1. Controller and scope
For the private beta, Datafolks is the name of the project that determines how participant data is used. The final legal operator and contact details must be added before public paid tasks open. This notice covers the Datafolks iOS application, participant accounts, task operations, and related support.
The public landing page currently uses no advertising trackers or analytics cookies. If that changes, Datafolks will provide any additional cookie or tracking notice required before collection begins.
2. Notice at collection
Data collected at registration: email or Apple account identifier, authentication records, country, age or date of birth, optional gender, device model, languages, equipment, household capabilities, and legal-document acceptance records.
Why: create and secure the account, confirm 18+ eligibility, match assignments, operate the service, prevent abuse, and keep evidence of the agreement.
Task data: task choices, answers, photos, videos, audio, file metadata, review decisions, rewards, and payout records. The task brief and license identify the permitted use before collection.
Sale or sharing: Datafolks does not sell profile or contact data for cross-context behavioural advertising. Accepted task deliverables may be licensed or supplied to customers for the purpose stated in the task brief and accepted license; that transfer may be treated as a sale or disclosure under some laws.
Retention: account data is generally kept while the account is active. Submission, payment, anti-fraud, audit, and legal acceptance records are kept for the task purpose and applicable legal or claims periods, then deleted or de-identified where feasible.
3. Information we collect
Account and authentication
Email address, Apple relay address or provider identifier, account ID, confirmation and session information, and account creation and sign-in timestamps. Passwords are handled by the authentication provider and are not available to Datafolks in readable form.
Profile and screening
Country, date of birth derived from the age supplied at registration, optional gender, phone model, languages and proficiency, instruction language, video and audio equipment, quiet-room availability, household appliances, and activities.
Tasks and submissions
Assignment status, task interactions, survey and form answers, uploaded or captured photos, video and audio, file type and size, submission revisions, timestamps, review notes, acceptance decisions, reward entries, and payout requests.
Legal and support records
Document key, version, title, URL, cryptographic content hash, acceptance timestamp and method, locale, app version, and communications with support.
Technical information
Basic request, security, and error information generated by the app, hosting providers, authentication service, and storage service. A future analytics feature must be disclosed before it is enabled.
4. Purposes and legal bases
- Contract: create the account, provide assignments, receive submissions, conduct review, calculate rewards, and administer payouts.
- Legitimate interests: secure the service, prevent duplicate accounts and fraud, troubleshoot failures, maintain audit records, and establish or defend legal claims, balanced against participant rights.
- Legal obligations: tax, accounting, sanctions, lawful requests, worker or platform reporting, and other duties that apply to the operator.
- Consent: only where a task or optional feature specifically says processing relies on consent, such as certain sensitive or biometric uses. Consent can be withdrawn prospectively without affecting processing already lawful before withdrawal.
Datafolks does not rely on a general privacy-policy checkbox as consent for every processing purpose.
5. How task data is used
Task data is reviewed for quality and may be cleaned, labelled, annotated, transformed, combined, analysed, used to train or evaluate technology, and licensed or delivered to a customer only as described in the task brief and accepted license. A task requiring materially different use must present a different license or supplemental notice before it starts.
Do not include another person or their personal data unless the task expressly provides a valid release workflow. Datafolks currently prohibits tasks requiring third-party model releases, property-owner signatures, biometric identification, health records, or other sensitive categories without a separate approved process.
6. Recipients and service providers
Information may be disclosed to:
- Datafolks personnel and reviewers who need it to operate and review tasks;
- infrastructure providers, including Supabase for authentication, database, and private file storage, and Vercel for website and administration hosting;
- Apple when Sign in with Apple or Apple platform services are used;
- customers and their processors for the task purpose stated before acceptance;
- professional advisers, auditors, insurers, payment and tax providers when those services are introduced;
- authorities or counterparties where disclosure is required by law or necessary for a corporate transaction, subject to appropriate protections.
Service providers must process information under contractual restrictions appropriate to their role. A customer receiving task data may act as an independent controller; the task notice should identify that role where required.
7. International transfers
The primary Supabase project is hosted in the European Union. Providers, reviewers, and customers may process information in other countries. Where transfer law requires it, Datafolks will use an adequacy decision, contractual safeguards, or another lawful transfer mechanism and provide information on how to obtain a copy.
8. Retention
- Account and profile: while the account is active, then deleted or de-identified after an account deletion request, subject to necessary legal records.
- Draft local files: on the device until removed, submitted, or the app’s local data is cleared.
- Submissions and accepted content: for the task purpose, customer commitments, dataset lifecycle, and applicable claims periods; content may remain in de-identified datasets or trained systems where deletion is not legally required or technically feasible.
- Rejected work: only as long as reasonably needed for dispute handling, quality control, security, and fraud prevention.
- Legal acceptance, reward, payout, audit, and tax records: for the applicable contract, accounting, tax, platform-work, and legal claims periods.
Exact periods depend on the final operator, task, customer obligations, and local law. Before public launch, Datafolks must publish a retention schedule with concrete periods where required.
9. Account deletion and pseudonymisation
The in-app Delete account control removes the authentication account and personal profile. Completed task, submission, content, reward, payout, audit, and legal acceptance records may remain under a new random pseudonym so they are no longer directly linked to the deleted authentication identifier. Pseudonymised data remains personal data where re-identification is reasonably possible and continues to receive applicable protection.
10. Your rights
Depending on location and applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, opt out of certain sales or sharing, limit certain sensitive-data uses, and complain to a regulator. You may also have rights concerning automated decisions and platform-work management.
Use the in-app deletion control for account deletion. Other request and appeal channels, identity-verification steps, authorised-agent procedures, and the operator’s privacy contact must be completed before public launch. Datafolks will not discriminate against a person for exercising a mandatory privacy right.
11. Automated matching and review
Profile fields may be used to identify potentially suitable tasks. Current submission decisions are made through operator review. Before material automated monitoring, ranking, eligibility, suspension, or review decisions are introduced, Datafolks must provide the additional explanation, safeguards, human review, and worker information required by applicable law.
12. Security and children
Datafolks uses access controls, private file storage, pseudonymisation on account deletion, and role-based administration. No system is completely secure. Participants should protect their devices and credentials and report suspected compromise through the support method shown in the app.
Datafolks is limited to adults aged 18 or older and is not intended for children.
13. Changes to this notice
Each notice has a version and effective date. New registrants acknowledge the current version. Material changes are shown in the app when renewed acknowledgement or consent is required. Historical versions and acceptance evidence are retained.