Data Security

Whether you upload your images or share their URLs, Ximilar doesn’t store the users’ images on our servers. We do not store your images in your collection for visual search nor the images for one-time processing (e.g., end-user data from the mobile app). When an image is inserted (automatically through synchronization or manually), our AI analyzes it and creates an encoded representation of the image, and then the image is immediately discarded.

We only store the training dataset used to train new custom image recognition (categorization, tagging, object detection) solution after mutual agreement. These images are secured at Amazon S3 with links that expire after one hour. If you use our pre-trained solutions, e.g. fashion tagging, there is no need to train a custom solution on your data, and thus to store any of your images.

However, you can choose whether your images will be available under a particular URL or encrypted and with restricted access. Contact us to discuss your needs.

Ximilar admins can access your images after being asked to do so (e.g., when a problem occurs).

NDAs are signed after mutual agreements with our customers. We can sign the standard NDA of your company. Contact our customer care to discuss your requirements.

You retain all rights to your own training data and its outputs — your Content, labels, annotations, metadata, training datasets, and prediction results. Models you create with your data (Image Recognition, Object Detection, and VLM) are for your exclusive use and are never made available to other customers.

To deliver these models, Ximilar hosts and serves them through our own software. The underlying model engine for Image Recognition and Object Detection — its weights, architecture, and runtime — is Ximilar's intellectual property and is not exportable. Everything else, including your Content, datasets, annotations, prediction results, and your VLM models, is fully exportable at any time through our open API, in line with the EU Data Act. If you cancel, we provide reasonable transition assistance for 30 days.

Ximilar does not use one customer's data to train another customer's models, which is guaranteed contractually. Contact us for details.

After signing up to the Ximilar app, you can access your unique API authorization token that is used for any API communication between you and Ximilar services.

Ximilar admins can access your images after being asked to do so (e.g. when a problem occurs).

NDAs are signed after mutual agreements with our customers. We can sign the standard NDA of your company.

If a custom solution is trained on your own training dataset, you own this dataset. Ximilar does not use one customer’s data to train another customer’s models, which is guaranteed contractually. You also hold intellectual rights to your models trained on our platform. Therefore, these models cannot be used by other customers. Your training data is stored on our own servers located in Prague, EU, and thus European regulations, including GDPR, are applied.

Ximilar never stores images that are used for inference API (for example, for classification, detection or tagging endpoints). Only the metadata extracted from your images is stored. We also do not store any images processed by visual search.

The only images stored by Ximilar are the images uploaded in the App as training data for new solutions. These data are stored in Amazon AWS S3 service.

Ximilar and its servers are located in the European Union, and therefore European regulations, including GDPR, are applied. Data are stored on our hardware infrastructure in a data center in Prague with multiple ISO certifications (ISO 27001, ISO 9001, ISO 14001, ISO 45001 and ISO 20000).