Privacy Notice

1. Notice at collection

Data collected at registration: email or Apple account identifier, authentication records, country, age or date of birth, optional gender, device model, languages, equipment, household capabilities, and legal-document acceptance records.

Why: create and secure the account, confirm 18+ eligibility, match assignments, operate the service, prevent abuse, and keep evidence of the agreement.

Task data: task choices, answers, photos, videos, audio, file metadata, review decisions, rewards, and payout records. The task brief and license identify the permitted use before collection.

Sale or sharing: Datafolks does not sell profile or contact data for cross-context behavioural advertising. Only accepted task deliverables may be licensed or supplied to customers for the purpose stated in the task brief and accepted license; that transfer may be treated as a sale or disclosure under some laws. The applicable task notice gives additional information before the participant starts.

Retention: account and profile data is generally kept while the account is active. Other server records are kept while needed to carry out the applicable contractual obligations and for one year after that need ends, where lawful, to handle disputes, prevent abuse, and establish or defend claims. A legal obligation may require a longer period; a valid deletion request may require earlier deletion. Section 7 explains how this rule applies to different records.

2. Information we collect

Account and authentication

Email address, Apple relay address or provider identifier, account ID, confirmation and session information, and account creation and sign-in timestamps. Passwords are handled by the authentication provider and are not available to Datafolks in readable form.

Profile and screening

Country, an estimated date of birth derived from the age supplied at registration, optional gender, phone model, languages and proficiency, instruction language, video and audio equipment, quiet-room availability, household appliances, and activities.

Tasks and submissions

Assignment status, task interactions, survey and form answers, uploaded or captured photos, video and audio, file type and size, submission revisions, timestamps, review notes, acceptance decisions, reward entries, and payout requests.

Legal and support records

Records of which legal documents and task licenses you accepted or acknowledged, when and how you did so, and communications with support.

Technical information

Basic request, security, and error information generated by the app, hosting providers, authentication service, and storage service. A future analytics feature must be disclosed before it is enabled.

3. Purposes and legal bases

• Contract: create the account, provide assignments, receive submissions, conduct review, calculate task credits, and administer payouts.
• Legitimate interests: secure the service, prevent duplicate accounts and fraud, troubleshoot failures, keep necessary audit records, handle disputes, and establish or defend legal claims, balanced against participant rights.
• Legal obligations: tax, accounting, sanctions, lawful requests, worker or platform reporting, and other duties that apply to Datafolks.
• Consent: only where a task or optional feature specifically says processing relies on consent, such as certain sensitive or biometric uses. Consent can be withdrawn prospectively without affecting processing already lawful before withdrawal.

Acknowledging this Privacy Notice is not general consent to every use of personal information.

4. How task data is used

Datafolks receives a license to submitted material when the participant accepts the applicable task license and submits the material. That license is separate from Datafolks' decision to accept or reject the work and from any task credit or payout. Datafolks reviews all submitted material for quality and may retain rejected material for review, disputes, security, and fraud prevention. Only accepted task deliverables are licensed or supplied to customers. Accepted material may be cleaned, labelled, annotated, transformed, combined, analysed, used to train or evaluate technology, and supplied to a customer only as described in the task brief, data-use notice, and accepted license. A materially different use requires an appropriate new notice or agreement before it begins.

Do not include another person or their personal data unless the task expressly provides a valid release workflow. Datafolks currently prohibits tasks requiring third-party model releases, property-owner signatures, biometric identification, health records, or other sensitive categories without a separate approved process.

5. Recipients and service providers

Information may be disclosed to:

• Datafolks personnel and reviewers who need it to operate the service and review tasks;
• Supabase, which provides account authentication, the application database, private file storage, and backend functions;
• Vercel, which hosts the public website and operator administration interface;
• Apple, when Sign in with Apple, iOS push notifications, or other Apple platform services are used;
• Resend, which delivers task messages and website download invitations, and may deliver account messages if configured for that purpose;
• customers and their processors, only for accepted task deliverables and the purpose disclosed before the task was accepted;
• professional advisers, auditors, insurers, and payment or tax providers where their services are used; and
• authorities or counterparties where disclosure is required by law or necessary for a corporate transaction, subject to appropriate protections.

Service providers must process information under contractual restrictions appropriate to their role. A customer receiving an accepted task deliverable may act as an independent controller; the task notice identifies the customer or customer category and its role where required. Datafolks' retention rule does not automatically control copies held by an independent customer.

6. International transfers

The primary Supabase project is hosted in the European Union. Providers, reviewers, and customers may process information in other countries. Where transfer law requires it, Datafolks will use an adequacy decision, contractual safeguards, or another lawful transfer mechanism. Email support@datafolks.space to ask about applicable transfer safeguards and how to obtain a copy where available.

7. Retention

Datafolks keeps server records while they are needed to perform the applicable obligations under a participant account, accepted task, customer delivery, review, or payout. Once those obligations end, Datafolks keeps the records for one further year where lawful to handle disputes, prevent abuse, and establish or defend legal claims, then deletes or de-identifies them. Datafolks may delete information sooner when required or keep particular records longer when law requires it. This period concerns Datafolks' copies, not a customer's independently held copies.

• Account and profile: while the account is active. The sign-in account and personal profile are removed after account deletion, subject to necessary retained records described below.
• Unsubmitted local files: on the device until removed, submitted, or the app's local data is cleared.
• Submissions and accepted content: during review, agreed customer delivery and other continuing task obligations, then for one further year under the rule above. Material already delivered to a customer or incorporated into a trained system is addressed by the task notice, the customer's obligations, and applicable law.
• Rejected work: during review and any related dispute or fraud investigation, then for one further year under the rule above. Rejected work is not supplied to customers.
• Legal acceptance, reward, payout, audit, and tax records: during the applicable contractual and legal obligations, then for one further year where lawful; a mandatory accounting, tax, reporting, or claims period may require longer retention.

8. Account deletion and pseudonymisation

The in-app Delete account control removes the authentication account and personal profile. Completed task, submission, content, reward, payout, audit, and legal acceptance records may remain under a new random pseudonym for the periods described above, so they are no longer directly linked to the deleted authentication identifier. Pseudonymised data remains personal information where re-identification is reasonably possible and continues to receive applicable protection. Account deletion does not by itself recall material already supplied to a customer under the accepted task terms.

9. Your rights and how to contact us

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, opt out of certain sales or sharing, limit certain sensitive-data uses, and complain to a regulator. You may also have rights concerning automated decisions and platform-work management.

Use the in-app control to delete your account. For other privacy requests, questions, or an appeal, email support@datafolks.space. We may ask for information reasonably needed to verify that a request concerns you, including when an authorised agent makes a request. If an account has been deleted, tell us the email address previously used with it and any task details you can provide; we will explain what records we can still locate and what rights apply. Datafolks will not discriminate against a person for exercising a mandatory privacy right.

10. Automated matching and review

Profile fields are used to identify potentially suitable tasks. Current submission decisions are made through operator review. Before material automated monitoring, ranking, eligibility, suspension, or review decisions are introduced, Datafolks will provide the additional explanation, safeguards, human review, and worker information required by applicable law.

11. Security and children

Datafolks uses access controls, private file storage, pseudonymisation on account deletion, and role-based administration. No system is completely secure. Protect your devices and credentials and report suspected compromise to support@datafolks.space.

Datafolks is limited to adults aged 18 or older and is not intended for children.

12. Changes to this notice

Each notice has a version and effective date. New registrants acknowledge the current version. Material changes are shown in the app when renewed acknowledgement or consent is required. Historical versions and acceptance evidence are retained.