Privacy Policy
Version 2026-09-17
Scope
The privacy of your data, and it is your data rather than ours, matters to us. This policy sets out what we collect and why, how it is handled, and your rights over it. We have never sold personal information and we will not.
This policy covers the Jean API, the Jean console at jeantechnologies.com, our documentation, and this website. In it, “we” and “us” mean Jean Technologies, and “you” means a site visitor, a prospective customer, or a customer and its authorized users.
This policy does not cover information about your own end users that you send us for processing through the API. We process that material under your instructions. You are the controller of it and we are the processor, and our obligations over it are set by our terms of service and any data processing addendum we have signed with you. If you are the end user of one of our customers and you have questions about your information, please contact the organization that gave it to us.
What we collect and why
Our guiding principle is to collect only what we need. In practice that means:
Identity and access
Sign-in runs through Google Identity Platform. We never see or store a password. What we keep from sign-in is the user id the identity provider gives us, your email address, and the organization you belong to. That is the whole account record.
We use your email address to send you the essential information that comes with running an account: service notices, policy changes, and answers to things you have asked us. We will not use your name or your company in marketing without your permission.
Organizations and API keys
Every account belongs to an organization, and the organization owns what is created under it: keys, submissions, results, usage records and settings.
An API key belongs to the organization rather than to the person who created it. The full key is shown once, at creation. After that we store only a hash of it, so we cannot show it to you again and we cannot recover it. A lost key is revoked and replaced, not retrieved.
Billing information
Billing during early access is arranged with you directly. We keep what we need to invoice you and to meet our tax and accounting obligations: a billing contact, a billing address, and a record of each transaction. We do not store full card numbers.
What you submit to the API
When you send work to the API, we store the submission for as long as we need it to compute the score you asked for, and we store the result and the job trace it produced. How that material may be used is set by your organization’s data use setting, described in the next section.
Usage and audit records
Every API request is metered, one record per request. That log is what billing and quotas are computed from, and it is append-only: entries are written, not edited. Administrative actions are written to a separate append-only audit log with the actor, the time, and the IP address the action came from. We keep these for security, for billing, and as business records.
Voluntary correspondence
When you email us with a question or use a form on this website, we keep that correspondence, including your email address, so that we have a history to refer back to if you get in touch again.
How we may use what you submit
Eval submissions are used only for scoring. They produce your result and your job trace, and they are used for nothing else, unless an organization owner explicitly opts into a broader setting. There are three settings:
scoring_only: submissions are used to produce your result and for nothing else. This is the default and it applies until an owner changes it.aggregate_ok: we may additionally publish aggregate statistics that include your usage.training_ok: we may additionally use your submissions to improve Jean models.
The setting is recorded per organization, not per user, together with the setting chosen, who chose it, and when. An owner can change it at any time, including back to scoring_only. A change applies from the moment it is made. It does not reach back into work already done under the previous setting.
Acceptance of our terms of service is recorded the same way: per organization, with the version accepted, who accepted it, and when.
Subprocessors
We use the following third parties to run the Services. They are the only subprocessors that handle data on our behalf:
- Google Cloud: hosting, database, and identity.
- Vercel: website hosting.
- PostHog: product analytics.
- Resend: transactional email.
If we add a subprocessor we will update this list and the same list in our terms of service.
When we access or disclose your information
To provide the service you asked for. The subprocessors listed above handle data on our behalf, under contract, for that purpose alone.
To help you with a support request. If we need to look at your content to help with a support case, we will ask for your consent before we do.
When an automated process fails partway through. We get alerts when that happens. Where we can fix it and restart without looking at your content we do. In rare cases we have to look at the minimum needed to fix it, and we then look for the root cause so that it does not recur.
To safeguard the Services. We look at logs and metadata as part of keeping the Services secure. Reaching into an account while investigating abuse is a measure of last resort.
Aggregated and de-identified data. We may aggregate or de-identify information collected through the Services and use it for any purpose, including analytics.
When required under applicable law. Jean Technologies is a United States company and our data infrastructure is in the United States. Our policy is not to respond to government requests for customer data unless we are compelled by legal process, or in limited emergency circumstances. Where United States authorities have the necessary warrant, subpoena or court order, we must comply. We will respond to a request from an authority outside the United States only where it is compelled through a mutual legal assistance treaty or an equivalent mechanism. Our policy is to notify affected customers before we disclose data, unless we are legally prohibited from doing so. If we are audited by a tax authority we will disclose only the minimum billing information the audit requires.
If the company changes hands. If Jean Technologies is acquired by or merges with another company, we will tell you well before any personal information is transferred or becomes subject to a different privacy policy.
Your rights with respect to your information
We apply the same data rights to every customer, wherever they are. They include the right to know what personal information we collect, use and share; the right to access it; the right to have it corrected; the right to have it erased, subject to the limits in the retention section below; the right to restrict or object to how it is processed; the right to receive a copy of it and to move it elsewhere; the right not to be subject to a decision made solely by automated processing where that decision has a legal or similarly significant effect; the right not to be treated differently for exercising any of these rights; and the right to complain to a supervisory authority.
Some of this you can do yourself by signing in and editing your account. For anything else, write to jonathan@jeantechnologies.com. That address is how to reach us about privacy questions, data requests, and data processing agreements, and a person reads it.
Before we act on a request we may need to take reasonable steps to verify who you are, which at a minimum means confirming your name and email address. If an agent is writing on your behalf, we will need written authorization from the account holder first.
Certain information is exempt from these requests under applicable law, and some of it we have to keep in order to provide the service to you at all. Fulfilling a deletion request may mean closing your account, because the service cannot run without the record it removes.
How we secure your data
Data is encrypted in transit with TLS between your systems and ours. Data at rest in Google Cloud is encrypted by the platform, and our database backups are encrypted.
API keys are never stored in a form we can read. We store only a hash, which is why we can verify a key you present but cannot show you one you have lost.
Results and job traces are stored under access rules that make them readable only by the organization that produced them.
If you believe you have found a security problem in the Services, write to jonathan@jeantechnologies.com and we will get back to you.
Data retention and deletion
Concretely:
- Files you upload are deleted after thirty days.
- Results and job traces are retained, so that a score you were given stays something you can go back and check.
- Account records are kept for as long as the organization’s account is active.
- Usage records and the audit log are kept as business records, including after an account is closed.
An organization owner can ask us to delete the organization by writing to jonathan@jeantechnologies.com from the owner address. We remove the organization’s account records, its submissions, and the results and traces stored for it. The usage records and the audit log survive that deletion, as described above. Beyond these specific periods, we keep information only for as long as the purpose we collected it for requires, and for as long as we need it to meet a legal obligation, resolve a dispute, or enforce our agreements.
Location of site and data
The Services run on Google Cloud in the United States. If you are in the European Union, the United Kingdom, or anywhere else outside the United States, please be aware that the information you give us will be transferred to and stored in the United States. By using the Services or giving us your personal information, you consent to that transfer.
Transfers from the EU and the UK
Personal data transferred out of the European Union must be given the same protection it has under EU law, and UK law provides similar safeguards. If the EU General Data Protection Regulation or the UK General Data Protection Regulation applies to your use of the Services, write to jonathan@jeantechnologies.com and we will put a data processing addendum with Standard Contractual Clauses in place before you send us personal data.
Changes to this policy
We may update this policy to reflect new practices or to comply with regulation. The effective date and the version at the top of this page say when it last changed. When a change is material we will say so to account owners rather than quietly editing the text.
Contact
Questions, requests and complaints about this policy or your information go to jonathan@jeantechnologies.com, and a person reads that address. The companion document is our terms of service.