Privacy Policy

JARAI STUDIO Ltd ("JARAI", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy, contact us.

1. Who we are

JARAI STUDIO Ltd is the data controller for personal data collected through jarai.studio and the JARAI STUDIO platform. We are registered in England and Wales.

As data controller, we determine the purposes and means of processing your personal data. Our lawful bases for processing are described in each section below.

2. What data we collect

We collect the following categories of personal data:

Account data

When you register for an account, we collect your name, email address, company or channel name, and the role you identify with (creator, media entrepreneur, enterprise, or investor). We use this to create and manage your account and to provide the service.

Usage and analytics data

We use Cloudflare Web Analytics to understand how visitors use our website. Cloudflare Web Analytics is a privacy-preserving analytics tool that does not use cookies, does not collect personal data, and does not track individual visitors. No IP addresses, device fingerprints, or personal identifiers are stored or transmitted. See our Cookie Policy for details.

Content and configuration data

When you use the JARAI platform, you provide content strategy configurations, production settings, connected platform credentials (via OAuth — we store tokens, not passwords), and the production outputs generated by the pipeline. This data is stored to operate the service on your behalf.

Billing data

Payment processing is handled by Stripe, Inc. We do not store payment card details. We receive confirmation of payment status and a Stripe customer reference only. Stripe's privacy policy applies to payment data.

Communications

If you contact us by email, through the sign-up form, or via support channels, we retain your messages and contact details to respond to your enquiry and to manage the relationship.

Voice recordings from public archives

This part is for people whose voices appear in recordings published in public speech archives. You are probably not a JARAI customer, so this notice is where we tell you about it.

JARAI can create a synthetic voice that reproduces the voice of a speaker in such a recording. Our software finds candidate recordings, but nothing is cloned automatically: a member of our staff must approve each voice individually and record who made the decision, why, and what consent the speaker is known to have given. The approved recording is sent to ElevenLabs (United States), which creates the voice model. ElevenLabs also receives the speaker's name as we understand it, the consent position we recorded, the member of staff who approved it, and the date.

We do this to build a range of synthetic voices with different accents. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)), and the balance between our interest and the speaker's rights is assessed and written down for each voice, not once for all of them. Where a speaker has given explicit, documented consent to commercial use, we rely on that consent instead (Article 6(1)(a)) and keep the document. A recording's licence, such as a public-domain or Creative Commons licence, covers the recording, not the speaker's rights in their own voice, so we do not treat it as permission. We do not use these voices to identify anyone.

Our record of a recording we find but nobody approves — the archive, the identifier it gives the speaker and the recording's address — is kept for 90 days. After that we keep only a one-way code made from its address, so that we never collect it again. How long we keep each of these records is in section 5.

If you object, contact us and tell us the archive and the identifier it gives you as a speaker, or the address of one of your recordings. That is all we need, and one request then acts on your objection in full. We delete every voice model made from your recordings at ElevenLabs, and any sample we made with it; we delete the recordings of you that we hold; and we remove your identifier and your recordings' addresses from our records, including the record of each voice. If we hold nothing about you when you object, we record your objection anyway, so that we do not collect your recordings later.

Two things are kept. The record of who approved each voice of you, why, and what consent we knew of is kept indefinitely: it is the only evidence that a person, not our software, decided to make the voice, and it is what we would rely on if the voice were ever said to have been made unlawfully. And we keep a one-way code made from the archive's name and your identifier. It is how we recognise you and never collect your recordings again, and it identifies nobody to anyone who does not already know your identifier. Our record that we acted on your objection names that code, not you. Our technical logs, and ElevenLabs' own, may still mention your identifier until they expire.

3. Lawful basis for processing

We process your personal data on the following lawful bases under UK GDPR Article 6:

• Contract (Article 6(1)(b)): processing necessary to perform our contract with you — account management, service delivery, and support.
• Legitimate interests (Article 6(1)(f)): security monitoring, fraud prevention, service improvement, and business analytics using anonymised data only. We have assessed that these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): retaining financial records as required by HMRC, Companies House, and applicable company law.
• Consent (Article 6(1)(a)): marketing communications, where you have explicitly opted in. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. How we use your data

We use your personal data to:

• Create and manage your JARAI account
• Provide the autonomous media production pipeline service
• Process payments and manage subscription billing
• Send service-related communications (account alerts, security notices, service updates)
• Respond to support and sales enquiries
• Improve the platform using aggregated, anonymised usage data
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal and regulatory obligations

Automated decisions

One decision on the platform is taken solely by automated means and can significantly affect you. Before a production starts, and again after its images and video are generated, an automated classifier (Microsoft Azure AI Content Safety) screens the input and the output for a small set of criminal categories: child sexual abuse material, non-consensual intimate imagery and terrorist content. A production it blocks is not made, and no one at JARAI can override the block. We rely on UK GDPR Article 22(2)(b) — a decision authorised by law — because detecting this material is itself a legal-compliance activity. You can ask us to review the blocked input and you can change and resubmit it; the verdict on the same input does not change. A record of each check — a fingerprint of the input rather than the input itself, and the classifier's result — is kept even after an erasure request, because it may be needed as evidence by law enforcement (Article 17(3)(b) and (d)).

Checks against abuse of the free trial can automatically refuse or restrict a free trial. We treat that as an automated decision with a significant effect: if it happens to you, you can ask for a person to review it — contact us.

Other automated checks are advisory. Warnings about possible copyright, likeness or content issues are shown to you before you publish, and you make the decision.

5. Data retention

The periods below are applied by the platform: a scheduled task deletes or anonymises the data when its period ends, or, for records that are themselves evidence (consents, approvals, legal requests), a member of our staff does so after checking that no dispute or regulator's question still needs them.

6. Who we share your data with

We share your personal data only with:

Service processors

Third parties who process personal data on our behalf to run the service. In summary:

• Microsoft Azure — hosting, databases, storage, sign-in (Entra External ID), content-safety screening and monitoring; e-mail and SMS notifications (Azure Communication Services); an approximate location for the sign-in alert (Azure Maps)
• Stripe — payments and invoices
• AI model providers — Anthropic, OpenAI, Google, Microsoft, ElevenLabs, Runway, Shotstack and Amazon (AWS Polly) — where content you have configured is processed by AI models to generate media
• Zoho Mail — our support and data-protection mailboxes
• Google — if you choose to sign in with Google
• Cloudflare — bot protection (Turnstile) when you register

Our sub-processors page lists each one: what it receives, where it processes it, and the legal basis for any transfer outside the UK. It is versioned like this policy.

Legal and regulatory authorities

We will share data where required by law, a valid court order, or a regulatory investigation by a competent authority. We will notify you of such requests unless legally prevented from doing so.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

7. International data transfers

The platform's databases, storage and processing are hosted in Microsoft Azure's UK South region. Our websites and the browser applications' files are served from Azure's West Europe region and its global network. Some processors handle personal data elsewhere: Azure Communication Services and Zoho Mail in Europe, and Stripe, Google, Cloudflare and most of our AI model providers in the United States.

For transfers to the United States we rely on UK adequacy regulations: the UK–US data bridge, the UK extension to the EU–US Data Privacy Framework, which covers providers certified under that Framework. Transfers to the European Economic Area rely on the UK's adequacy regulations for the EEA. Where neither applies, a transfer needs the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. An AI model provider with no valid transfer basis is not permitted to receive personal data, and the platform refuses to send it any. The basis for each processor is on our sub-processors page, and a copy of any safeguard we rely on is available on request — contact us.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Access (Article 15): request a copy of the personal data we hold about you
• Rectification (Article 16): request correction of inaccurate or incomplete data
• Erasure (Article 17): request deletion of your data ("right to be forgotten"), subject to legal retention obligations
• Restriction (Article 18): request that we restrict processing of your data in certain circumstances
• Portability (Article 20): receive your data in a structured, machine-readable format for transfer to another controller
• Object (Article 21): object to processing based on legitimate interests
• Withdraw consent: withdraw marketing consent at any time without affecting processing already carried out

To exercise any of these rights, contact us with your name, email address, and a description of your request. We will respond within one calendar month. We may request proof of identity before processing your request.

9. The right to complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact us first.

10. Cookies and similar technologies

Under PECR and UK GDPR Article 13, we are required to tell you what we store on your device when you use our marketing site, the Studio Console, or the Client Portal (✦ BL-1573). We use only strictly necessary cookies and storage (authentication / session continuity / offline cache) plus one functional cookie (referral attribution) and one cookieless analytics provider (Cloudflare Web Analytics). We do not use advertising, cross-site tracking, or social retargeting cookies.

The full per-item inventory — names, scope (cookie / localStorage / sessionStorage), purpose, duration, and classification — lives in our Cookie Policy.

11. Changes to this policy

We will notify you of material changes to this policy by email and by a notice on our website at least 30 days before changes take effect. The version and "last updated" date at the top of this page reflect the most recent revision, and the change log at the end of this page lists every version and what changed in it. We encourage you to review this policy periodically.

12. Contact us

• All enquiries, including data protection: Contact us - this reaches the right team and gives you a reference you can quote.
• Data protection enquiries by email: privacy@jarai.studio
• General enquiries by email: hello@jarai.studio
• Company: JARAI STUDIO Ltd, registered in England and Wales