Jam / JamStudio Privacy Policy (GDPR-ready draft)
Effective date: 4 November 2026
Controller: Jam SAS, 12 rue du Général Camou, 75007 Paris, France, RCS Paris 918 312 117 (“Jam”, “we”).
Privacy contact: contact@withjam.ai
This policy explains how Jam processes personal data when you use the Service, contact us, receive marketing, or appear in content shared through the Service. It must be read with the live Subprocessor List and the Cookie Notice.
1. Data we process
| Category | Examples | Source |
|---|---|---|
| Account and identity | name, email, username, password hash, organisation role | you or your organisation |
| Subscription and payment | plan, invoices, payment status, billing address; card data is handled by Stripe | you / Stripe |
| User Content and activity | audio/files, music metadata, prompts, analyses, Outputs, project settings, sharing choices, rights confirmations | you or collaborators you authorise |
| Technical and security | IP address, device/browser, logs, timestamps, authentication events, abuse signals | your use of the Service |
| Communications | support requests, feedback, copyright notices and complaint correspondence | you / reporters |
| Marketing preferences | consent, unsubscribe status, campaign interactions | you / email provider |
Do not upload special-category personal data or personal data about others unless you have a lawful basis and have provided required notices. Audio may incidentally contain voices or other personal data; treat it accordingly.
Google Sign-In and Google user data
You may choose to create or access a Jam account using Google Sign-In. When you do so, Jam requests only the standard Google identity permissions: openid, email and profile. Through those permissions, Google may provide us with your Google account’s unique identifier, email address, name and profile picture, if available (together, “Google user data”). We use that data only to create or authenticate your Jam account, associate the account with your chosen sign-in method, prevent account abuse, provide account support, and communicate necessary service information.
Jam does not request access to the contents of Gmail, Google Drive, Google Calendar, Google Photos, YouTube, contacts, or any other Google account content. Jam does not sell Google user data; use it for advertising, profiling or interest-based advertising; make it available to data brokers; or use it to train or fine-tune artificial-intelligence or machine-learning models.
We disclose Google user data only to service providers that need it to operate and secure Jam (for example, our authentication, hosting, database and support providers), under contractual confidentiality and security obligations; where you direct us to do so; where required by law; or in connection with a corporate transaction as permitted by applicable law. We do not otherwise transfer Google user data to third parties.
We retain Google user data while your Jam account is active and for the deletion and backup periods described in Section 5, unless a longer period is required by law or needed to establish, exercise or defend legal claims. You may request deletion of your Jam account by emailing contact@withjam.ai and may review or revoke Jam’s Google access through your Google Account security settings. Revoking Google access does not itself delete your Jam account; contact us if you want your account deleted.
Google’s processing of your account information is governed by the Google Privacy Policy. Jam’s use of Google user data is subject to the Google API Services User Data Policy, including its Limited Use requirements where applicable.
2. Why we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts, process files, deliver analyses/Outputs, administer plans and support | Performance of contract (GDPR Art. 6(1)(b)) |
| Prevent fraud, secure the Service, diagnose incidents, enforce terms, manage legal claims | Legitimate interests (security, service integrity, legal protection), balanced against your rights; or legal obligation where applicable |
| Invoices, tax and compliance records; responding to valid legal requests | Legal obligation (Art. 6(1)(c)) |
| Optional marketing and non-essential cookies | Your consent (Art. 6(1)(a)); you can withdraw it at any time |
| Optional service analytics | Your consent (Art. 6(1)(a)); we do not activate non-essential analytics until you consent through the Cookie Notice |
We do not sell personal data, display advertising, or use User Content, recordings or Outputs to train or fine-tune AI/ML models. We may use aggregated or de-identified technical usage and performance data to operate, test and improve the Service. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you, unless we tell you otherwise and provide the required safeguards.
3. Who receives data
We use carefully selected processors to provide website delivery and security, hosting, storage, infrastructure, payments, email, support, consent-based analytics and audio-analysis inference. Our current processors are Cloudflare, Vercel, Supabase, Modal, Resend and Stripe; see the live Subprocessor List for their functions and relevant location information. They process data only on our documented instructions and under appropriate contractual safeguards.
We may disclose data to professional advisers, insurers, corporate transaction counterparties, competent authorities, or others where required by law or necessary to establish, exercise or defend legal claims. Publicly shared projects/Outputs are visible to anyone with the applicable public or unlisted link; unlisted links may be forwarded.
4. International transfers
Jam uses providers that may process personal data in the European Economic Area, the United States and other countries where they or their subprocessors operate. Jam’s primary database, authentication service, file storage and related backups are hosted through Supabase in Central EU (Frankfurt, eu-central-1). Jam’s Vercel server-side execution is configured for Washington, D.C., USA (East, iad1). Jam’s audio-analysis compute uses Modal without an explicit code-level region setting, so related processing and certain logs or durable storage may occur in the United States. Where a processor or remote access involves a country outside the EEA, we use an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where required, supplementary measures and a transfer assessment. You may request information about applicable safeguards at contact@withjam.ai.
5. Retention
We retain data only as long as necessary for the purposes above:
| Data | Retention rule |
|---|---|
| Account profile and private projects | account life, then deleted within 30 days after a verified deletion request, subject to backup and legal-retention periods |
| Public content | until unpublishing/deletion, then deleted within 30 days, subject to backup and legal-retention periods |
| Backups | normally deleted or overwritten within 35 days after the applicable deletion event, unless a provider’s documented backup process or legal obligation requires a longer period |
| Security logs | up to 90 days, unless required longer to investigate a security incident or comply with law |
| Support and copyright/takedown records | 5 years after closure, or longer where necessary for claims or law |
| Invoices/tax records | 10 years from the close of the relevant accounting year, where required by French law |
Aggregated or genuinely anonymised information may be retained longer because it no longer identifies you.
6. Your rights
Subject to conditions and limits in applicable law, you may request access, correction, deletion, restriction, objection (including to processing based on legitimate interests), portability, and withdrawal of consent. Contact contact@withjam.ai. We may need to verify identity and will respond within the applicable statutory period. You may complain to your local data-protection authority; EEA authorities are listed by the European Data Protection Board.
7. Security
We use technical and organisational measures designed for the risk, such as access controls, encryption in transit, encryption at rest for data stored in our managed database, storage and service-provider systems, logging, backups and vendor assessment. No system is completely secure; please use strong unique credentials and report concerns to contact@withjam.ai.
8. Children
The Service is not directed to children under 16. If you believe a child provided data without required authorisation, contact us at contact@withjam.ai.
9. Changes
We will post updates here and change the effective date. For material changes, we will provide additional notice where required.
