Privacy Policy

• Email: privacy@jamcontent.com
• Post: Jam Content Pty Ltd, 7 Mitchell St, Marrickville NSW 2204, Australia

Jam Content Pty Ltd is the controller of your account, billing, support and website data, and the processor of the content our customers store in Jam. We are based in Australia. Our appointed representative and privacy contact for the EU and UK is Mikey Stojcevski, reachable at the email address above, which handles requests from every country.

• Customers and their teams. Businesses that sign up for Jam and the people they invite. We are responsible for your account, billing, support and usage information.
• Contributors and audiences. People who upload to a customer's form, appear in a customer's photos, visit a customer's gallery or Link in Bio page, or interact with a customer's social accounts. The customer decides what is collected and why; we process it on their instructions ("Customer Content"). Their privacy notice applies to you first, and you should contact them to exercise your rights. We will help, and we pass on any request we receive.
• Website visitors. Anyone reading jamcontent.com. See the Cookie Policy.

We never load analytics or advertising tags on the galleries, forms, Link in Bio pages, share links or embeds our customers publish. Those visitors are our customers' audiences, not ours.

• Account: name, email, profile picture, phone if you add one, company, time zone, role and workspaces. Passwords are held by our identity provider, never by us. Google sign-in gives us your name, email and picture.
• Billing: plan, invoices, billing address and tax identifiers. Card details are held by Stripe; we never see your full card number.
• Support: emails and in-app Live Support chats, including attachments.
• Customer Content: photos, videos, designs, captions, notes, tags, collections, calendars, approvals, form submissions, and what Jam derives from them: people, faces and transcripts.
• Social accounts: when a customer connects Facebook, Instagram, Threads, Messenger, LinkedIn, TikTok, X, Pinterest, YouTube or Google Business Profile we hold the encrypted access tokens and, depending on the platform, posts, comments, messages, mentions, follower counts, audience demographics (age bands, gender, country and city) and the public profiles of people who interact with the account.
• Connected storage and integrations: only the files and metadata a customer chooses to import from or send to Google Drive, Dropbox, Microsoft 365, Shopify, Canva or Unsplash.
• Usage and technical data: for signed-in users, which features are used, errors and page performance; for public upload forms, upload progress diagnostics with no file names; on our servers, IP address, request path, time and browser type for security. Your IP address also picks the nearest storage region for uploads, without being kept for that purpose.
• Cookies and local storage: listed in full in the Cookie Policy.

Jam's People feature finds faces in a workspace's photos and videos and groups ones that look alike, the same way it makes thumbnails and tags. A group is shown as an unnamed suggested person and identifies no one. Labelling is opt-in and manual: a name is attached only when someone in the workspace, or a contributor the customer invites, types it. Jam never looks names up anywhere and never matches faces across customers. A workspace Owner can ask us to switch face grouping off, which deletes the face data.

• We keep a numerical face template (not a picture) and its position, generated on our own infrastructure and never sent to a third-party face service.
• Face data is used only to organise and search the workspace that owns it, and for the optional Find my photos gallery feature, where a visitor who ticks a consent box takes a selfie that is compared once and never stored.
• We never use it for advertising, surveillance, law enforcement or training models for other customers, and we never sell it.
• It is deleted with the photo or video it came from, when a person is deleted, when grouping is switched off, when the workspace is closed, and in any case within three years of the workspace’s last activity. Annex A is our written retention and destruction policy.

Customers are responsible for telling the people in their content that faces are grouped and named, and for obtaining consent where the law requires it; see our Terms, Annex B. To have your face data removed from a customer's workspace, contact that customer, or us if you cannot reach them.

Jam uses machine-learning models to draft captions and replies, edit and extend images, search by meaning, and transcribe video. These features run only when a user triggers them or a customer has turned them on, and send only the content needed for that request to the AI providers listed in section 7. Our contracts prohibit those providers from using Customer Content to train their models, and we do not use it to train models for other customers either. AI output can be wrong; customers review it before publishing.

• To provide the Services: storing, organising, editing, scheduling and publishing content, and acting on connected accounts as directed.
• To sign you in, keep accounts secure and prevent abuse.
• To bill you and meet tax and accounting obligations.
• To answer support requests.
• To understand how Jam is used and fix what is slow or broken (signed-in users and jamcontent.com visitors only).
• To email customers and leads about Jam. Every email has an unsubscribe link. We never email our customers’ contributors or audiences.
• To comply with the law and enforce our Terms.

Under the EU and UK GDPR we rely on our contract with you for the Services and billing, on legitimate interests for security, support, product analytics and customer marketing (with opt-out), on consent where the law requires it (including the explicit consent a customer obtains before faces are grouped and labelled), and on legal obligation for tax and compliance. In Australia we collect sensitive information such as face data only with consent.

• The sub-processors that host and run Jam, listed below and bound by contracts limiting what they may do.
• Social platforms and integrations a customer connects, when the customer publishes, replies, imports or exports. They are independent controllers under their own policies.
• Other members of the workspace, and sibling workspaces the customer shares with.
• Regulators, courts and law enforcement where the law requires it; we review every request and tell customers where we are allowed to.
• A successor if Jam is sold or merges, under this policy.

We do not sell personal information. The only sharing for cross-context advertising is the Meta Pixel on jamcontent.com, which you can opt out of (section 11).

Customer media is stored in the region nearest the workspace: Australia, the United States or the European Union. Our main database, identity, billing and search run in the United States and Australia. Because we are an Australian company, information about people in the EU and UK leaves those areas; we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, for certified US providers, the EU-US Data Privacy Framework, and we take the steps Australian Privacy Principle 8 requires. Face templates for every region are currently indexed in the United States and clustered in Singapore under the same safeguards. A copy of the clauses is available on request.

Information is encrypted in transit and at rest, social tokens are additionally encrypted with keys in a managed vault, access is role-based and scoped to a workspace, reset and invite links expire quickly, and we keep point-in-time database recovery and geo-redundant media storage. Our staff access Customer Content only to support a customer at their request or to investigate abuse. If a breach is likely to cause serious harm we notify affected people and the relevant regulator within the time the law sets (72 hours in the EU and UK).

Wherever you live you can ask us to access, correct, delete or export your personal information, to restrict or object to how we use it, and to withdraw consent. Email privacy@jamcontent.com; we verify your identity and reply within 30 days (one month in the EU and UK, 45 days in California), free of charge. If you are a contributor or audience member of a customer we forward the request to them and help them respond.

• Australia: access and correction under APPs 12 and 13; complaints to us, then the OAIC (oaic.gov.au).
• EU and UK: the GDPR rights above, plus a complaint to your national authority or the ICO (ico.org.uk). Face templates are special-category data; the customer enrolling them must have your explicit consent. We make no automated decisions with legal effects.
• United States: residents of California and other states with privacy laws may know, access, correct, delete and port their information, opt out of sale, sharing and targeted advertising, limit use of sensitive information, use an authorised agent, and appeal a decision by emailing us. We do not sell personal information. In Illinois, Texas and Washington, the customer must obtain the written consent those laws require before faces are grouped; Jam never sells biometric data and destroys it under Annex A.

Jam's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube features use YouTube API Services and are subject to the YouTube Terms of Service and Google Privacy Policy; you can revoke Jam's access in your Google security settings. Our use of Meta data follows Meta's Platform Terms. To delete the data we hold from any connected platform, disconnect the account in Settings, Socials, or email privacy@jamcontent.com; we delete it within 30 days and confirm by email.

Jam accounts are for people aged 18 or over, and we do not knowingly collect information from children under 16 as a controller. Customers who collect content from or depicting children are responsible for parental consent where the law requires it.

We update this policy when our practices or the law change; the effective date above shows the current version. For material changes we give workspace Owners at least 30 days' notice by email and in the app.

Questions, requests and complaints:

• Email: privacy@jamcontent.com
• Post: Jam Content Pty Ltd, 7 Mitchell St, Marrickville NSW 2204, Australia

This is Jam's public written policy for face templates and person groupings created by the People feature, published to meet the Illinois Biometric Information Privacy Act and similar laws.

1. Face templates are generated automatically from content a customer uploads and grouped without any name. Labelling is a manual, opt-in act by the customer or a contributor they invite; Jam never assigns a name. The customer obtains any notice and consent the law requires.
2. Templates are used only to group and find faces within the workspace that created them, to let contributors name their own uploads, and for Find my photos where a gallery owner has enabled it.
3. Templates are never sold, leased, traded, used for advertising, shared with other customers or disclosed to anyone other than the sub-processors that host our infrastructure.
4. A template is permanently destroyed, within 30 days and from backups as they roll over, when the source media is permanently deleted, the person group is deleted, a workspace Owner asks us to switch grouping off, the workspace is closed, or a person in the content asks for deletion and the customer confirms.
5. Regardless of the above, a template is destroyed when its purpose is satisfied or within three years of the workspace’s last activity, whichever comes first.
6. Find my photos selfies are compared once in memory and never written to storage.
7. Templates are stored encrypted, in a per-workspace index with role-based access, and protected to at least the standard we apply to other confidential information. This policy is reviewed at least annually.