Privacy Policy

01Who we are

1.1Addvista Inc., a Delaware corporation with its registered office at 8 The Green, Ste R, Dover, DE 19901, USA, together with its subsidiaries and affiliated companies (each an Addvista Company; collectively Addvista, we, us, our), explains in this policy how we handle personal data and personal information.

1.2Your contracting party is the Addvista Company named in your order, booking, license order, account confirmation, or engagement confirmation (for example Addvista Inc. or an Addvista subsidiary in your country). Where no Addvista Company is named, your contracting party is Addvista Inc. Where a third-party provider is named as the contractor for a service, that provider is your contracting party for the service itself, and Addvista acts only as stated in the relevant terms.

1.3The controller is the Addvista Company that decides why and how your personal data are processed. Unless this policy or your confirmation names another Addvista Company, the controller is Addvista Inc.

1.4In particular:

(a) Accounts, recordings, quality review, de-identification, annotation, dataset licensing, payouts, Assist session retention, and our own product and model development: Addvista Inc., until an EU Addvista Company takes over the EU processing.

(b) Addvista Assist live guidance that a business customer runs on its jobs: we act as that customer's processor under a data-processing agreement. For keeping Assist sessions and for product and model improvement, we are an independent controller. Section 4.6 explains this.

(c) A construction or consulting engagement: the Addvista Company named in the booking or statement of work.

(d) A dataset license: Addvista is the controller of the licensing. A Licensee is an independent controller of any personal data it can identify in its copy.

1.5For matters under Regulation (EU) 2016/679 (the GDPR), our representative in the European Union is Cognivity GmbH, Friedrichstraße 171, 10117 Berlin, Germany. You can also reach us directly at data@addvista.com.

1.6Send data protection requests to data@addvista.com.

1.7Privacy requests, objections, and deletion requests: data@addvista.com or in the app. Postal address: Addvista Inc., 8 The Green, Ste R, Dover, DE 19901, USA. Product support: support@addvista.com. Legal notices: legal@addvista.com.

1.8This policy is our notice under GDPR Articles 13 and 14 and our California notice at collection. Signs, app screens, and booking screens give a short notice at the point of collection and link to this policy.

02Who and what this policy covers

2.1This policy covers our websites, apps, the recording program, Addvista Assist, consulting, construction and trade services, subcontracting, and dataset licensing. Regional rights are in sections 17 and 18.

2.2The policy covers:

(a) visitors to our websites and people who contact us;

(b) app users, including tradespeople and other workers who record work or use Addvista Assist (each a Worker);

(c) construction, trade, and service companies that use the team tool, bring crews and job sites, or receive a revenue share (each a Company), and their staff and administrators;

(d) people who use Addvista Assist, on a team seat or a solo plan;

(e) consulting clients and their staff who take part;

(f) clients who book construction or trade services from or through us, including bookings that include recording at a preferential price (each a Client), and people at their sites;

(g) subcontractors we engage and their staff on site;

(h) robotics labs, manufacturers, and other dataset licensees (each a Licensee), and their contacts;

(i) job applicants; and

(j) bystanders and other people captured in a recording.

2.3A Recording is first-person video of the work and the immediate work area, captured with a platform-approved helmet camera, smart glasses, or phone through the Addvista app, together with the sensor, device, and task data the task collects. Audio is a separate stream and is off by default.

2.4A Dataset is a collection of Recordings we have reviewed, de-identified, and annotated for licensing or for our own model work. De-identified means we have removed or masked direct identifiers using the measures in section 8.8.

2.5An Assist Session is the live camera feed, any audio, the task context, and the outputs of a use of Addvista Assist.

2.6This policy does not cover third-party sites we link to, app stores, or a payment provider's own processing. Where a named third-party provider performs construction work as your contractor, that provider's own notice covers the work it controls.

2.7We do not offer accounts to anyone under 18. Section 18 covers children.

2.8We also give short notices where they matter: site signs or QR codes, an in-app notice before the first Recording and the first Assist Session, booking screens, Company agreements, dataset licenses, and the cookie banner.

03How we use words

3.1In this policy:

(a) Personal data has the GDPR meaning.

(b) Personal information has the meaning in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), and the comparable term in other US state privacy laws.

(c) Special-category data means the categories in GDPR Article 9.

(d) Company staff means employees, individual contractors, and other workers a Company or Subcontractor directs.

(e) Subcontractor means a firm we engage to carry out construction or trade work.

(f) Vendor means a service provider that processes personal data on our instructions.

(g) Verified means we have accepted a Recording under the published quality rules.

(h) Preferential Price and Recording-Free Price have the meanings in the Customer Terms.

(i) Including means including without limitation.

04Our roles

Where we are the controller

4.1We are the controller for:

(a) Worker, Company, Client, Licensee, and applicant accounts;

(b) Recordings a Worker makes for us and Recordings collected on a Company's or Client's jobs;

(c) quality review, verification, fraud checks, and the use of Recordings as evidence under section 8.3;

(d) de-identification, annotation, Dataset creation, licensing, and our own product and model development;

(e) Assist Session retention and Assist improvement under section 9;

(f) payouts, tax records, and customer service;

(g) our own marketing; and

(h) security of our services and legal claims.

Joint control with Companies

4.2We and a Company are joint controllers of the collection of Recordings where the Company requires its staff to record, makes recording part of a work instruction or price, or takes footage back for its own purposes. After collection, we alone control annotation, licensing, and our own model work.

4.3The essence of our arrangement under GDPR Article 26(2) is:

(a) Information. The Company informs its staff before recording starts and posts the signage we supply. We supply the sign text, the in-app notice, and this policy.

(b) Employment law. The Company is responsible for its own legal basis toward its staff and for any consent, notice, consultation, or agreement that employment law requires before its staff record. The Company confirms this to us. We may suspend collection if it is missing.

(c) Rights. data@addvista.com is the single contact point for requests about Recordings, Datasets, and Assist Sessions we hold. The Company handles pure human-resources requests. A party that receives a request meant for the other passes it on promptly.

(d) What the Company receives. Verification status, the hour count for its revenue share, and any clip the Company contract allows for a defined operational use, such as quality control, documentation of its own work, or claims. The Company does not receive clips for decisions about individual employees, except where the law requires a specific disclosure (section 13.2).

(e) Breaches. Each party tells the other without undue delay about a breach that affects the joint processing.

(f) Your claims. You may exercise your rights against either of us.

4.4The same arrangement applies, with the Client or Subcontractor in the Company's place, where a Client or Subcontractor requires its own staff to be recorded.

4.5A Company or Client that only allows site access, and does not require recording or take footage back, is not a joint controller of the Recording.

Addvista Assist for business customers

4.6Where a business customer runs Addvista Assist on its jobs:

(a) we provide the live guidance as the customer's processor, under a data-processing agreement that meets GDPR Article 28;

(b) we keep Assist Sessions for quality assurance, safety, support, and fraud prevention, and use them for product and model improvement, as an independent controller under section 9; and

(c) the customer informs its staff and is responsible for any legal basis, consultation, or agreement that employment law requires for its staff.

4.7We may also act as a processor where a written agreement says so for a narrow custom job, such as annotation of a customer's own data on its instructions.

Independent controllers and other recipients

4.8A Licensee decides how it uses a Dataset within its license. For any personal data it can identify in its copy, it is an independent controller. The license bans re-identification and limits purposes.

4.9Payment providers are processors for our payment instructions and independent controllers for their own regulatory and anti-fraud duties. Authorities that receive data because the law requires it are recipients. Professional advisers act as processors or independent controllers according to their engagement.

05Principles

5.1We process personal data lawfully, fairly, and transparently, for the purposes in this policy, limited to what we need, kept accurate, kept no longer than section 16 allows, and protected under section 19.

06Processing overview

6.1The table states the main categories of data, purposes, EU legal bases, and retention. Sections 7 to 13 explain them.

6.2Where we rely on legitimate interests, our interests are: operating and securing our services; preventing fraud and verifying paid work; site and worker safety; developing and improving our products, models, Addvista Assist, and safety systems; building and licensing Datasets; capturing the work while de-identifying people who are not its subject; direct marketing to existing customers; and establishing and defending legal claims.

6.3Is providing data required? Account, payout, and tax data are needed to enter into and perform a contract with you, and tax data are also required by law. Without them we cannot open an account, pay you, or perform an order. Recording is a contractual requirement of a paid recording task and of a booking at the Preferential Price; you may instead choose a task or booking without recording where we offer it. Marketing consent, audio, analytics cookies, and optional app permissions are voluntary; if you decline, only the related feature is unavailable. Bystanders are not required to provide any data.

6.4United States residents do not need a GDPR legal basis. The same purposes, categories, and retention periods apply. Section 18 adds US rights.

07Accounts, companies, and recordings

Website, accounts, and teams

7.1When you visit our website we process the data in the first row of the table in section 6.1. Cookies and similar technologies follow section 23.

7.2We collect the account data needed to identify you, let you sign in, and show you the right jobs, teams, or licenses. We store passwords only as salted hashes. We ask for a government identification document only where a payout, tax rule, or sanctions check requires it.

7.3Company data let us contract with the firm, administer crews, assign tasks, and calculate a revenue share.

7.4You may decline device permissions. If you refuse the camera, you cannot record or use Assist, but you can still use features that do not need it.

What a Recording contains

7.5A task records the work and the immediate work area from the Worker's view: hands, tools, and materials. It may include motion data from the approved device, device and camera parameters, task metadata such as task type, start and stop, and result, and coarse job-site location.

7.6We collect a precise location only where coarse location cannot confirm that the session is at the assigned job, and we then coarsen or delete it. Licensed Datasets do not contain precise locations, street addresses, or Client names.

7.7Audio is off by default. We turn it on only for a task that needs it, and we record or store audio only with the consent of the people who can be heard.

7.8Tasks are designed not to capture minors, private or intimate areas, restrooms, medical situations, screens, passwords, payment cards, identity documents, or confidential plans. The Worker stops recording when it would be unsafe or unlawful, or when a person present asks.

7.9Rights in Recordings are granted under the Platform Terms, Customer Terms, or Subcontractor Terms. This policy covers the personal-data side.

Clients, consulting, and preferential prices

7.10For a construction booking we process the Client's contact and site data to schedule, perform, invoice, and handle defects.

7.11Recording is part of our construction service. For business Clients and US consumers, every booking includes recording of the work at the Preferential Price unless the order states the Recording-Free Price. Consumers in the European Union choose at booking between the Preferential Price with recording and the Recording-Free Price without recording. For the Client's own data in a Recording, the legal basis is the contract (Article 6(1)(b) GDPR) and, where the law requires consent, consent (Article 6(1)(a) GDPR). For other people on site, the legal basis is legitimate interests (Article 6(1)(f) GDPR), as section 12 explains.

7.12A business Client or US consumer may switch unperformed visits to the Recording-Free Price under the Customer Terms. Under the Regional Terms — Europe, a consumer in the European Union may switch unperformed visits to the Recording-Free Price at any time, as easily as they chose recording, and may withdraw any consent they gave at any time. A switch or withdrawal stops further recording; unperformed work continues at the Recording-Free Price. Anyone on site may still object, ask for a pause, or request deletion under section 17.

7.13The Client confirms that it may admit the crew and allow recording in the work area, and that it will tell employees, residents, visitors, and other contractors before recording starts.

7.14For consulting engagements we use contact and project data to perform the statement of work. If a consulting or inspection visit is recorded, the recording rules in this policy apply.

08Quality, de-identification, training, and licensing

Quality review and use of Recordings

8.1We review Recordings, automatically and by people, to check that they show the assigned work, meet the quality rules, and contain no excluded material. Section 21 covers human review of automated outcomes.

8.2We may reject a Recording, request a new one, or withhold or reclaim pay for fraud, synthetic or recycled footage, spoofed location, or a material breach.

8.3We may use Recordings and Assist Sessions to verify work, prevent fraud, improve safety, and as evidence in defect, payment, or other disputes.

8.4Rejected and accidental clips are deleted under section 16.

Training and licensing

8.5For a Worker who records for pay, capture, verification, de-identification, annotation, and licensing of the resulting Dataset are the performance under the Worker's contract (Article 6(1)(b) GDPR). Our use of Recordings to develop and improve our own products and models, including Addvista Assist and safety systems, is based on our legitimate interests (Article 6(1)(f) GDPR). You may object under section 17.7.

8.6Where a Company or Subcontractor requires its staff to record, we do not rely on those staff members' consent. Our legal basis toward them is legitimate interests, under the joint arrangement in section 4.

8.7For bystanders and other people on site, our legal basis is legitimate interests, limited to capture, review, and de-identification.

8.8Before we license a Dataset we:

(a) blur or mask faces and heads;

(b) blur or remove license plates, screens, identity documents, plans and drawings, payment cards, badges, and name tags;

(c) remove audio unless the people who can be heard have consented;

(d) coarsen location and remove account links and keys from the delivered copy; and

(e) exclude clips of minors, injuries, and other special-category content.

8.9A face detector may run briefly to place a blur. We do not store face templates, embeddings, or galleries, and we do not use face recognition.

8.10Annotation labels describe the actions, tools, successes, and failures of the task.

8.11Licensees receive a non-exclusive, purpose-limited license. They may not redistribute the footage, re-identify any person, household, site, or device, build biometric identification systems, infer special-category attributes, infer emotions in the workplace, monitor or discipline the people recorded, or generate a person's likeness or voice from the footage. They must bind their contractors to the same limits and delete files on our notice.

8.12Models already trained on a Dataset are not retrained after a deletion request or objection, unless the law requires it.

Review by other Users

8.13We may show short De-identified excerpts of Recordings to other Users who perform paid review tasks. Reviewers see no names and never Recordings from their own Company. We process reviewers' answers to verify Recordings, pay reviewers, and measure review accuracy (Article 6(1)(b) and (f) GDPR). For Peer Review, a person checks a photo of your trade qualification document; we keep only the result and delete the image after our decision.

09Addvista Assist

9.1Addvista Assist is an assistance system that helps qualified workers check their own work steps. It can make mistakes and does not replace professional judgment, inspections required by law, or occupational-safety duties. The user and the company remain responsible for the work.

9.2Assist is an AI system. We tell you so at your first interaction. Assist does not infer emotions.

9.3If you use Assist for your own work, we process the live feed to provide the service (Article 6(1)(b) GDPR). For business customers, section 4.6 applies.

9.4We keep Assist Sessions for a limited period, by default 90 days, for quality assurance, safety, support, and fraud prevention, based on our legitimate interests. We may keep a specific session longer while an incident, dispute, or claim is open.

9.5We use Assist Sessions to improve and develop our products and models, based on our legitimate interests. We use de-identified material for training where reasonably possible. You may object at any time in the app settings or under section 17.7. On free and solo plans, improvement is on by default and you can switch it off. On paid team plans, the customer's administrator may also switch it off for the team.

9.6Audio in an Assist Session is recorded or stored only with consent.

9.7Live Help between users. If you call another User for live help, we transmit the live video and audio between the participants to provide the call (Article 6(1)(b) GDPR). We do not record or store the call content. We keep call metadata (participants, time, duration, task) as account and security data. Tell people present before you start a call; section 12 applies to them.

10Payouts, tax, marketing, and security

Payouts and tax

10.1Independent Workers may receive a bonus for Verified hours at the amount shown for the task. Workers who record as employees or contractors of a Company are paid by that Company, and we pay the Company.

10.2Card and bank details are handled by a payment provider. We do not store full card numbers or card security codes.

10.3We collect the tax forms and identifiers that tax law requires, such as US Forms W-9 and W-8 and EU platform-reporting data under the German Platform Tax Transparency Act (PStTG), and we report to tax authorities as tax law requires.

10.4We keep payout and tax records for the periods in section 16, separately from training data.

Marketing

10.5We send marketing email only with your consent, except under section 10.6. We send marketing text messages and automated marketing calls only with your prior express written consent. That consent is not a condition of an account, of being paid, or of buying a service.

10.6Where German law allows, we may email existing customers about our own similar products or services if you did not object when we collected your address. Every message lets you opt out.

10.7Marketing texts support STOP and HELP. Message and data rates may apply.

10.8You may withdraw consent or object to marketing at any time through the link in the message or by emailing data@addvista.com. We keep a minimal suppression record so we do not contact you again.

Security, fraud, and claims

10.9We process logs, device-attestation data, and investigation files to protect accounts, prevent fraudulent hours, and keep the service available.

10.10We may keep specific material needed to establish, exercise, or defend a legal claim.

Website forms

10.11When you send a form on our website, we use the details you enter, such as your name, email address, company, and message, to answer your request and to send you a short confirmation email. Forms are delivered by email through our email provider (section 14.1(b)). To prevent abuse, we store a one-way hash of your IP address with the times of your recent submissions and delete it after a short time, normally ten minutes. Legal basis: Art. 6(1)(b) GDPR where your request concerns our services or a contract, otherwise Art. 6(1)(f). We keep your request as customer-service correspondence under section 16.

Online tech demo (not app users)

10.12This section applies only to people we have given access to our online tech demo, such as investors and partners. It does not apply to users of the Addvista app. In the demo we show technology and additions to our platform that are still to come. If you have received access, we use your email address as your username, store your password only as a one-way hash, and log the date and time when you sign in and out, to provide the demo and protect it from misuse. Your email address appears faintly on the demo screens, so shared screenshots can be traced. A sign-in cookie keeps you signed in; it ends when you close your browser or after 12 hours without activity (section 23.1). After failed sign-ins we store a one-way hash of your IP address and delete it after 15 minutes. On a phone, the demo can show your camera as a live view; the picture stays on your device and is not recorded or sent to us. Legal basis: Art. 6(1)(f) GDPR, our interest in showing our product securely to the people we are in contact with. We delete the sign-in log after 3 months and your account details when we end your access.

11Construction clients, subcontractors, applicants, and special categories

Subcontractors

11.1Before site access we process the compliance documents a Subcontractor must provide, such as tax and social-security clearances, trade registrations, minimum-wage declarations, posted-worker and right-to-work evidence, insurance certificates, and safety documents. We use them to perform the subcontract and meet legal duties. Access to identity and immigration documents is restricted, and they are not used in Datasets or model training.

11.2Subcontractor staff who are recorded are covered by sections 4.4, 8.6, and 12. Any data fee is paid to the Subcontractor.

Special categories and biometric data

11.3We do not seek special-category data. If a Recording shows an injury, medication, a clinical conversation, or other health information, we delete that segment.

11.4We do not use facial recognition and do not create, store, or use face templates, face geometry, iris scans, fingerprints, voiceprints, or hand-geometry templates.

11.5Where special-category data cannot be avoided and we need to keep them, we keep them only with your explicit consent (Article 9(2)(a) GDPR) or under another exception in Article 9(2) GDPR; otherwise section 11.3 applies.

11.6We do not infer race, ethnicity, religion, political views, trade-union membership, health, sexual orientation, or emotions from footage.

Applicants

11.7If you apply to work for us, we use your application to decide whether to hire you (Article 6(1)(b) GDPR). We keep a rejected application for six months after we close it, unless you agree to a talent pool or a longer hold is needed for a possible claim.

11.8An automated screening result never alone rejects an application. A person reviews it.

12Bystanders and people on site

12.1If you appear in a Recording but did not give us your data, the source is the Recording a Worker made while doing the job. The data are your image, any audio that was lawfully on, coarse location, and your incidental appearance in the work area. We inform you through this policy, site signs or QR codes, and the advance notice given by the Client or Company. The other information GDPR Article 14 requires, including recipients, transfers, retention, and your rights, is in sections 14 to 17. Where we cannot identify you, or individual notice would involve disproportionate effort, this public notice applies (GDPR Article 14(5)(b)).

12.2Our legitimate interests are to capture the work and to de-identify people who are not its subject. You may object at any time.

12.3On site, ask the crew to stop. Afterwards, email data@addvista.com with the place, the date or time window, and what you remember. You do not need an account. We handle your request as section 17.11 describes.

12.4In a private home, the Client acknowledges the recording at booking and warns other adults. The Worker pauses if an uninformed person enters or anyone objects.

13Employees of Companies and Subcontractors

13.1If you record because your employer requires it, your in-app acknowledgement confirms that you received the notice. It is not consent. The legal basis is the one in section 8.6, together with your employer's own legal basis.

13.2We do not provide Recordings or Assist outputs to your employer for decisions about individual employees, except where the law requires a specific disclosure.

13.3Your employer gives you the notices that employment and workplace-monitoring laws require, including US state electronic-monitoring notices. Where we are the employer, we give them.

13.4You may exercise your rights against your employer or against us. For Recordings and Assist Sessions we hold, write to data@addvista.com.

14Recipients

14.1We disclose personal data to:

(a) Addvista Companies that operate the service, host data, or perform group functions, under this policy.

(b) Vendors for hosting, cloud infrastructure, annotation, payments, email and SMS, and support, under written contracts. Annotators see unblurred material only where needed to complete de-identification, under confidentiality. Current categories and regions: website hosting by Alfahosting GmbH, Halle (Saale), Germany; [app and cloud hosting provider and region], [annotation vendors], [payment provider]; email by Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland), with email data stored in the European Union; transactional email by Mailgun Technologies, Inc. (part of Sinch), EU region with data centers in Germany and Belgium; [SMS provider], [support tools].

(c) Companies, which receive their administrators' account and team data, verification status, and the hour ledger for their revenue share.

(d) Licensees, which receive de-identified Datasets under the Licensing Terms.

(e) Authorities, including tax authorities, courts, and regulators, where the law requires it.

(f) Professional advisers, such as lawyers, accountants, auditors, and insurers, under confidentiality.

(g) Buyers and investors in a merger, financing, reorganization, or sale of all or part of our business, under confidentiality.

(h) Other Users, who see De-identified excerpts in review tasks and, in Live Help, the live view of the User they help.

14.2We do not sell or share personal information as US state privacy laws define those terms. Section 18 covers dataset licensing under US law.

15International transfers

15.1Addvista Inc. is established in the United States. Personal data from the EEA, the UK, and Switzerland may be transferred to the United States and other countries.

15.2Where we host data in the EEA, the region is [EEA hosting region].

15.3Where a US recipient is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision. Current status: [DPF certification status, and the Department of Commerce list link].

15.4Otherwise we use the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) and, where needed, supplementary measures.

15.5Licensees outside the EEA that receive personal data are bound by an appropriate transfer safeguard.

15.6For the United Kingdom we use the UK-US data bridge, the UK addendum to the standard contractual clauses, or the UK International Data Transfer Agreement. For Switzerland we use the Swiss-US Data Privacy Framework or the Swiss addendum to the standard contractual clauses.

15.7You may ask us for a copy of the safeguards that apply to your data.

16Retention

16.1We keep personal data for the periods below, or shorter if the purpose ends sooner. We may keep specific data longer while a legal claim, dispute, or investigation is open, or where you ask us to restrict processing instead of deleting.

16.2When a period ends, we delete the data. Data in backups are deleted in the regular backup cycle and are not restored except to delete them.

17Your rights in the EEA, the United Kingdom, and Switzerland

17.1Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, you have the rights below, under the conditions the law sets.

17.2Access. You may ask whether we process your personal data and for a copy, with the information GDPR Article 15 lists.

17.3Rectification. You may have inaccurate data corrected and incomplete data completed.

17.4Erasure. You may have your data erased where the law provides, for example where you withdraw consent, object successfully, or we no longer need the data. We may keep data we must retain by law or need for legal claims.

17.5Restriction. You may have processing restricted in the cases GDPR Article 18 lists.

17.6Portability. Where processing is based on contract or consent and is automated, you may receive the data you provided in a machine-readable format, or have it sent to another controller where technically feasible.

17.7Objection. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, including product and model development from Recordings and Assist Sessions. We then stop, unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or need the data for legal claims. If you object before a Recording is in a released Dataset, we exclude it. You may object to direct marketing at any time; we then stop it.

17.8Withdrawal of consent. You may withdraw consent at any time, as easily as you gave it, in the app settings or by email to data@addvista.com. Withdrawal does not affect processing before withdrawal.

17.9Automated decisions. You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Section 21 explains our approach.

17.10Complaint. You may complain to a supervisory authority, in particular in the EEA country of your habitual residence, place of work, or the alleged infringement. In the United Kingdom, the authority is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. Section 25 lists contact details.

17.11Deletion of Recordings in Datasets.

(a) Before a Recording has been released in a Dataset, we delete it.

(b) After release, we delete the copies and linking keys we hold, stop further distribution, exclude the Recording from future releases, and tell the Licensees that received it, unless this is impossible or involves disproportionate effort (GDPR Articles 17(2) and 19). Our licenses require Licensees to delete affected files on our notice.

(c) Models already trained are not retrained, unless the law requires it.

(d) We tell you what we did.

17.12We respond within one month. We may extend by two further months for complex or numerous requests, and we will tell you why. We may ask for information to confirm your identity.

17.13Requests may be made in the app or by email to data@addvista.com.

18United States privacy rights

California notice at collection

18.1This section is our notice at collection for California residents and describes our practices under the CCPA.

18.2We collect the categories of personal information below, from the sources listed, for the purposes in section 6, and keep them for the periods in section 16.

18.3We do not collect biometric information to identify a consumer.

18.4We do not use personal information for materially different purposes without notice.

Sale, sharing, and de-identified Datasets

18.5We do not sell or share personal information. If we ever do, we will provide a "Do Not Sell or Share My Personal Information" link at [Do Not Sell or Share link] before we start.

18.6Datasets we license are de-identified information under California Civil Code § 1798.140(m):

(a) we take reasonable measures so that the information cannot be associated with a consumer or household;

(b) we publicly commit to maintain and use the information only in de-identified form and not to attempt to re-identify it, except to test our de-identification processes; and

(c) we contractually require recipients to comply with these requirements and to pass them on to anyone who receives the information from them.

18.7We apply the same commitments to the de-identified-data provisions of other US state privacy laws. Copies we hold that can still be linked to a person remain personal information, and your rights apply to them.

Sensitive personal information

18.8We use sensitive personal information only for the purposes permitted by California Civil Code § 1798.121, such as providing the service you request and security. We do not use it to infer characteristics about you.

18.9Where another state requires opt-in consent before processing sensitive data, we obtain it.

18.10Because we do not use sensitive personal information beyond the permitted purposes, we do not offer a separate limit link. If that changes, we will provide a "Limit the Use of My Sensitive Personal Information" link at [Limit the Use of My Sensitive Personal Information link].

Notice of financial incentive

18.11We offer two financial incentives related to personal information.

18.12The incentives are:

(a) Recording bonus. An independent Worker may earn a bonus per Verified hour of recording. The personal information involved is identifiers, audio and visual information, commercial information, coarse geolocation, and professional information. You opt in by accepting a task after reading the in-app notice.

(b) Preferential Price. A Client booking with recording receives the Preferential Price instead of the Recording-Free Price. The same categories are involved, plus the site address. A California consumer opts in by booking with recording after reading the notice at booking.

18.13We calculate the value of the personal information in good faith as the average price Licensees pay for a Verified hour of the relevant task type (or the current list price where no average exists), minus the average direct cost of capture support, quality review, de-identification, annotation, storage, and payout administration for that hour. The bonus, and the difference between the Recording-Free Price and the Preferential Price, do not exceed that value. The current amounts are shown on the task card and at checkout.

18.14You may withdraw from an incentive at any time by stopping recording, switching to the Recording-Free Price under section 7.12, or emailing data@addvista.com. Pay already earned for Verified hours is not affected, except for fraud. We do not discriminate against you for exercising your privacy rights.

California rights

18.15California residents may request to know the categories and specific pieces of personal information we collected, the sources, the purposes, and the categories of recipients; may request correction and deletion; and may opt out of sale or sharing and limit the use of sensitive personal information as sections 18.5 and 18.10 describe. These rights also apply to employees, contractors, and business contacts.

18.16You may submit requests in the app or by email to data@addvista.com.

18.17We verify requests by matching them to information we hold. Bystanders may describe the session.

18.18You may use an authorized agent. We may require written permission and verify your identity directly.

18.19Where California rules on automated decision-making technology apply, we give the required notices and let you appeal to a person.

Other US states

18.20If you live in a state with a comprehensive privacy law that applies to us, you may request access, correction, deletion, and a copy of your data, and opt out of sale, targeted advertising, and profiling with legal or similarly significant effects.

18.21We respond within 45 days, or a shorter period if the law requires, and may extend where the law allows. If we decline, you may appeal by replying to our answer or by emailing data@addvista.com with the word "Appeal". If we deny the appeal, we tell you how to contact your state attorney general.

18.22We honor opt-out preference signals, including the Global Privacy Control, where the law requires it.

Biometric, audio, and health laws

18.23We do not collect biometric identifiers or biometric information, as defined by the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Washington law, or other state laws, and we do not create face templates or other identifiers from Recordings.

18.24Audio follows section 7.7. We do not record in restrooms, locker rooms, changing areas, or similar private places.

18.25We do not collect consumer health data as defined by Washington's My Health My Data Act.

18.26Where US state law requires employers to give notice of electronic monitoring, the employer of the crew gives that notice.

Children

18.27Our services are not directed at children. We do not knowingly collect personal information from children under 13 and do not sell or share personal information of consumers under 16.

18.28We do not record minors. If a minor appears in a clip, we delete that segment. If you believe we hold a child's data, email data@addvista.com.

Do Not Track

18.29We do not respond to browser Do Not Track signals. We honor the Global Privacy Control as section 18.22 describes.

19Security

19.1We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, multi-factor authentication for production systems, separate storage of re-linking keys, access logs for raw footage, and confidentiality duties for staff and Vendors.

19.2Current certifications: [security certifications, if any].

20Breach notification

20.1If a personal-data breach occurs, we notify the competent authorities and affected people where and within the time the law requires.

21Automated decisions and AI transparency

21.1Addvista Assist is an AI system. We tell you so at your first interaction. We do not use Assist to infer emotions in the workplace.

21.2We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, such as denying pay for an hour, refusing a bonus, or rejecting an application. A person reviews the outcome where you ask, and you may contest it in the app or at data@addvista.com.

21.3Where a Licensee needs it for its AI documentation duties, we provide a data card describing a Dataset. It does not contain Worker names, consent forms, or site addresses.

22Risk assessments

22.1We carry out data-protection impact assessments where the law requires them.

23Cookies and SDKs

23.1Strictly necessary. These are required to provide the service you ask for, such as security, authentication, and storing your cookie choices. They run without consent.

23.2Analytics. These measure how the site or app is used. In the EEA, the UK, and Switzerland, and wherever the law requires it, they run only with your consent (in Germany under § 25 TDDDG). Current tools: Google Analytics 4, by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It shows us which pages and forms are used. It sets the cookies `_ga` and `_ga_<ID>` (up to 2 years) and only runs if you agree. Google does not store IP addresses of EU visitors. We keep the data for 14 months. Data may go to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time under "Cookie settings".

23.3Marketing cookies and pixels. These measure campaigns or build advertising audiences. They run only with your consent. Current tools: none. If a tool shares identifiers for cross-context behavioral advertising, section 18.5 applies.

23.4Functional. These remember choices such as language. They run without consent only where strictly necessary for a choice you made.

23.5Manage cookies via "Cookie settings" at the bottom of every page. Rejecting is as easy as accepting, and you may change your choice at any time.

23.6The app may ask for camera, microphone, motion, location, photos or files, and notifications. Each permission is used only for the feature that needs it. You can withdraw a permission in your device settings.

24Changes to this policy

24.1We may update this policy. We post the new version here and change the "Last updated" date. For material changes, we give reasonable advance notice by email or in the app.

24.2Where a change requires your consent, we ask for it.

25Contact and authorities

25.1Privacy requests: data@addvista.com or in the app. Postal address: Addvista Inc., 8 The Green, Ste R, Dover, DE 19901, USA. Support: support@addvista.com.

25.2Supervisory authorities:

(a) EEA: the authority of your habitual residence, place of work, or place of the alleged infringement.

(b) United Kingdom: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom, ico.org.uk.

(c) Switzerland: Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, Switzerland, edoeb.admin.ch.

(d) California: California Privacy Protection Agency, cppa.ca.gov, and the California Attorney General.

(e) Other US states: your state attorney general.

25.3We do not charge for reasonable requests. Where a request is manifestly unfounded or excessive, we may refuse it or charge a reasonable fee where the law allows.