Privacy Policy

Effective October 28, 2026 · Last updated October 28, 2026

1. Who we are and what this policy covers

This Privacy Policy describes how JPX Studios LLC, a New York limited liability company ("JPX Studios", "we", "us" or "our"), collects, uses, shares and protects information in connection with JPX Desk, including the websites at jpxdesk.com, app.jpxdesk.com and site.jpxdesk.com, the JPX Desk web application, its client-facing proposal, signing and payment pages, and its MCP server and APIs (together, the "Service"). Capitalized terms not defined here have the meaning given in our Terms of Service.

The Service is used by photo and video studios and other businesses ("Customers") to manage their own clients, leads, crew and other contacts. This policy covers two different roles we play:

• Information about Customers and visitors. For the account details of our Customers, information about visitors to our websites, and information about how the Service is used, JPX Studios decides how the information is used and is responsible for it under this policy.
• Customer Content. For the information a Customer stores in or sends through the Service, including details about the Customer's own clients, leads and crew, the Customer decides what is collected and how it is used. We process that information on the Customer's behalf and on its instructions, as a service provider or processor. The Customer's own privacy policy governs it. If you are a client or contact of a studio that uses JPX Desk, please contact that studio about your information. We will assist the studio with requests where the law requires us to.

2. Information we collect

2.1 Information you give us

• Account information: name, business name, email address, phone number, sign-in credentials and passkey records, studio details such as address and legal name, and your settings and preferences.
• Customer Content: everything you or anyone acting for you, including an AI Tool you connect, puts into the Service, such as clients, leads, inquiries, proposals, contracts, prices, invoices, receipts, payment records, notes, crew and roster details, holds, calendar entries, house rules, templates and messages.
• Connected account details: when you connect a mailbox, calendar, payment or other third-party account, the credentials, tokens or keys needed to reach it. Passwords for connected mailboxes and calendars are stored encrypted. Where you provide an API key for an AI Provider, we store it so the Service can use it on your behalf.
• Early access requests and messages: information you send us when you ask for access, contact us or give us feedback.

2.2 Information from services you connect

• Email: if you connect a mailbox, the Service reads and stores message headers, contents and attachments from it as needed to show your mail, recognize leads and clients, send email you ask it to send and keep your records in step.
• Calendar: if you connect a calendar, event details the Service reads or writes.
• Payments: if you connect Stripe, payment status, amounts, dates, payment link details and related identifiers. We do not receive or store full card numbers.
• AI Tools: when an AI Tool you connect calls our MCP server, the request it sends us and the information we return to it. We do not receive your conversations with the AI Tool beyond those requests.

2.3 Information collected automatically

• Usage and device information: IP address, browser and device type, operating system, pages and features used, dates and times, referring pages and error logs, collected by our servers and hosting providers.
• Client page activity: when a Customer sends a proposal page to a client, the Service records visits and actions on that page for the Customer, such as when it was opened, the device and browser used, approximate location derived from the IP address, time spent on each part, dates chosen, and whether signing or payment was started. We never record what a visitor types into a field until they submit it. Where applicable law requires notice or consent for this, the Customer is responsible for providing it.
• Electronic signature records: when a client signs, the Service keeps a record of the signed document, its fingerprint, the signer's name and signature, the date and time, IP address, browser and device details, and the consent text shown, so the signature can be proven later.
• Email delivery information: whether emails sent through the Service were delivered, bounced, opened or clicked, where the email service reports it. Opens and clicks can be measured with small images and tracked links in those emails, and the results are estimates.

3. How we use information

We use information to:

• provide, operate, maintain and support the Service, including features you ask for and actions you or your connected tools instruct;
• authenticate you, keep your account secure, and detect, prevent and respond to fraud, abuse, spam, security incidents and technical problems;
• send you service messages, such as alerts, notifications, security notices and changes to our terms;
• understand how the Service is used and improve it, using aggregated or de-identified information where we can;
• comply with law, respond to lawful requests, and establish, exercise or defend legal claims; and
• enforce our Terms and protect the rights, property and safety of JPX Studios, our Customers and others.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use Customer Content to train artificial intelligence models, and we do not use it for our own marketing.

4. How we share information

We share information only as described here:

• At your direction. With the services you connect and the people you choose to contact, including AI Tools (see Section 5), mailboxes, calendars, Stripe, and the clients you send emails, proposals, invoices and receipts to.
• Service providers. With companies that host and operate parts of the Service for us under obligations to protect the information and use it only to provide their services, including Vercel (hosting and content delivery), Supabase (database, sign-in and file storage), Resend (email delivery), Stripe (payments, through your own Stripe account), and, for features that use artificial intelligence inside the app, Anthropic or another AI provider whose key you supply. This list may change as the Service develops. Customers can ask us for the current list and for a data processing addendum by emailing us.
• Legal and safety. When we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or is needed to protect the rights, property or safety of JPX Studios, our Customers or others, or to investigate fraud or security issues.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to this policy or one at least as protective.
• With consent. In any other case where you ask us to or agree to it.

5. AI tools you connect, and our responsibility for them

5.1 How an AI connection works

JPX Desk lets you connect AI assistants and agents, such as Claude by Anthropic, ChatGPT by OpenAI, Grok by xAI and other tools that use the Model Context Protocol ("AI Tools", provided by "AI Providers"). When you connect one, you sign in and grant it permission to call JPX Desk's tools. The AI Tool can then request information from your account, such as leads, clients, proposals, prices, emails, calendar holds and payment status, and, if you allow it, ask JPX Desk to create, change or send things.

5.2 You decide, and we send at your direction

Connecting an AI Tool is optional and is your decision. Every piece of information that JPX Desk returns to an AI Tool is sent because you connected that tool and authorized it to make that request. We treat that as your instruction to transmit the information to the AI Provider on your behalf. It is not a sale or sharing of personal information by JPX Studios for any purpose of our own.

5.3 After that, the AI Provider's policies apply, not ours

Once information reaches an AI Tool, it is held and processed by the AI Provider under that provider's own terms, privacy policy, retention practices and security controls, and under the settings of your account with that provider. Depending on those terms and settings, an AI Provider may store your conversations and the information an AI Tool retrieved, keep it in memory or history features, have people review it, use it to improve or train its models, process it in other countries, or disclose it to others.

JPX Studios LLC does not control, operate, monitor or have access to any AI Tool or AI Provider, and has no responsibility or liability for any information you or an AI Tool share with an AI Provider, or for how that AI Provider collects, uses, stores, retains, protects, discloses, transfers or deletes it. This includes any data breach, unauthorized access, human review, model training, retention after you disconnect, or legal disclosure at or by the AI Provider. This Privacy Policy does not apply to information once it is in an AI Provider's possession. Please read each AI Provider's terms and privacy policy, and review your settings with it, before you connect it to JPX Desk.

5.4 Information about your clients

Your account may contain personal information about your clients, leads, crew and other contacts. If you connect an AI Tool, that information may be retrieved by the AI Tool and shared with the AI Provider. You are responsible for deciding whether that is appropriate, for telling those people about it where the law requires, and for obtaining any consent required. If you are a client of a studio and want to know whether your information was shared with an AI Tool, please ask that studio.

5.5 What we keep, and safeguards we offer

We keep records of AI connections, such as which AI Tool was connected, when, with which permissions, and the tool requests it made, so you can review and revoke them and so we can secure the Service. We store only hashed forms of the access tokens we issue to AI Tools. We offer safeguards such as read-only access by default, a separate permission for changes and sending, confirmations before certain actions, labels on untrusted content and time limits on connections. These safeguards reduce risk but cannot prevent every unintended disclosure or action, and they do not make us responsible for what an AI Provider does.

5.6 Sign-in and credentials

AI Tools connect to JPX Desk through a standard sign-in (OAuth) on our own page. The AI Tool never receives your JPX Desk password, and we never receive your password for the AI Provider. Your account with the AI Provider, its credentials and its security are your responsibility and the AI Provider's.

5.7 Your settings and your clients' expectations

Before connecting an AI Tool, you are responsible for making sure that the information in your account may be shared with that AI Provider, that your own privacy notice to your clients covers it, that any consent you need has been obtained, and that you supervise how the AI Tool uses the connection. Do not connect an AI Tool to an account holding sensitive categories of information, such as health, payment card or government ID information.

5.8 Disconnecting and deleting

You can disconnect an AI Tool at any time in your settings. That stops new requests to JPX Desk. It does not remove information the AI Provider already has, and we are not able to remove it for you. Use the AI Provider's own controls, or contact it directly, to delete your conversations, memories or other stored information.

6. Cookies and similar technologies

The Service uses cookies and browser storage that are necessary to sign you in, keep your session secure, protect against cross-site attacks and remember choices such as your selected views. Our marketing website at site.jpxdesk.com does not use advertising or analytics cookies. We do not use third-party advertising trackers. You can control cookies through your browser, but the Service will not work properly if you block the cookies it needs.

7. How long we keep information

We keep information for as long as your account is active and as needed to provide the Service, and afterwards for as long as needed to comply with legal, tax and accounting obligations, resolve disputes, keep evidence such as signature records and financial records, and enforce our agreements. We regularly delete or de-identify information we no longer need, including removing IP addresses and device details from older records. When a Customer closes an account, we delete or de-identify its Customer Content within a reasonable period, except where the law requires us to keep it, and except for copies in backups, which are overwritten on a regular cycle.

8. Security

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit, encryption of stored mailbox and calendar passwords, access controls, row-level security on the database, rate limits and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your own credentials and devices and for the security of every third-party account and AI Tool you connect. If we learn of a security incident at JPX Studios that affects your personal information, we will notify you without undue delay and as required by law. A security incident at an AI Provider or other third-party service you connected is that provider's responsibility to report.

9. Your choices and rights

You can review and update your account information in the Service, export your information, disconnect any connected service or AI Tool, and ask us to delete your account by contacting us. Depending on where you live, you may have rights under applicable law to access, correct, delete or obtain a copy of your personal information, to opt out of certain processing, and not to be discriminated against for exercising these rights. To make a request, email hello@jpxstudios.com. We may need to verify your identity before acting on it, and you may use an authorized agent where the law allows.

If your information is held in the Service by a studio you dealt with, that studio controls it. Please send your request to the studio. If you contact us instead, we will refer you to the studio and help it respond where the law requires.

You can unsubscribe from marketing emails sent through the Service by using the unsubscribe link in them. Service and security messages about your account are not optional while your account is active.

Notice for California and other U.S. state residents

In the last 12 months we have collected the categories of personal information described in Section 2: identifiers (such as name, email address, phone number and IP address), commercial information (such as payment status and records), internet and device activity, approximate location derived from IP address, professional information, and the content of communications. We collect it from you, from the services you connect, from your clients' use of pages you send them, and automatically. We use it for the purposes in Section 3 and disclose it to the categories of recipients in Section 4. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not use or disclose sensitive personal information for purposes that would give a right to limit its use. We honor Global Privacy Control signals as a request to opt out of any sale or sharing, although we do not sell or share. We do not knowingly sell or share the personal information of anyone under 16.

10. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18 for our own purposes. If you believe a child has given us personal information, contact us and we will delete it.

11. Where information is processed

JPX Studios is based in the United States, and our service providers process information mainly in the United States. If you use the Service from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. AI Providers and other services you connect may process information in other countries under their own terms.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, for material changes, notify you by email, in the Service or on this page. Your continued use of the Service after a change takes effect means you accept the updated policy.

13. Contact us

Questions about this policy or your information can be sent to:

JPX Studios LLC
New York, New York
hello@jpxstudios.com