Privacy policy: your data stays yours. We just label it.

01Who we are and scope

InitLabel ("InitLabel," "we," "us," or "our") provides high-precision, human-in-the-loop data annotation for AI teams, along with related business process outsourcing (BPO) services. This Privacy Policy explains how we collect, use, store, share and protect personal data in connection with our website, enquiries, client accounts, recruitment and the AI data-labeling and BPO services we deliver.

We believe that being transparent about data is part of being a good partner. This policy should be read together with any project-specific privacy notice, contract or data-processing agreement (DPA) that applies to your engagement. Where those documents give more specific commitments, they take precedence for that project.

We handle personal data lawfully, fairly and transparently, and only for clearly defined purposes. Where applicable, our practices are designed to align with Kenya's Data Protection Act, 2019 and its regulations, as well as other privacy laws that apply to a particular engagement, such as those that govern your organisation or the people in your datasets.

02Personal data we collect

We collect only what we need, and what we collect depends on how you interact with us. It may include:

• Contact and business details: your name, work email, company, job title, phone number, country and any information you include in a project enquiry or quote request.
• Account and usage data: login identifiers, account preferences, access logs, security events and the activity needed to operate, support and protect our platforms.
• Commercial records: quotations, contracts, invoices, payment status, purchase orders and communications that relate to our business relationship. Payment-card details are handled by the relevant payment provider and should never be sent through a contact form.
• Recruitment and workforce data: CVs, qualifications, skills assessments, availability, work history, payroll or contractor records and other information shared during an application or engagement with our team.
• Technical information: device and browser details, IP address, approximate location inferred from technical data, cookies and diagnostic logs where these are collected.
• Project information: instructions, guidelines, feedback and communications relating to a client project. Project datasets themselves may contain personal data and are governed by the project contract and your processing instructions (see section 3).

Please share only information that is relevant to your request. Avoid sending sensitive personal information through general enquiry forms unless we have specifically asked for it and provided an approved, secure method.

03Customer datasets and annotation data

Our clients trust us with the raw material of their AI: images, video, audio, text, documents, LiDAR point clouds, records and other source data for labeling, transcription, evaluation, content moderation, data cleansing and related work. Some of this material may contain information about identifiable people, and we treat it accordingly.

We will not use identifiable client datasets to train our own general-purpose models, or for any unrelated purpose, unless you have expressly authorised that use in writing and any required legal basis is in place. Your competitive edge stays with you.

High-risk and sensitive data

If a dataset includes sensitive personal data, children's data, biometric data, health information, financial records or other high-risk material, please tell us before any transfer. This lets us design the right protections from the start. Depending on the risk, we may carry out a risk assessment, add safeguards, put a separate agreement in place, or, where appropriate protections can't be established, decline the work. We'd rather say no than put your data or the people in it at risk.

04Why we use personal data

We use personal data to run a reliable, responsive business for you. Depending on our relationship, that means we may use it to:

• respond to enquiries, scope projects, prepare quotations and communicate with you;
• create and administer accounts, provide support and deliver the services you've contracted;
• manage recruitment, onboarding, training, workforce scheduling, payroll and contractor administration for the skilled teams who do the work;
• process invoices, keep business records and meet tax, accounting and other legal obligations;
• protect our systems, detect fraud or misuse, investigate incidents and enforce our agreements;
• improve our website's functionality, reliability and accessibility, and refine how we run services; and
• send relevant business updates where permitted, always with an easy way to opt out of marketing.

We don't collect more personal data than we reasonably need for each purpose, and we don't repurpose it for something materially different without an appropriate legal basis and, where required, telling you first.

05Lawful basis and roles

Where the law requires a lawful basis for processing, we rely on the one that fits the activity and jurisdiction. That may be steps taken at your request before entering a contract, performance of a contract, compliance with a legal obligation, your consent, protection of vital interests, a task carried out in the public interest, or our legitimate interests, where those interests don't override your rights and freedoms.

For our own activities (website enquiries, recruitment, account administration and business records), InitLabel generally acts as a data controller.

For client datasets processed to deliver annotation or BPO work, the client usually decides the purposes and essential means of processing, so InitLabel usually acts as a data processor. The actual roles depend on the facts and the written agreement; in some situations, the parties may have different or joint roles, and we'll document them clearly so there's no ambiguity.

06When data is shared

We do not sell personal data. We share only the minimum information necessary, and only with:

• authorised employees, annotators, reviewers, supervisors and project managers who need access to carry out assigned work;
• approved providers of hosting, infrastructure, communications, authentication, productivity, security, payment and similar services;
• professional advisers, auditors, insurers or financial institutions where necessary for their services;
• regulators, courts, law-enforcement bodies or other recipients where disclosure is required or permitted by law; and
• a successor or transaction partner in connection with a proposed business transfer, subject to appropriate safeguards and applicable law.

Our service providers are expected to handle information under appropriate contractual and security obligations. If your project requires specific approved tools, named subprocessors, processing locations or prior approval before any new provider is used, we'll write those requirements into your project agreement.

07International transfers

InitLabel serves AI teams around the world from Kenya, so some service providers, clients or project teams may be located outside the country. Whenever personal data crosses borders, we apply the safeguards required by applicable law and your contract. Those safeguards may include assessing the destination, using contractual protections, restricting access or obtaining consent where legally required.

If you have data-residency requirements or transfer restrictions, please tell us before you share project data, so we can design the engagement around them from the outset.

08Security safeguards

We use reasonable technical and organisational measures matched to the nature of the information and the level of risk. Depending on the system and project, these may include:

• role-based access and least-privilege permissions;
• authentication controls and secure transmission;
• device and workspace restrictions;
• confidentiality obligations and regular staff training;
• activity logging, backups and incident-response procedures.

We'd rather be precise than overpromise: specific certifications or controls are not implied unless we expressly state and verify them for your engagement. If you need evidence of particular controls, ask us and we'll walk you through what applies to your project.

No system can be guaranteed to be perfectly secure. If we become aware of a personal-data incident affecting information we're responsible for, we'll assess it promptly and notify affected clients, individuals or authorities as required by applicable law and contract.

09Retention and deletion

We keep personal data only as long as reasonably necessary for the purpose it was collected for, including to deliver our services, resolve disputes, maintain security, meet legal obligations and enforce agreements. Retention periods vary by data type and relationship.

At the end of a project, client datasets and derived project files are returned, deleted or retained according to the statement of work (SOW) and data-processing agreement, subject to legal retention requirements, backup cycles and any documented exceptions.

If you ask us to delete your personal data, we may need to verify your identity first. Some information may be exempt from deletion where we're required by law to keep it or need it to establish, exercise or defend legal claims.

10Your privacy rights

Subject to applicable law and its exceptions, you may have the right to:

• Be informed about how your personal data is processed
• Access the personal data we hold about you
• Correct information that is inaccurate or incomplete
• Delete personal data, where an exception doesn't apply
• Object or restrict certain types of processing
• Withdraw consent where processing relies on consent
• Challenge automated decisions in certain circumstances
• Complain to the relevant data-protection authority

Rights and procedures differ by jurisdiction. To make a request, email hello@initlabel.com with "Privacy Request" in the subject line and enough detail for us to understand what you're asking. We may ask for reasonable verification before acting.

If we process your information solely on behalf of one of our clients, we may refer your request to that client or help them respond, as our agreement and applicable law require.

11Cookies and analytics

Our website may use essential cookies and similar technologies needed for security, session management and core functionality. If we use analytics or preference cookies, we'll provide any notices and choices required by applicable law.

You can also manage cookies through your browser settings, although disabling essential cookies may affect some features. The specific tools in use, and any consent controls, reflect the live configuration of our website at the time you visit.

12Children's data

Our services are designed for businesses and professional users, not for children to use independently. If a client project involves children's personal data, the client must tell us before transferring it and ensure all required legal grounds, notices, approvals and safeguards are in place. We may decline such projects where appropriate protections can't be established.

13Changes to this policy

We may update this policy as our services, systems or legal requirements evolve. The current version will always be published on this page with a revised effective date. If a change materially affects how we handle personal data in an active client engagement, we'll address it through the applicable notice or contract where required.

14Contact us

Questions, requests or concerns about this policy or any personal data handled by InitLabel are always welcome. Email us at hello@initlabel.com or visit our contact page. If a data-protection contact has been designated for your project, you can also use the details in your project documentation.

To learn more about data-protection rights and the role of Kenya's Office of the Data Protection Commissioner, visit the ODPC rights of a data subject page.