Data protection policy

Version of 19/08/2026

This English version is provided for information purposes only. In the event of any discrepancy or conflict between this translation and the French version, the French version shall prevail.

Preamble

This Privacy Policy is intended to inform Website users about:

how their personal data are collected. Personal data means any information that can identify a user. This may include their first name and surname, age, postal or email address, location or IP address, among other information;
the rights they have in relation to those data;
the person responsible for processing the personal data collected and processed;
the recipients of those personal data.

This Policy supplements the Legal Notice, the Cookie Policy and the Terms of Use of the Service.

1. Principles governing the collection and processing of personal data

In accordance with Article 5 of Regulation (EU) 2016/679, personal data must be:

processed lawfully, fairly and transparently in relation to the data subject;
collected for specified (see Article 2 of this Policy), explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
processed in a manner that ensures appropriate security of the data collected, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Processing is lawful only if and to the extent that at least one of the following conditions applies:

the data subject has consented to the processing of their personal data for one or more specific purposes;
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject’s request before entering into a contract;
processing is necessary for compliance with a legal obligation to which the controller is subject;
processing is necessary in order to protect the vital interests of the data subject or of another natural person;
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, in particular where the data subject is a child.

2. Personal data collected and processed when using the Website and the Jimini AI application

2.1: Data collected

The different types of data collected on our Website and application should be distinguished as follows:

information relating to any visitor to https://www.jimini.ai/;
personal information relating to our prospects, customers and Jimini AI account holders;
connection and usage data relating to our prospects, customers and Jimini AI account holders;
use of data contained in documents uploaded to a personal or company library in the Jimini AI application;
use of User Prompts and responses provided by Jimini AI following a User request;
use of data collected through connectors to customer databases;
use of data collected through the Microsoft “Jimini for Word” and “Jimini for Outlook” add-ins.

2.1.1 Data relating to any visitor to https://www.jimini.ai/

a) General data

Data processed: Every visitor’s Internet browser sends the following information by default, which we therefore collect automatically:

the operating system used by your device (Windows, macOS, Android, iOS, etc.);
the Internet browser used and its language;
your IP address;
the time of your visit;
technical information about your type of device (computer, smartphone, etc.);
where applicable, the website that referred you to jimini.ai.

Purpose of processing: These data are processed in order to improve the Website visitor’s experience.

Legal basis: The collection and use of this information are based on consent under Article 6(1)(a) GDPR.

Retention period: Browsing data are retained for one (1) year. The lifetime of each cookie is specified in our Cookie Policy.

b) Data relating to Users wishing to join the Waitlist

Data collected: When a User completes the Waitlist contact form, they will be asked to provide their first name, surname, telephone number and email address.

Legal basis: Personal data collected through the Waitlist contact form are processed on the basis of the User’s explicit consent, expressed when the form is submitted, in accordance with Article 6(1)(a) GDPR.

Purpose of collection: These data are used exclusively to contact the User and provide information about our solutions or facilitate their subscription.

Retention period: They are retained as part of our record of messages received until you exercise your right to erasure, or for a maximum period of three years from receipt of the form.

The Company may retain certain personal data beyond the periods stated above in order to meet its legal or regulatory obligations.

2.1.2 Personal information relating to our prospects, customers and Jimini AI account holders

Data processed: To access Jimini AI features, you must create an account under the conditions set out in the Terms (the “Account”). As stated in our Terms, the Account may be linked to a subscription or a free trial. Creating an Account requires the following information so that we can verify your identity, provide and secure access to the Website:

your first name and surname;
your professional email address;
the name of your organisation.

Recipients of the data: We transfer some of your information—your first name and surname and the name of your firm—to Auth0 by Okta, our secure authentication provider, in order to improve the security of your connection data. Okta stores its user information on AWS servers located in Europe. Your password is retained only by our provider and only until you delete your Account.

Legal basis: The collection and use of this information are necessary for performance of our Terms in accordance with Article 6(1)(b) GDPR.

Billing data: For the payment of invoices by bank transfer, we collect and process only the data strictly necessary, namely: first name and surname or company name; bank details (IBAN/BIC); amount and invoice references. These data are retained for the statutory accounting period of ten years from the end of the relevant financial year, in accordance with Article 6(1)(c) GDPR.

Certain Jimini AI support features require us to collect information about you: the matters you create, your contact details so that we can send newsletters personalised for your organisation, and your request history. To manage feedback you send us, we also collect your first name and surname and the content of that feedback, including product improvement suggestions or reported errors.

Retention period: Providing this information is necessary to access the Service. It is retained for one year after your last visit to the Website or your last click on a link in our emails, or until you delete your Account using the dedicated function on the “Settings” page. Deletion of your Account through that function is completed within one day. Aggregated usage data are deleted from our database within one month after your Account deletion request.

2.1.3 Connection and usage data relating to our prospects, customers and Jimini AI account holders

Data processed: When you use the Jimini.ai application, we also collect certain information about your activity, such as when you click a button, copy text, print or download a page. This information is first pseudonymised, then sent to our provider PostHog for User behaviour monitoring and analysis, and is accessible only to our dedicated Product team.

Legal basis: The collection and use of this information are based on consent under Article 6(1)(a) GDPR.

Necessity of collection: The User may choose not to provide these data by refusing PostHog cookies.

Purpose of processing: Activity is analysed to improve and personalise the Service, understand how the Website is used and develop the product accordingly.

Retention period: One (1) year. The lifetime of each cookie is specified in our Cookie Policy.

2.1.4 Use of data contained in documents uploaded to the personal or company library in the Jimini AI application

Data processed: When using the Jimini AI application, Users may upload and store documents in their personal or company library.

Raw files and their content are stored in a secure database. Files are encrypted at rest and in transit and stored separately for each User or Organisation. Access to documents is strictly controlled through a secure authentication system (Auth0 by Okta) and subject to the principle of least privilege. Documents may be indexed and split into paragraphs to facilitate searches and access to information.

No model training using documents: Documents uploaded to the personal or company library and their content are under no circumstances used to train or retrain Jimini AI’s artificial intelligence models or those of its providers. They are used exclusively to provide Service features, including viewing, search, analysis and interaction with your content, and where applicable for technical operations necessary to provide the Service.

Purpose of processing: Storing and processing documents allows Users to view, search, analyse and interact with their own content through Jimini AI features.

Necessity of collection: Users may anonymise these documents if they wish or upload only documents that contain no personal data.

Legal basis: Processing is necessary for performance of the agreement between the User and Odysai under the Terms, in accordance with Article 6(1)(b) GDPR.

Categories of recipients: Documents are not shared with third parties unless this is necessary for specific technical requirements, including hosting by Scaleway, or to comply with a legal obligation.

Retention period: Documents are retained for as long as the User’s account remains active. When the account is deleted, documents are deleted within 30 days.

2.1.5 Use of User Prompts and responses provided by Jimini AI

Data processed: The content of Prompts entered by the User and responses generated by Jimini AI.

Purpose: To process the User’s request and generate a response using the artificial intelligence models employed by the Service.

Legal basis: Article 6(1)(b) GDPR, performance of the agreement entered into with the User.

Recipients: Depending on the circumstances, Prompts and responses are sent to the following model providers: Mistral AI SAS, OpenAI (European deployment), and Google Cloud Vertex AI for Anthropic Claude models. All these providers host the relevant processing within the European Union and are bound by a Zero Data Retention Agreement guaranteeing that Customer Data are not retained and are not used to train models.

Retention period: Prompts and responses are retained for the lifetime of the User’s account. When the account is deleted, they are deleted within thirty (30) days. The User may delete a conversation from their personal area at any time.

2.1.6 Use of data collected through connectors to customer databases (Google Drive, SharePoint, etc.)

Data processed: When using Jimini AI, Users may activate connectors linking the tool directly to certain internal databases, including Google Drive. When a connector is activated, only data strictly necessary for the features to operate properly are collected. These include files selected by the User in their database and the necessary technical metadata, such as connection identifiers and timestamps.

Purpose of collection: Files and data collected through connectors are used exclusively to perform features requested by the User, such as search, analysis or assisted drafting. Processing is temporary and does not involve storing data on our servers beyond the time required for processing.

Files and data accessible through connectors, including Google Drive and SharePoint, are not used to train or retrain Jimini AI’s artificial intelligence models or those of its providers.

Legal basis: Processing is necessary for performance of the agreement between the User and Odysai under the Terms, in accordance with Article 6(1)(b) GDPR, and is also based on the User’s explicit consent when activating the connector.

Data collected through connectors are not shared, transferred or sold to third parties for advertising purposes. They are processed temporarily on secure servers hosted by our technical providers, including Scaleway.

Retention period: When a Google Drive connector is used, data are processed in accordance with the Google API Services User Data Policy. Google data are not accessed without authorisation, systematically explored or used for any improper purpose. Data collected through connectors are processed in real time and are not retained by Jimini AI beyond their immediate use. When the connector is disconnected or the account is deleted, all access is revoked immediately.

The User may revoke permissions granted to connectors at any time from the settings of the relevant services. All transferred data are encrypted in transit and at rest.

2.1.7 Use of data collected through the Microsoft “Jimini for Word” add-in

Purpose of data processing: When the “Jimini for Word” add-in is used, we collect and process certain data in order to provide artificial-intelligence-assisted drafting features.

Data processed: Data collected include the content of Word documents processed, interactions with the add-in such as Prompts entered and suggestions generated, and technical metadata required to use the Service, including timestamps and User identifiers.

Necessity of collection: The purpose of this collection is to facilitate assisted drafting, provide responses adapted to Users, improve the tool’s performance and provide technical support.

Categories of recipients: No data are shared with third parties except for technical hosting requirements on Scaleway or to comply with a legal obligation. Documents and related data are processed locally and temporarily sent to our secure servers for processing. All data transferred are encrypted, and appropriate technical and organisational measures are implemented to protect them.

Retention period: The content of documents sent is not stored by Jimini AI: it is processed and then discarded once processing is complete. Only the request entered and the response generated are retained for the lifetime of the User’s account, then deleted within thirty (30) days after closure. A request for earlier deletion may be made at any time.

2.1.8 Use of data collected through the Microsoft “Jimini for Outlook” add-in

Purpose of data processing: When the “Jimini for Outlook” add-in is used, certain data are collected and processed so that Users can access Jimini AI’s legal email review, analysis and drafting features from Outlook.

Data processed: Data processed may include the content of emails selected by the User, including the message body and any attachments, Prompts entered through the add-in, responses generated by Jimini AI and technical metadata strictly necessary for the Service to operate, including timestamps and User identifiers.

Necessity of collection: Processing is necessary to provide the features requested by the User, ensure response quality, improve Service performance and provide technical support.

Categories of recipients: No data are disclosed to third parties except where strictly necessary for technical hosting and secure processing by our providers, including Scaleway, or to comply with a legal obligation.

Retention period: The content of emails sent, including attachments, is not stored by Jimini AI: it is processed and then discarded once processing is complete. Only the request entered and the response generated are retained for the lifetime of the User’s account, then deleted within thirty (30) days after closure. A request for earlier deletion may be made at any time.

2.1.9 Measurement of the opening and viewing of our emails

Purpose of data processing: Some emails we send contain a tracking pixel that allows us to measure their receipt and viewing. This tracking serves two purposes. For transactional emails, including confirmations, security alerts, account notifications and password resets, and solely for deliverability measurement designed to identify inactive recipients and remove them from our lists, it ensures that our messages operate properly and reliably. For communication and information emails, measuring open and click rates allows us to personalise content and adjust sending frequency.

Data processed: We collect whether the email is opened and, where applicable, whether links within it are clicked, together with the corresponding date and time, using a tracking pixel, which is a very small image invisible to the recipient.

Necessity of collection: For our communication emails, you may refuse this tracking and withdraw your consent at any time as easily as you gave it, using the link in each email or by writing to dpo@jimini.ai. Withdrawing your consent does not affect receipt of our emails or your use of Jimini AI.

Legal basis: Tracking of transactional emails and deliverability measurement are based on our legitimate interest in ensuring the security and proper operation of our services (Article 6(1)(f) GDPR) and are exempt from consent within the meaning of Article 82 of the French Data Protection Act. Measuring opens and clicks in communication emails is based on your consent (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act), obtained when you register.

Categories of recipients: These data are not shared with any third party other than our email sending and management provider, which acts as a processor on our behalf.

Retention period: Tracking data are retained for a maximum of 13 months from the date the email is sent, then deleted or anonymised.

2.2: Data hosting and location

All your data are stored in France.

The https://app.jimini.ai platform, through which all your data pass and on which they are stored, is hosted by Scaleway, whose registered office is located at 8 rue de la Ville l’Évêque, 75008 Paris (Scaleway website), and by S3NS. Both providers operate servers physically located in France.

The https://jimini.ai website is hosted by Scaleway SAS, whose registered office is located at 8 rue de la Ville l’Évêque, 75008 Paris, France (Scaleway website). Data are hosted in data centres located in France (Paris region). Visiting this Website does not result in any audience-measurement cookie being placed or any data being stored on your device. The strictly statistical and anonymous audience-measurement processing implemented on the Website is described in Section 2.4.

2.3: Security measures implemented to protect data

Odysai makes every effort to protect its Users’ personal data. It applies rigorous organisational measures, including least-privilege access control and regular staff training on security and confidentiality. It also applies robust technical measures, including encryption of data in transit and at rest, access monitoring and regular tests to identify and remediate potential vulnerabilities. More specifically, data are encrypted using AES-256 for storage and TLS 1.3 in transit. Databases are logically segregated between Organisations. Access is logged and audited regularly, and vulnerability tests are carried out every six months.

In the event of a personal data breach within the meaning of Article 4(12) GDPR, Odysai undertakes to notify the affected User or customer as soon as possible and no later than twenty-four (24) working hours after the breach has been classified, and to notify the CNIL within 72 hours in accordance with Article 33 GDPR.

Where our customers are lawyers or law firms subject to professional secrecy under Article 66-5 of the French Law of 31 December 1971 and Article 2.3 of the French National Rules of Procedure for Lawyers, all measures described in this Section, in particular the absence of retention beyond processing (Zero Data Retention) and exclusive hosting on French infrastructure, are implemented with due regard to the absolute and public-policy nature of that obligation. Specific contractual provisions are set out in Article 6.7 of our Data Processing Agreement.

The processing described in this Section concerns only our public pages: the marketing website at https://jimini.ai and the online subscription journey at https://app.jimini.ai/self-serve. It does not apply to the Jimini platform after authentication, where no navigation tracking for marketing or advertising purposes is implemented.

a) Marketing website

To understand visitor journeys and improve our communications, we measure the audience of our pages using PostHog, hosted within the European Union.

Audience measurement on the marketing website is particularly protective: it is activated only after your consent has been obtained and operates in memory mode. No cookie, persistent identifier or data are stored on your device. No advertising profile is created, no data are sold, and no cross-referencing is carried out with data from the Jimini platform. The information collected is used solely to produce aggregated traffic statistics.

b) Online subscription journey

On the online subscription journey, subject to the conditions set out in our Cookie Policy, we use:

PostHog for audience measurement and journey analysis;
HubSpot for prospect relationship tracking, in order to link a subscription request to its source and manage commercial follow-up;
Google Ads to measure the performance of our advertising campaigns.

These tools are loaded through Google Tag Manager.

c) Linking forms to the navigation journey

When a visitor completes a form on our public pages, a technical navigation identifier (posthog_distinct_id) is sent to our form-management tool, Typeform, and then to our prospect relationship management tool, HubSpot. The sole purpose of this transmission is to link the form submission to the observed navigation journey, measure campaign effectiveness and improve commercial follow-up. This technical identifier cannot, by itself, directly identify a person and is not associated with data processed within the Jimini platform.

Campaign parameters (UTM) that may be present in page addresses (URLs) may also be collected in order to measure the source of visits.

d) Legal basis and duration

These processing activities are based on your consent, obtained through our cookie management banner (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act). You may withdraw it at any time through the cookie management module available in the footer.

Navigation data collected in this way are retained for one (1) year.

In accordance with Section 3 of this Policy, you may exercise your rights of access, rectification and erasure at any time by writing to contact@jimini.ai, or to dpo@jimini.ai for any request relating to the protection of your data.

3. Data controller and Data Protection Officer

3.1: Data controller

Personal data are collected by Odysai, a French simplified joint-stock company (société par actions simplifiée) with share capital of EUR 2,899, registered with the Nanterre Trade and Companies Register under number 949 542 013, whose registered office is located at 5 Boulevard des Bouvets, 92000 Nanterre, France, and whose offices are located at 6-8 rue Saint-Sabin, 75011 Paris, France.

The personal data controller may be contacted as follows:

By post: 5 Boulevard des Bouvets, 92000 Nanterre, France; By email: dpo@jimini.ai

3.2: Data Protection Officer

The Company’s Data Protection Officer is Auriane Roussel, who may be contacted at dpo@jimini.ai.

If, after contacting us, you consider that your rights under French data protection law have not been respected, you may lodge a complaint with the CNIL.

4. User rights concerning the collection and processing of personal data

Any User concerned by the processing of their personal data may exercise the following rights under Regulation (EU) 2016/679 and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties:

right of access, rectification and erasure (Articles 15, 16 and 17 GDPR respectively);
right to data portability (Article 20 GDPR);
right to restriction (Article 18 GDPR) and to object to processing (Article 21 GDPR);
right not to be subject to a decision based solely on automated processing;
right to determine what happens to their data after death;
right to lodge a complaint with the competent supervisory authority (Article 77 GDPR).

To exercise your rights, please email dpo@jimini.ai.

To enable the data controller to act on their request, the User may be required to provide certain information, including their first name and surname, email address and account, personal area or subscriber number.

Visit CNIL website for more information about your rights.

5. Amendments to this Privacy Policy

The Website publisher reserves the right to amend this Policy at any time in order to ensure that it complies with applicable law.

Any amendments will not affect purchases previously made on the Website, which remain subject to the Policy in force at the time of purchase and accepted by the User when confirming the purchase.

The User is invited to read this Policy each time they use our services, without any formal notice being required.

This Policy was issued on 31 July 2024 and updated on 19/08/2026.