Privacy policy

This English version is a translation; the French version prevails in the event of any discrepancy. The reference text is available on the French version of this page.

Article 1 — Identity of the Data Controller

Your Data is processed by JUST AI, a simplified joint-stock company (SAS) with a share capital of €2,275, registered with the Evreux Trade and Companies Registry under number 882 522 436, with its registered office at 71 rue Marcel Paul, 27000 Evreux, France. JUST AI publishes and operates the website justai.fr (the justai.co domain redirects to it), dedicated to AI consulting, engineering and training services (hereinafter the “Website”), and an inference API giving access to artificial intelligence models (the “API”). JUST AI acts as data controller within the meaning of the General Data Protection Regulation (“GDPR”), except where it acts on behalf of its customers. Its role for the content of requests sent to the API is set out in Article 11.

The purpose of this personal data protection policy is to explain: what personal data we collect from you and how we use it; what your rights are regarding the personal data we collect and process; how we protect your data.

For any questions regarding this policy, including any request relating to your legal rights, please contact us at: privacy@justai.co

Using our API? Everything about it is in Article 11.

Article 2 — Personal Data Collected

Personal Data is information that directly or indirectly identifies a natural person. We collect different types of Personal Data in connection with the use of our Website and Services.

1. Data you provide directly

• Identity and account data: last name, first name, email address, phone number, position, industry sector, billing information, login credentials.
• Contractual data: information related to your contract (subscription category, payment methods, invoices).
• Contact and communication data: when you agree to receive our communications or when you contact us (assistance, technical support, complaint, incident report).

2. Data collected automatically

• Technical and usage data: IP addresses, session identifiers, connection data, configuration settings, interaction history, performance metrics and response times, cookies (excluding the API: see Article 11).
• Support relationship data: usage volume, amounts and frequency, customer service correspondence, usage history, cancellations, comments and complaints.
• Origin of a contact request: when you submit the contact form, it sends along with your message the page of our site you viewed just before the form, the page on which you entered our site and, where available, only the domain name of the site you came from (for example a search engine), never the address of the page you viewed there. We use this information to know which content on our site brings in requests. It is only sent when you submit the form, relies on no cookie or storage in your browser, and disappears at the latest when you close the tab.

Article 3 — Conditions of Use of Personal Data

We will only collect Personal Data about you if there is a reason to do so and if the law authorizes it or with your consent. We may collect personal information about you for the following purposes:

• Manage your access to and use of our Website and Services
• Manage our relationship with you and provide you with Services
• Improve the Website and the quality of Services
• Resolve technical issues related to the Website and Services
• Send information about our Services and offers, if you have chosen to receive such information
• Handle any claims and disputes
• Prevent fraud, protect and secure the Website against cyber attacks
• Comply with our legal and regulatory obligations, particularly in terms of billing and accounting

These data processing activities are based on the following legal bases: (i) the performance of a contract or pre-contractual measures, (ii) legitimate interest, (iii) consent, particularly for marketing communications, or (iv) a legal obligation. For contacts at our business customers and prospects, managing the business relationship is based on our legitimate interest; performance of a contract applies only where you are yourself a party to the contract.

Article 4 — Data Transfers

We undertake not to sell, exchange, rent or transfer in any way your Personal Data to third parties without your consent. The only cases in which your Personal Data may be transmitted to third parties are:

• For the execution of requests to the inference API (Article 11) and the hosting of the Brio platform (app.brio.eu): transfers to our service providers located exclusively in the European Union and the European Economic Area
• For our business email (@justai.co addresses, including privacy@ and contact@: exchanges with customers, support, billing): Google Workspace, provided by Google Ireland Limited; data may be processed by Google LLC in the United States, under the safeguards provided by Google (standard contractual clauses adopted by the European Commission and the EU–U.S. Data Privacy Framework)
• For billing and accounting: disclosure to our billing and accounting providers, limited to what these purposes require
• For the justai.fr website only: transfers to our technical service providers, including those described below, some of which are established outside the European Union
• For the API: return of the response to the sender of the request, i.e. the customer contracting directly with JUST AI or, where the API is offered through a third-party platform, that platform (Section 11.9)
• Where required by law
• With your consent or at your request

For the justai.fr website only: emails from the Website's forms are sent through the Resend service, operated by Plus Five Five, Inc. (United States), under the standard contractual clauses adopted by the European Commission; videos embedded on the Website are hosted by YouTube (Google) (see Article 10); the redirection of the justai.co domain to justai.fr is provided by Webflow (United States).

Article 5 — Promotional Offers

If you are a business, we may send you commercial information by email related to your professional activity, unless you object. If you are an individual consumer, we only do so with your prior consent, except for products or services similar to those you have already purchased from us. If you no longer wish to receive such messages, you can change your settings at any time by clicking the unsubscribe link at the bottom of each promotional email.

Article 6 — Retention

We will not retain your information longer than necessary for the purposes of the Website and Services, taking into account our legal and contractual obligations.

Article 7 — Security

We take appropriate technical and organizational measures to protect your Personal Data against unauthorized access, unlawful processing, accidental loss, destruction and damage.

If you believe your account, data or access credentials are no longer secure, please notify us immediately at: privacy@justai.co

Measures specific to the API are described in Section 11.10.

Article 8 — Your Legal Rights

You have certain legal rights regarding your Personal Data:

• Right of access: You may request access to the Personal Data we hold about you.
• Right of rectification: You may ask us to correct, modify or delete any inaccurate Personal Data.
• Right of erasure: You may ask us to delete any Personal Data.
• Right to restriction: You may ask that the processing of your Personal Data be temporarily frozen, for example while its accuracy is being verified.
• Right of objection: You may withdraw your consent or object at any time to the processing of your Personal Data.
• Right of portability: You may have the right to obtain your Personal Data in an accessible format.
• Right to define directives: Regarding the retention, erasure and communication of your Personal Data after your death.

To exercise any of your legal rights, please contact us at: privacy@justai.co

If your request is not resolved satisfactorily, you may contact the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

For the content of requests sent to the API, see Section 11.11.

Article 9 — Policy Amendments

We reserve the right to modify this Personal Data policy. In the event of a significant change affecting your rights, we will inform you in advance, by email where we have your contact details and, in all cases, by a notice on this page showing the new version date. Changes concerning the API follow Section 11.14. Each published version is archived and provided on request. In any case, this document is accessible at any time from our Website.

Article 10 — Cookies and Similar Technologies

What is a cookie?

A cookie is a small text file placed on your device when you browse the Website. It allows your browser to be recognized and certain information to be memorized.

Cookies placed by JUST AI

We place no audience measurement cookies and no advertising cookies. The only cookies we use, where our services need them, are the following:

• Strictly necessary cookies: Essential for the operation of the Website (authentication, session management, security).
• Preference cookies: Remember your choices and usage preferences.

Embedded YouTube videos

Some pages of the Website embed videos hosted by YouTube (Google), in particular video articles on the blog and testimonials. When you view these pages or play one of these videos, your browser connects to YouTube's servers, which receive your IP address and may place their own cookies on your device. These cookies are managed by Google under its own privacy policy.

Managing your cookie preferences

You can block or delete cookies at any time, including YouTube's, via your browser settings. The cookies we place have a limited lifespan, with a maximum of 13 months for persistent cookies, in accordance with current regulations.

Article 11 — JustAI Inference API

11.1. Scope and definitions

JUST AI provides an application programming interface (the “API”) for sending requests to open-weight artificial intelligence models run by JUST AI and receiving their responses. JUST AI sells the API directly to businesses, under a contract entered into with JUST AI. The API may also be offered through third-party intermediary platforms (“Platforms”), for example OpenRouter, operated by OpenRouter, Inc., a company established in the United States. The provisions of this article concerning Platforms apply only where the API is offered through one of them.

This article describes the processing of data related to the API. For that processing, it supplements Articles 1 to 10 and prevails over them in the event of conflict.

In this article:

• Customer means the party that has entered into a contract with JUST AI for the API: a business that contracts directly (“Direct Customer”) or, where the API is offered through it, a Platform. When the API is used through a Platform, JUST AI's Customer is the Platform (for example OpenRouter, Inc.), not its users.
• User means anyone who sends requests to the API, directly or through a Platform. Users of a Platform enter into their commercial contract (sign-up, pricing, billing) with that Platform. The Platform's terms may require them to comply with the terms of each model and provider, including JUST AI's API Terms of Service.
• Content means the data sent in a request (instructions, messages, documents, images or other inputs, known as “prompts”) and the responses generated by the model (“completions”).
• Metadata means the technical information describing a request, excluding any Content, as listed in Section 11.3.

11.2. Who is responsible for what

• Content. JUST AI processes Content solely to execute the request and return the response, and for no purpose of its own. Toward its Direct Customers, it acts as a processor within the meaning of Article 28 GDPR, under the data processing agreement annexed to the API Terms of Service. Where the API is offered through a Platform, its role toward that Platform is defined by the agreement entered into with it. Whatever that role, the commitments in Sections 11.5 and 11.6 apply. In practice, we are the engine that computes the response: we choose neither what is sent to us nor what is done with the response. Whoever sends Personal Data in a request is responsible for having a legal basis and for informing the individuals concerned.
• Metadata, account, billing and security data. JUST AI acts as data controller, because it processes these data for its own purposes: billing, securing the service, measuring its quality and complying with its legal obligations.

11.3. Data processed

a) Content. Depending on what the User chooses to send, Content may include Personal Data of the User or of third parties, including special categories of data within the meaning of Article 9 GDPR. No JUST AI staff member looks at Content. Please send only the Personal Data a request actually needs. JUST AI does not hold the French Health Data Hosting (HDS) certification and does not enter into Business Associate Agreements under the US HIPAA rules. The API must therefore not be used for health data where regulations require a certified host or other specific safeguards.

b) Metadata (complete list):

• timestamp and request identifier;
• model called;
• generation parameters (temperature, maximum tokens, etc.);
• input and output token counts;
• latency, time to first token and throughput;
• status code and, where applicable, error type;
• Customer identifier and identifier of the API key used;
• connecting IP address. For a request sent through a Platform, this is the address of the Platform's servers, not the User's.

JUST AI does not record end-user identifiers that may accompany a request, such as a “user” field.

c) Customer data: identity and contact details of the Customer's representatives, contract and billing data, and exchanges with our support team.

11.4. Purposes and legal bases

11.5. No training on Content

JUST AI does not use Content to train, retrain, fine-tune, align or evaluate any model, to build datasets, or for any other purpose of its own. We do not sell Content, do not share it for advertising purposes and do not pass it to any other artificial intelligence provider. This commitment applies however the API is accessed. The fine-tuning work JUST AI carries out for its consulting clients is governed by separate contracts and never involves API Content.

11.6. Retention

• Content: not retained. It is processed only in memory, including graphics processor (GPU) memory, for as long as it takes to generate the response. It is never written to disk, to logs or to a database, and it is not kept once the response has been returned, with the sole exception of the in-memory prefix cache described below. To speed up computation, the inference engine may keep in GPU memory an intermediate representation of the repeated parts of recent requests (prefix cache). This cache exists only in memory, is never written to disk, cannot be viewed by anyone and is gradually replaced by that of subsequent requests. As a result, JUST AI cannot retrieve or disclose the Content of a past request, including at the Customer's request.
• Metadata: 30 days from the request, including when used for security. It is then deleted, or aggregated into usage totals (per Customer, per model and per period) from which no individual request can be retrieved.
• Usage totals used for invoicing: 10 years from the close of the financial year (Article L.123-22 of the French Commercial Code).
• Customer data: term of the contract plus 2 years (Article 6), subject to accounting obligations.
• Support. Anything you send us on your own initiative outside the API, such as an example request attached to a support email, is not API Content. It is handled as support correspondence and deleted no later than 3 months after the request is closed.

11.7. Place of processing

Models run on GPU servers owned by JUST AI, installed in France in a data center operated by DC2SCALE, a French operator that designs and runs its own data centers in France, at its Paris-Vélizy site. This is the location (country code FR) we state to our Customers, including, where applicable, Platforms. TLS encryption of requests terminates on our servers. No third-party network intermediary (content delivery network, anti-DDoS service, etc.) decrypts API traffic.

Requests are not executed by any cloud provider or any other artificial intelligence provider. If our servers are unavailable, the API rejects requests: they are not failed over to another host.

We will not change where requests are executed without first updating this article and the information provided to our Customers, including, where applicable, Platforms.

11.8. Recipients

• Content: processed automatically by our servers and returned only to the sender of the request (the Direct Customer or, where applicable, the Platform). It is disclosed to no other recipient.
• Physical host: DC2SCALE (Paris-Vélizy site): supplies premises, power, cooling and connectivity. It has no logical access to our servers or to the data, and therefore does not act as a processor.
• Metadata and Customer data: authorized JUST AI staff, our billing and accounting providers, and our business email provider (Google Workspace, provided by Google Ireland Limited), under the conditions set out in Article 4.
• Authorities: upon a lawful request, limited to the data we hold.

Direct Customers are informed in advance of any addition or replacement of a processor involved in processing Content, and may object, as provided in the data processing agreement annexed to the API Terms of Service. Where the API is offered through a Platform, that Platform is informed as provided in the agreement entered into with it.

11.9. Transfers outside the European Union

JUST AI executes requests in France and returns each response only to the endpoint that sent the request. It does not transfer Content outside the European Union to any other recipient.

Where the API is offered through a Platform, the request is sent to us by the Platform and the response is returned to it: that is the very service requested, and the choice to use a Platform belongs to its user. Where the Platform's endpoint is located in the European Union (some Platforms offer EU-only routing), neither the request nor the response leaves the European Union because of JUST AI. Otherwise, the response may be returned to Platform infrastructure located outside the European Union. Access to the API through a Platform established or located outside the European Union, such as OpenRouter, Inc., a company established in the United States, is opened only once one of the transfer mechanisms provided for in Chapter V of the GDPR covers that Platform: an adequacy decision applicable to it (for example the EU-US Data Privacy Framework, if the Platform is certified under it) or appropriate safeguards such as the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). Processing carried out by a Platform is governed by its own rules, for example, for OpenRouter, by its privacy policy.

Transfers outside the European Union relating only to the justai.fr website are described in Article 4.

11.10. Security

JUST AI implements technical and organizational measures appropriate to the risk, including:

• encryption of traffic to and from the API (TLS);
• authentication of every request with an API key, keys being stored hashed or encrypted;
• a network surface reduced to what the service strictly needs;
• inference engines, servers and monitoring tools configured not to log Content;
• administrative access limited to authorized staff, with strong authentication and audit trails;
• physical security of the site, provided by DC2SCALE;
• regular security updates.

No system is infallible: these measures reduce risk but cannot eliminate it. In the event of a data breach affecting the API, JUST AI informs the Customer concerned without undue delay and no later than 48 hours after becoming aware of it. For processing it controls, it notifies the CNIL (the French data protection authority) as provided in Article 33 GDPR.

11.11. Your rights

• Regarding Content: contact first whoever decides how your data is used: the Direct Customer or, if you use a Platform, that Platform. Since JUST AI does not retain Content, it cannot directly act on an access, rectification or erasure request about a past request. If you write to us, we forward your request to the Customer concerned without delay and help it respond.
• Regarding Metadata and Customer data: you have the rights described in Article 8, which you can exercise at privacy@justai.co. For requests sent through a Platform, Metadata relates to the Platform's account, not to an identified person. We can therefore only act on your request if you provide information that allows us to identify you (Article 11 GDPR, on processing that does not require identification).
• You may object to processing based on our legitimate interest and lodge a complaint with the CNIL.
• JUST AI takes no decision based solely on automated processing that produces legal effects concerning individuals (Article 22 GDPR). Generated responses are used by those who receive them, under their own responsibility.

11.12. Abuse prevention

Since Content is not retained, abuse prevention relies on Metadata: quotas and rate limits, detection of abnormal volumes, suspension or revocation of API keys. Through a Platform, JUST AI cannot identify the end user. It therefore reports the abuse to the Platform, which alone can act on the account concerned, and suspends the Platform's entire traffic only as a last resort, in the event of a serious risk to the service.

JUST AI does not submit Content to human review and does not retain it for moderation purposes. Models may, by design, decline certain requests.

The API must be used in accordance with the API Terms of Service and with the licenses and acceptable use policies of the models. To report abuse or a security issue: contact@justai.co.

11.13. AI transparency

API responses are generated automatically by artificial intelligence models. They may be inaccurate, incomplete or biased, and should be checked before any significant use. Each response states the model used. The up-to-date list of models offered, with their developers and licenses, is set out in the API Terms of Service (Article 5) and in the API's technical catalog (/models endpoint).

JUST AI and those who integrate these responses into their own services each comply, for their own part, with Regulation (EU) 2024/1689 on artificial intelligence, including the transparency obligations of its Article 50.

11.14. Contact and changes

For any question about the processing of data by the API: privacy@justai.co.

Any material change to this article (retention, training, place of processing, recipients of Content) is published on this page with a new version date and notified to Customers at least 30 days in advance. Where the API is offered through a Platform, the change is reflected, before it takes effect, in the information provided to that Platform, including, where applicable, the zero data retention flag. A change never applies to requests already processed.