never returned or logged in plaintext.
• The server denies inbound traffic by default and allows only HTTPS, key-only SSH, and port 80, which exists only so TLS certificates can be renewed. Nothing else — no database, cache, scanner, metrics or worker port — is reachable from the internet, and there are automatic security updates and an automatic ban on repeated failed SSH attempts.
• Data in transit is encrypted with TLS. Data at rest is a mixed picture and we would rather say so: the nightly database backup is encrypted by us before it leaves the server, connector credentials are encrypted with AES-256-GCM before they reach the database, and your image files are protected by whatever encryption at rest the storage provider applies by default — we do not send an encryption header of our own and do not claim more than the provider does. We do not run a key management service, and we do not pseudonymise the content you upload.
• The database is backed up every night to a separate bucket under a separate key, encrypted before it leaves the server, and a job restores the newest backup into a throwaway database every week to prove it can be read.
• Account activity is written to an audit log — who did what, when, from which IP address — readable by your admins and owners.

7. Sub-processors

You give us general authorisation to engage the sub-processors we engage today, listed below, and to add or replace one on the notice set out under the table.

We engage each sub-processor under a written contract that imposes on it data protection obligations the same in substance as those in this agreement — in particular that it provides sufficient guarantees to implement appropriate technical and organisational measures, that it processes Customer Personal Data only for the purpose in the table, that its personnel are bound by confidentiality, and that it notifies us without undue delay of any Security Incident affecting Customer Personal Data. We will give you a copy of the data protection terms of any sub-processor contract on request, with commercial terms redacted.

Anthropic and Replicate are not sub-processors today. All image processing runs on Jeani’s own server using the built-in provider, and no image is sent to a model vendor. Which model provider Jeani uses is a setting for the whole deployment, not for one workspace, so turning either on would be a sub-processor change: it would get the 30 days’ notice and the objection right below, and we would tell you where it processes and on what transfer basis before it ran.

The stores, buckets, drives and SFTP servers you connect are not our sub-processors. They are your own systems, and connecting one is your instruction to send your images and their metadata there; what happens once they arrive is governed by your arrangement with that system.

If we add or replace a sub-processor that will process Customer Personal Data, we will email your account owners at least 30 days beforehand. If you object on reasonable data protection grounds within those 30 days, we will look for another way to give you the service; if there isn’t one, you may stop using the affected part of Jeani and terminate that part of your subscription without penalty. We then refund the unused part of any period you have already paid for, on the same footing as a termination without cause under the Terms; unused credits are dealt with under section 3 of the Terms.

We remain fully liable to you for the performance of each sub-processor’s data protection obligations, as if we were performing them ourselves.

8. International transfers

Jeani runs on a single server at OVHcloud in Sydney, Australia. Your image files sit in Wasabi object storage in the ap-southeast-2 region, which Wasabi names Sydney, and the nightly database backup sits in a separate bucket in the same region. In Australia, the Privacy Act 1988 and the Australian Privacy Principles are the law that applies to us.

The location column in clause 7 says where your data sits, which is not the same as which company holds it or where that company’s staff sit. A provider’s support and engineering people can in principle reach their own infrastructure from outside Australia under that provider’s own terms, and where that is possible we rely on the transfer terms in the provider’s own data processing agreement. Ask us for the contracting entity behind any provider in the table, or for a copy of its transfer terms, and we will give you both.

Australia is not the subject of a European Commission adequacy decision. Where you are subject to the EU GDPR, transfers of Customer Personal Data from the EEA to us in Australia are made under the European Commission’s Standard Contractual Clauses (Decision 2021/914), module two, controller to processor, which are incorporated into this agreement by reference and which we will sign as a separate document on request. Where you are subject to the UK GDPR, the UK International Data Transfer Addendum to those clauses applies to transfers from the United Kingdom.

For the purposes of the Clauses, Clause 17 Option 1 applies and the Clauses are governed by the law of Ireland, and under Clause 18(b) any dispute arising from the Clauses is to be resolved by the courts of Ireland. That does not change the governing law of the rest of this agreement or of the Terms, which remains the law of New South Wales, Australia. If the Clauses conflict with this agreement or the Terms, the Clauses prevail.

For the clauses’ annexes: you are the data exporter and we are the data importer — Jeani AI, ABN 72 238 565 706, of Australia, at the street address we will give you on request; the categories of data, data subjects, purpose and duration are the table in clause 4; the technical and organisational measures are the list in clause 6; the transfers are continuous for the term; and our contact point is hello@jeani.ai. Annex I.A also asks for a named individual and their position: ask us and we will give you one in writing. For the sensitive data line of Annex I.B, the honest answer is that none is transferred by design — you must not upload special category data, we do not ask you for it, Jeani has no field for it, and we apply no additional restrictions or safeguards for it, which is why clause 4 excludes it rather than accepts it. A photograph can reveal it anyway; if that is a live risk in your catalogue, tell us before you upload and we will settle in writing what that line should say.

For the choices the Clauses leave to the parties: the optional docking clause in Clause 7 does not apply; Clause 9 Option 2, general written authorisation, applies with the 30 days’ prior notice set out in clause 7; the optional redress clause in Clause 11(a) does not apply; and the competent supervisory authority under Clause 13 is the authority of the EEA Member State in which you are established, or, where you are not established in the EEA, the authority of the Member State in which the data subjects whose data is transferred are located. Where the UK Addendum applies: Table 1 is the parties named in clause 1; Table 2 selects the Approved EU SCCs, module two, as incorporated here; Table 3 is the sections cross-referenced above; and in Table 4 neither party may end the Addendum under section 19 of it.

Government access

We have assessed the Australian laws that could apply to us as importer, including the Telecommunications (Interception and Access) Act 1979 and the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, and we have no reason to believe they prevent us from meeting our obligations under this agreement or the Standard Contractual Clauses. We will tell you if that changes.

If we receive a legally binding request from a government or law enforcement agency for Customer Personal Data we will notify you before we respond, unless the law forbids it — in which case we will seek a waiver, challenge the prohibition, and tell you as soon as we lawfully can. We will challenge a request that appears unlawful or excessive, disclose only the minimum it requires, and never give an authority direct or bulk access to your data or hand over an encryption key. We keep a record of the requests we receive and will make it available to you and to a supervisory authority on request.

Onward flows

Three of the providers in the table are United States companies. Two of them hold data, and it sits where the table says: Wasabi Technologies, which holds your files and the encrypted backups in ap-southeast-2, and Google, whose infrastructure carries our outbound email and a Google sign-in. The third is Cloudflare, which is only the authoritative DNS for jeani.ai — our records are DNS-only rather than proxied, so it answers name lookups and no request, no file and no account record passes through it.

Two onward flows are worth naming. Platform email is sent through the Gmail API, so the content of a notification — which can include a name, an email address, a sign-in IP address or a list of your file paths — transits Google’s infrastructure. And if we ever enable an external model provider, that is a new transfer: we will tell you where it processes, and on what basis, before it runs.

9. Security incident notification

If we become aware of a Security Incident affecting Customer Personal Data, we will tell you without undue delay and in any case within 48 hours of becoming aware of it, which leaves you time to make your own notification inside your 72 hours. We notify by email to your account owners and admins.

We will tell you:

• what happened, when it happened and when we found out;
• which categories of data are involved and, as far as we can establish, roughly how many records and people;
• what we have done to contain it and what we are doing next;
• what we suggest you do.

Where we do not have all of that at first, we will send what we have and follow up rather than wait until the picture is complete. We will write a post-mortem within five business days of closing the incident and give it to you on request.

Notifying a regulator or the affected individuals is your decision as controller; we will give you what you need to make it and to make the notification. We will not name you in a public statement without your agreement unless a law requires it. Telling you about an incident is not an admission of fault by either of us.

10. Audits and information

We make available the information necessary to demonstrate compliance with this agreement. In practice that is this page, the security page, and a written answer to your questions: send them to hello@jeani.ai and we will answer within 30 days.

You may audit us no more than once in any 12 months, on 30 days’ written notice, at your own cost, in business hours, under confidentiality, and in a way that does not disrupt the service. You may audit more often if a regulator with authority over you requires it, or after a Security Incident affecting your data. We may decline an auditor who competes with us.

An audit can cover our configuration, our procedures and our answers. It cannot cover a sub-processor’s premises: we do not control OVHcloud’s or Wasabi’s datacentres and cannot let you into them. For those we will pass on whatever the provider publishes.

11. Deletion and return

Getting a copy out

You can take your data out at any time while the account is open. Export a project as a ZIP with a manifest listing every file, its path, its version and its checksum; download any single original or output; export the credit ledger and the most recent 5,000 audit entries as CSV; or read the records over the API with a read-scoped key. There is no single “download everything” button — a full copy is assembled project by project. If you would rather we assembled it for you, ask.

Return or deletion, at your choice

At the end of the agreement you choose: we return Customer Personal Data to you, or we delete it. Tell us which. For 30 days after the agreement ends we delete nothing, so the choice stays open — and because closing an account stops everyone signing in to it, if you no longer have access you can ask us within that window and we will assemble a complete copy and deliver it to you.

Deleting

Within 30 days of your written request, or of the end of those 30 days — earlier if you tell us you have what you need — we delete Customer Personal Data from the live system: the image files and their earlier versions in object storage, and the account and content records in the database. We confirm in writing when it is done. If a law requires us to keep something, we will tell you what and why, and we keep it only for as long as that law requires.

Backups

The nightly database backup is kept on a rolling schedule of seven daily, five weekly and twelve monthly snapshots. A record you delete from the live system can therefore survive in an encrypted backup for up to about twelve months, until the snapshot holding it rolls off. We do not use backups to bring deleted data back; the only reason we restore one is to recover the whole service. Image files are not in the backup at all — they live in object storage, which keeps earlier versions of a file, and we remove those as part of a deletion request.

What we keep

One thing survives deletion for our own purposes: the audit log. We keep audit entries as our record of who did what — the actor’s identifier, IP address and user agent. For that limited record we act as a controller in our own right rather than as your processor, and we keep it because we may need to establish, exercise or defend a legal claim or investigate abuse of the service. We do not use it for anything else. We are honest that nothing prunes it automatically today; our intention is a 24-month limit and we will say on this page when that is running.

Two other records stay with us: the notification records that show which emails were sent, whose contents can include a name, an email address, a sign-in IP address or a list of your file paths; and the credit and cost ledgers, which are our financial record. Beyond those we keep only what a law requires, for as long as it requires. Everything else goes.

12. Liability

Liability under this agreement is governed by, and counts towards, the limits and exclusions in the Terms, with two exceptions. First, the exclusion of liability for loss of data in the Terms does not apply to a claim under this agreement or under the Standard Contractual Clauses. Second, our liability to a data subject under Clause 12 of the Standard Contractual Clauses is not capped by the Terms.

The cap in the Terms is the greater of US$1,000 and the fees you paid us in the preceding 12 months, so on a free plan it is US$1,000. If you need a higher floor under this agreement, ask and we will agree one with you in writing.

Nothing here limits a data subject’s rights under Applicable Data Protection Law, and nothing here limits liability that cannot be limited by law.

13. Term and changes

This agreement starts when you accept the Terms or first use Jeani, whichever is earlier, and runs for as long as we process Customer Personal Data for you. Deletion and return, Liability and Governing law survive the end of it.

We may update this agreement — to name a new sub-processor, to reflect a change in the law, or to describe something the product now does differently. Substantive changes are emailed to account owners at least 30 days beforehand. The date and version at the top of this page always say which one you are reading.

14. Governing law

This agreement is governed by the same law, and subject to the same courts, as the Terms. Where the Standard Contractual Clauses apply, they are governed by the law of Ireland and disputes about the Clauses are heard by the courts of Ireland, as set out in clause 8. Where the UK Addendum applies, the Addendum and the Clauses as amended by it are governed by the law of England and Wales and are subject to the courts of England and Wales.

15. Contact

Write to hello@jeani.ai and put “DPA” in the subject. Same address for a data subject request, an audit question, our registered street address, a countersigned copy of this agreement or the Standard Contractual Clauses, or an objection to a sub-processor.

We have not appointed a data protection officer; hello@jeani.ai reaches the people who run the service.

We have not designated a representative in the European Union or the United Kingdom under Article 27 of the GDPR and the UK GDPR. That designation is ours to make, not yours to assess, and not having made it is a gap on our side rather than a question for your procurement. When one is in place we will publish the representative’s name and address on this page and email account owners. If it blocks your own assessment, tell us and we will prioritise it.