Who we are, and what this covers
Jeani is operated by Jeani AI, ABN 72 238 565 706, an Australian business. In this policy we means Jeani AI, and you means anyone who visits jeani.ai or uses the Jeani app.
This policy covers the site at jeani.ai and the application behind it, including everything you upload. It is written to meet the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the European Union or the United Kingdom, the GDPR sections below apply to you as well.
Two kinds of information, two different roles
- Your account. Your email address, your name, how you sign in and what you do in the app. We decide what to collect and why, so we are responsible for it as the controller.
- Your catalogue. The product images you upload and the settings you apply to them. You decide what to send and what should happen to it, and we act on that instruction. Under the GDPR you are the controller and we are the processor.
Business customers who need that split in writing can use the Data Processing Agreement.
Anything here you want explained, corrected or acted on goes to hello@jeani.ai. That address reaches the people who run the service.
The information we collect
Account details, from you
Signing up collects an email address, a display name and a name for the account or organisation. That email address is also set as the account billing email. If you sign up with a password, we store it hashed with scrypt and never in a readable form. We record when you last signed in. If you sign up or sign in with Google we also record the date Google confirmed your address; we do not run a separate email-verification step for password sign-ups, so on those accounts that date stays empty.
If someone on your account invites a colleague, we store the invited email address, the role and a single-use invitation token. The link stops working once the invitation is accepted, or seven days after it is sent; the record itself stays until you ask us to remove it. That is personal information about someone who may never become a user.
If you have landed here from an invitation email, this is how we came to hold your address: the person inviting you typed it in. We hold that address, the role they picked and a single-use token, for one purpose — letting you accept or ignore the invitation. You have every right on this page over that address: write to hello@jeani.ai and we will tell you what we hold, correct it, or remove it. The same applies if your details reached us inside a catalogue someone connected to Jeani; there we act on that customer’s instructions, so we will pass your request to them and tell you we have.
Sign in with Google, from Google
If you sign in with Google we ask for three permissions and nothing else: openid, email and profile. Google returns a stable identifier for your Google account, your email address, your name and your avatar URL, and we keep those against your Jeani user along with the date the account was linked and the date it was last used. We only link a Google account to an existing Jeani user when Google tells us the email address is verified. We never see your Google password, and this sign-in permission does not let us read your mail, files or contacts. Connecting Google Drive as a source or destination is a separate step you take deliberately, with its own permissions — see destinations you connect below.
Your catalogue, from you
Image bytes never go into our database. When you upload files, they travel from your browser straight to object storage and never touch our server. When you upload a ZIP catalogue, the archive is posted to our server and written to a temporary file on disk while we read it, each image inside is streamed straight into object storage, and the temporary file is deleted as soon as the import finishes. Either way the database holds only the record: the file path and name you sent, the extension and file type, the processing status, the measurement described below, quality scores, how many attempts and credits an image used, any error, and timestamps. Each stored file — the original and every output — is recorded with its dimensions, byte size, type and checksum.
Originals are written once and never modified, so whatever is embedded in the file you upload stays in your original: camera data, a colour profile, location coordinates if your camera recorded them. Outputs are different, and the answer has two halves. Anything that changes the pixels — repositioning the product, resizing the canvas, enhancing, removing or replacing the background — rebuilds the image on a fresh canvas, and nothing from the original file’s EXIF or ICC block survives that. The other half is the “keep colour profile” setting in your recipe, which is on by default: it tells the encoder to carry the input’s colour profile and EXIF through into the output. So when a recipe changes nothing about the pixels — a format or quality change on an image that already meets the recipe — what the encoder is handed is still your original file, and its EXIF, including camera data and any location coordinates, is copied into the output. Turn that setting off and every output is stripped.
Reviewers can attach free-text notes to an image, and the note is kept with the decision. If you connect a store, we store what is needed to write a processed image back to the right product: the platform, the product and image identifiers, the SKU, the position and the source URL. Credentials for a connection are encrypted with AES-256-GCM before they reach the database and are never displayed or logged in readable form.
Usage and technical data, generated as you work
- Sessions. Every sign-in records the IP address and the browser User-Agent string, truncated to 500 characters, alongside a hash of the refresh token. The token itself is never stored.
- Audit log. Around forty kinds of action — signing in, inviting or removing a member, creating or revoking an API key, starting or cancelling a job, creating an export, changing a connection — are recorded with who did it, when, from which IP address and browser, plus a small block of detail. Some of that detail can include your own file paths; a blocked upload, for example, records the path of the file that was blocked.
- Processing records. Each AI or computer-vision operation attempted on an image is recorded with the provider name, the model, timings and cost. These records hold the parameters and the verdict, not the image.
- Server logs. The web server writes an access log containing client IP addresses and requested paths. Application logs are structured JSON, with authorisation headers, cookies, passwords, secrets, credentials, API keys and tokens replaced by [redacted] before anything is written.
Communications
The emails we send you, and anything you send us. Queued notification emails keep the information used to build them, which depending on the email can include an IP address, a User-Agent string, a colleague email address or a list of your own file paths.
Whether you have to give us this
No law requires you to give us any of it. An email address, a name for you and a name for the account are what the contract between us runs on: without them we cannot create an account, sign you in, scope what you can see, or tell you when a job finishes — so we cannot provide the service at all. If you sign in with Google instead of a password, Google supplies the same three things. Everything else is optional: an avatar, a store connection, a review note. Leaving one out costs you only the feature it belongs to.
What we do not collect
- No card numbers. Payments are taken by Stripe on Stripe’s own pages; card details are entered there and never reach Jeani. What we keep is Stripe’s reference for your account and its subscription, and the billing email and account name we give Stripe so it can issue your receipts.
- No images from anonymous visitors. Nothing on the marketing site accepts a file — the free analysis runs inside an account.
- No analytics, tag manager, session recording or error-reporting service, on any page.
- No sensitive information, as the Privacy Act defines it and as Article 9 of the GDPR defines special category data. We never ask for it and no field in Jeani is for it. We do not look inside your catalogue before you send it, so this one needs you: please do not upload images whose subject is a person’s health, biometrics, race, religion, politics, sexual orientation or criminal record, and do not use Jeani to identify a person from a photograph. Tell us if something like that has reached us and we will remove it.
How we use it
Running the service
Creating your account, signing you in and keeping you signed in, showing your workspaces and projects, applying roles so people see only what they should, counting credits and usage, and answering the API when you call it.
Processing your images
The analysis run on every uploaded image is plain measurement on our own servers, with no AI involved: width, height, format, file size, transparency, where the product sits in the frame and how much of it it fills, how far off centre it is, the dominant border colour, how uniform the background is, sharpness, an estimate of the quality it was saved at, whether it looks like a lifestyle shot, and a list of coded findings. Processing then does what your recipe asks and scores the result against the original.
AI model providers, where enabled
Some operations need a model we do not run ourselves. Two outside providers are built. Claude, from Anthropic, compares an output against its original — the adapter can also describe an image, though nothing in the pipeline asks it to today; it receives a downscaled copy, auto-rotated, flattened onto white, longest side no more than 1024 pixels. Replicate handles upscaling, background removal and reference-conditioned generation; it receives the image at full resolution.
Neither receives anything unless we have configured that provider and your recipe asks for an operation that needs it. The provider switch is ours and applies to the whole platform: there is no per-workspace setting that turns an outside provider on or off, so if we ever configure one it is available to every recipe that uses those operations.
Today no customer image is sent to an outside model provider. Production runs the built-in provider, which does its work locally on our own server, and the service that talks to outside models is not started as part of a normal deployment. If that changes we will name the provider in the sub-processor table and update this page before the change takes effect.
We do not use your images to train models, ours or anyone else’s. If we ever enable an outside provider, it will be one whose terms forbid training on what we send.
Keeping the service safe
Every uploaded file is streamed to a virus scanner before it is processed, and if the scanner cannot be reached the upload is refused rather than let through. The one thing that reads a file before the scanner does is the check that confirms, from its opening bytes, that it really is the image type its name claims. Requests are rate limited. A sign-in from an IP address and browser we have not seen for you before triggers a security email. The audit log exists so a question about what happened has an answer.
Emails
Three emails are sent the moment you act and cannot be switched off: the welcome email when you sign up, an invitation when someone invites you, and a password reset link when you ask for one. Security emails cannot be switched off either — a new sign-in, an API key created or revoked, a password changed — because they exist to tell you about something you may not have done.
Everything else is optional. Job, alert, report and account notifications can be switched off by category in your account settings, and every one of those emails carries a one-click unsubscribe link and the standard list-unsubscribe headers.
Support
Answering your questions, fixing what is broken and understanding how the service behaves so we can make it better. We do not sell personal information and we do not use it for advertising.
Legal bases, for people in the EU and UK
The GDPR requires a lawful basis for each use of your information. Ours are set out below. Australian law does not work this way, which is why the rest of this policy is written around what we actually do rather than around a list of bases.
| What we do | Basis |
|---|---|
| Create and run your account, process the images you send, and send the emails that come with using the service | Performance of our contract with you |
| Screen uploads for malware, rate-limit requests, keep the audit log, alert you to a new sign-in | Our legitimate interest in keeping the service and your catalogue safe |
| Send optional job, alert, report and account notifications | Our legitimate interest in keeping you informed, which you can switch off at any time |
| Answer your support questions, fix what is broken, and study how the service behaves so we can improve it | Our legitimate interest in running and improving a service you pay for |
| Keep records we are required to keep, or answer a lawful request | Legal obligation |
| Keep records we may need to establish, exercise or defend a legal claim | Our legitimate interest in defending ourselves, and legal obligation where one applies |
| Anything we ask your permission for | Consent, which you can withdraw |
Where we rely on a legitimate interest we have weighed it against your interests before relying on it, and you can object — see your rights below. Ask us and we will explain the reasoning behind any of the rows above.
Where a business customer uploads a catalogue, that customer is the controller and we act on their instructions as processor. If you are one of their staff or customers and you want information corrected or deleted, ask them. If you ask us, we will pass it on and tell you we have.
Disclosure and sub-processors
We do not sell your information and we do not share it for advertising. It leaves us in five situations: to the people on your own account, according to the role they hold; to the vendors below, who help us run the service; to a destination you connect yourself; where the law requires it; and to a buyer if the business is ever sold.
Our sub-processors
| Vendor | What it does | Where the data sits |
|---|---|---|
| OVHcloud | The dedicated server that runs the app, the database, the job queue and the virus scanner | Sydney, Australia |
| Wasabi | Object storage for your images and outputs, and a second, separate bucket holding encrypted database backups | ap-southeast-2, the region Wasabi names Sydney |
| Google (Gmail API) | Sends every email we send you, from hello@jeani.ai. The permission we hold is send-only; we cannot read a mailbox with it. | Google infrastructure; Google does not tell us which country handles a message |
| Google (Sign in with Google) | Confirms who you are, if you choose to sign in that way | Google infrastructure |
| Cloudflare | DNS for jeani.ai. Our records are set to DNS-only rather than proxied, so requests and files go straight to our server and not through Cloudflare; Cloudflare still answers DNS lookups for the domain. | DNS records and lookup traffic only |
Anthropic and Replicate are named under how we use it as model providers. They are not sub-processors today, because nothing is sent to them. If we enable either, this table changes first.
Destinations you connect
Jeani can read from and write to systems you own: Shopify, WooCommerce, Magento 2, Shopware 6, Amazon S3, Wasabi, SFTP and Google Drive. Connecting one is an instruction to send your images and their metadata there. Those are your systems and your relationships, not our sub-processors, and what happens to the data once it arrives is governed by your arrangement with them.
Our own access
The platform administration screens inside Jeani show account names, plans, member and workspace counts, image counts, credit balances and job records, and the job records carry the workspace and project name the job ran in. They do not show your images, your file names or your member email addresses, and holding that access does not lift the boundary between accounts anywhere else in the API.
Beyond those screens, someone has to be able to run and repair the service, which means we can reach the server, the database and the storage buckets. We keep that to the smallest number of people it can be, and we use it to operate and support the service, not to look through your catalogue.
Other disclosures
We will disclose personal information where Australian law, a court or a regulator requires it, and where it is necessary to prevent serious harm. If the business is ever sold or merged, information may pass to the buyer. We would tell you before that happened, and the buyer would be held to this policy until it published its own.
Sending information overseas
Australian Privacy Principle 8 requires us to tell you which countries our overseas recipients are likely to be in, and to take reasonable steps to make sure they handle your information consistently with the Australian Privacy Principles.
Jeani runs in Australia. The application, the database, the job queue and the virus scanner sit on a single machine in Sydney. Your images, your outputs and our encrypted backups are stored with Wasabi in ap-southeast-2, the region Wasabi names Sydney.
Four of our vendors are overseas companies:
- Wasabi Technologies, a United States company. The data itself is stored in the Asia-Pacific region named above, but the corporate group is overseas.
- Google, a United States company. Our outbound email passes through Google infrastructure, and so does a Google sign-in if you use one.
- OVHcloud, a French group. The machine and everything on it stay in Sydney, but the company is not Australian and support access may come from outside Australia. Nothing is stored overseas as a result.
- Cloudflare, a United States company. It answers DNS lookups for jeani.ai. Our records are DNS-only rather than proxied, so no request and no file passes through it; what reaches Cloudflare is the lookup traffic for the domain name itself.
Anthropic and Replicate are also United States companies. Nothing is sent to them today, and if that changes we will say so here before it does.
These are the steps we take to meet APP 8.1: we choose Australian regions for both the server and the buckets, so the data stays here; we use each vendor on terms that commit them to protect the information and to use it only to provide their service; we encrypt backups on our own machine before they leave it; and we keep what reaches an overseas vendor to the minimum the job needs — Google handles the email we send you, never your catalogue. We are not asking you to consent to overseas disclosure under APP 8.2(b), so we stay accountable to you for what those vendors do with your information.
If the GDPR or the UK GDPR applies to you
Australia is not the subject of a European Commission adequacy decision, so a transfer of your information out of the EEA or the United Kingdom to us needs a basis of its own. We do not ask for your consent to it. For the catalogue you upload — where you are the controller and we are the processor — the transfer terms sit in the Data Processing Agreement. For the information we hold as controller — your account details, your sessions, the audit record and the emails we send you — the transfer to us, and the onward step to Google and Wasabi in the United States, rest on the data processing terms we have accepted with each of those vendors. Email hello@jeani.ai and we will tell you in writing what covers a particular transfer.
How long we keep things
Nothing is deleted on a schedule yet. The retention setting and the process that acts on it are built, but the sweep that runs it is not yet scheduled, so today nothing is removed automatically. Until it runs, read every line below as kept until you ask us to remove it, with three exceptions: server logs, which roll over by size as new ones are written; the encrypted database backups, whose snapshots are pruned nightly to the 7 daily, 5 weekly and 12 monthly rotation set out below; and the audit log, the notification records and the credit and cost ledgers, which a deletion request does not remove — the rows below say why.
The setting that exists
One retention control exists: an account-wide number of days after which your original images are deleted, anywhere from 1 to 3,650, or never. The default is never, because we keep your originals so you can restore them. There is no screen for it yet: an account owner can set it through the API, or email us and we will set it for your account and confirm the new value in writing. A change made through the app or the API is recorded in your audit log.
What we hold, and for how long
| What | How long |
|---|---|
| Original images | Until you ask us to delete them, or until the retention period you set, once the scheduled sweep is running |
| Outputs and previews | Until you ask us to delete them |
| Export archives | The download stops working seven days after the export is made. The archive itself stays in storage until we remove it, which we do on request. |
| Signed links | Download links last 15 minutes, upload links one hour |
| Unfinished uploads | An upload session must be completed within 24 hours |
| Sign-in sessions | An access token lasts 15 minutes, a refresh token 30 days. The session record, with its IP address and User-Agent, is kept indefinitely after it expires or is revoked; we remove it on request. |
| Password reset links | 30 minutes, single use |
| Invitations | The link stops working after seven days. The record, including the invited email address, is kept until you ask us to remove it. |
| Audit log, which carries IP addresses and User-Agent strings | Kept indefinitely as our own record of who did what. A deletion request does not remove it: we hold it to investigate abuse of the service and to establish, exercise or defend a legal claim, and for that record we act as controller in our own right. See clause 11 of the Data Processing Agreement. |
| Notification records, including the detail used to build each email | Kept indefinitely. That detail can include an IP address, a User-Agent string, a colleague email address or your own file paths. A deletion request does not remove it; it is our record of which emails were sent. |
| Credit and cost ledgers | Kept indefinitely — they are the financial record of the account |
| Server and application logs | Rotated by size rather than by date: the access log keeps five 50 MiB files and the container logs three 10 MB files each, so the oldest entries fall off on their own |
| Database backups | Encrypted nightly; 7 daily, 5 weekly and 12 monthly snapshots are retained |
Where a line says kept until you ask us to remove it, that is the criterion rather than a period: we hold it while your account is running, and we act on a request to remove it within 30 days. When the sweep is scheduled we will set out the periods it applies here before it runs.
Deleting things
Deleting a project or a workspace in the app archives it. The files and records stay, recoverable, and nothing leaves storage. There is no button that deletes an image, the contents of a workspace or an account.
So deletion is a request rather than a button. Email hello@jeani.ai from the address on the account and we will confirm it is you. Then:
- we act on a verified deletion request within 30 days;
- we delete the objects in storage and the rows in the database, other than the audit log, the notification records, the credit and cost ledgers and anything a law requires us to keep;
- the image bucket keeps a previous version of an object when it is overwritten or removed, so we clear those versions too;
- database records survive in encrypted backups until those snapshots age out, which takes up to about twelve months. Your image files are not in those backups at all. A backup is never restored to serve the live product except in a whole-system recovery, and if that ever happened we would re-apply your deletion.
Backups
The database, our server configuration and our certificates are backed up nightly to a separate bucket under separate credentials, encrypted before they leave the machine. Your image files are not in that backup — they live in the storage bucket, which keeps a previous version of an object when it changes.
Security
The short version. Passwords are hashed with scrypt and never stored readably. Refresh tokens are stored only as a hash and are single-use, replaced every time they are used. Connector credentials are encrypted with AES-256-GCM before they touch the database. Every request is scoped to your account, and another account identifier comes back as not found rather than as forbidden. Every upload is scanned for malware before it is processed, and a scanner outage blocks uploads rather than letting them through. Files are validated by their actual bytes. The site is TLS-only. Backups are verified nightly and a restore is tested weekly.
Two things worth saying plainly. Your image files sit in a private bucket, but encryption at rest for them is whatever the storage provider applies by default: we do not send an encryption header of our own and we do not claim more than the provider does. The nightly database backup is the exception, encrypted by us before it leaves the server. And no set of controls is perfect: if a breach happens that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Where the GDPR or the UK GDPR applies and we are the controller, we will report a notifiable breach to the supervisory authority within 72 hours of becoming aware of it, and tell affected people directly where the risk to them is high. Where we are your processor, we will tell you without undue delay after we become aware, and in any case within 48 hours — with what we know at the time and the rest as we learn it — so you can make your own report inside your 72 hours. The Data Processing Agreement is the binding version of that commitment.
The full account of how the service is built and defended is on the security page.
Your rights, and how to use them
Requests are free. We may ask you to confirm who you are before we act, and if a request is repetitive or plainly excessive we may decline it and tell you why.
Access
Signed in, you can see your profile, your account, your role, your workspaces and your credit balance. Administrators can read the account audit log in the app and download it as a CSV — that file covers the 5,000 most recent entries, and the credit ledger download the 200 most recent. An API key pulls the same records programmatically, within the scope you give it: a read-scope key reaches your account, workspaces, projects, assets, jobs and credit ledger, and the audit log needs an admin-scope key.
If you want something the app does not show you, or the whole history rather than those files, email hello@jeani.ai. We will confirm who you are, answer within 30 days, and charge nothing for it. If there is something we cannot give you — because it would reveal another person’s information, or because the law says we must not — we will tell you in writing which part we are withholding and why, and how to complain about that decision, including to the Office of the Australian Information Commissioner.
Correction
If what we hold about you is wrong, out of date, incomplete, irrelevant or misleading, tell us and we will fix it, free, within 30 days. There is currently no screen for changing your own name, email address or avatar, so email hello@jeani.ai and we will make the change. Passwords are changed through the reset link, which you can request from the sign-in page at any time.
If we have already passed the wrong information to someone else, ask us and we will tell them about the correction, unless that is impracticable or the law prevents it. If we decide not to correct something, we will write to you with the reasons and with how to complain about that decision, and if you ask us to we will attach your own statement to the record, so anyone who reads it later reads your version too.
A copy of your data
Any project can be exported as an archive with a manifest listing every file, its path, its version and its checksum, downloaded through a signed link. There is no single button that exports an entire account, so ask us and we will assemble one within 30 days.
Deletion
Email us, as set out under how long we keep things.
Withdrawing consent
Where we asked your permission for something, you can take it back at any time — switch the setting off in your account, use the unsubscribe link on the email, or write to hello@jeani.ai. Withdrawing it stops that use going forward. It does not make what we did beforehand unlawful, and it does not touch anything we do on another basis: running your account, keeping the audit log, or a record we are required to keep.
Complaints
Start with us at hello@jeani.ai. We will acknowledge within five business days and answer within 30 days.
The Office of the Australian Information Commissioner will normally expect you to have complained to us first and given us 30 days to answer, so start here — but if those 30 days pass with no answer, or the answer does not satisfy you, take it to them at oaic.gov.au, which lists the ways to reach them.
If you are in the EU or the UK
You also have the rights the GDPR gives you: access, rectification, erasure, restriction of processing, objection to processing we base on legitimate interests, portability, and withdrawal of consent where we rely on it. Where we are the processor for a business customer, we pass your request to them rather than act on their catalogue ourselves, and we tell you we have. You can also complain to your local supervisory authority. Business customers can put the processor relationship in writing with the Data Processing Agreement.
We do not make automated decisions about you that produce legal or similarly significant effects. Images are scored automatically and doubtful results are routed to a review queue for a person to approve or reject, but that is a judgement about a photograph, not about a person.
Children
Jeani is a tool for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, email us and we will delete it.
Changes to this policy
When this policy changes we update the page, the date at the top and the version number. If a change materially affects how we handle your information, we will email account owners at least 30 days before it takes effect. Using Jeani after that date means the new version applies to you.
Earlier versions are available on request.
Contact
Privacy questions, requests and complaints: hello@jeani.ai.
Jeani is operated by Jeani AI, ABN 72 238 565 706, in Australia, and that is the entity responsible for the personal information described here. For EU and UK purposes we are the controller of your account information and the processor of the catalogue you upload. We are small enough that there is no data protection officer; the address above reaches the people who run the service. We do not publish a registered street address on this page — if you need one for your own records or to send us a letter, ask and we will give it to you in writing.
We are established in Australia and have not appointed a representative under Article 27 of the GDPR. If our handling of EU or UK personal information grows past the exemption in Article 27(2), we will appoint representatives and name them here.
The rest of the fine print lives on the terms, security, status and data processing pages.