Human Archive procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Human Archive is based in the United States, and we operate the Service primarily from the United States. We and the vendors we use to provide the Service may store and process personal information in the United States and in other countries where we or those vendors operate. Privacy and data-protection laws in those countries may be different from, and may be less protective than, the laws of your state, province, or country. By using the Service or providing personal information to us, you understand that your personal information may be processed in those locations.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Payment, tax, KYC, and anti-fraud records that we are required to retain by law.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We will describe in your account-deletion confirmation what we have deleted and what we are retaining and why. Deleted recordings that were never approved will be removed from our active systems on the schedule set out in our internal retention practices.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Retention and destruction. We keep voice recordings and derived biometric data only as long as needed for the purposes above and per our retention schedule (section 9). For biometric identifiers, we destroy them no later than the earlier of (a) satisfaction of the purpose for which they were collected or (b) three years after your last interaction, consistent with BIPA. Approved recordings incorporated into datasets are de-identified and retained as described in sections 5.7 and 6.6.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Records reasonably necessary to detect security incidents, investigate fraud or abuse, defend or assert legal claims, or comply with law.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can delete your contributor account at any time from within the app, under Settings → Account → Delete Account, or by contacting us at the address in Section 13. When you delete your account, we will delete or de-identify personal information associated with the account, except for information that we are required or permitted to retain, including:” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain personal information for as long as needed to provide the Service to you, to operate our business (including paying contributors, calculating earnings, performing fraud and quality reviews, and meeting tax and accounting obligations), and to comply with our legal obligations. In general, we retain account and profile information while your account is active and for a reasonable period after account closure to handle final payouts, tax reporting, dispute resolution, and recordkeeping required by law. We retain rejected submissions only for the limited time needed to administer the review and any appeal, and we retain approved submissions and the metadata required to support our licensing of those submissions for the duration of the applicable customer license and our recordkeeping obligations. We retain payment, tax, and KYC information for the periods required by tax, anti-money-laundering, and other applicable laws, and we retain support, diagnostic, and security logs for the periods needed to operate and secure the Service. When personal information is no longer needed for the purposes described in this Privacy Policy, we will delete, de-identify, or archive it in accordance with our internal retention practices.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Mobile-platform services — used for app distribution, device permissions, crash diagnostics, and other platform-level features provided by the operating-system vendors.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share personal information with other third parties when you direct or authorize us to do so — for example, when you choose to connect your Human Archive account to a third-party service.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Platform providers — for example, Apple and Google may share information that they collect as the platform operators (such as crash diagnostics) and that we use to operate the app.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Service may contain links to websites, mobile applications, and other online services operated by third parties (for example, to the privacy policy or support resources of our payout provider, or to platform pages operated by Apple or Google). These links are not an endorsement of, or a representation that we are affiliated with, any third party, and we do not control or take responsibility for the practices of third-party services. We encourage you to read the privacy policies and other terms of any third-party website, application, or service you use.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Cloud storage and supporting infrastructure — used to store uploaded recordings and related files and to host our systems.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payout, tax/KYC, and sanctions-screening services — used to process payouts to contributors and to satisfy applicable identity, tax, and anti-fraud obligations. Our payout providers are Arc and Stripe; certain payment, identity, or tax information you provide may be collected by those providers directly under their own terms and privacy policies (Stripe’s is available at https://stripe.com/privacy ).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Fraud, security, and identity-verification vendors — who may share signals indicating that a sign-up, login, or submission warrants additional review.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The third-party software-development kits (SDKs) currently embedded in the app are limited to (i) the Supabase SDK, which supports our authentication, contributor database, and backend services, and (ii) MediaPipe, which performs certain on-device image analysis used to calculate aggregate quality metrics about your recording (for example, the percentage of frames containing a hand). MediaPipe runs entirely on your device, and neither the recordings, the frames, nor the underlying biometric landmarks it processes are transmitted off your device by MediaPipe.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Quality-assurance analysis has two parts. The hand-visibility analysis described above (MediaPipe) runs entirely on your device. Separately, to confirm that a clip shows the assigned task, the app sends a small number of still video frames — approximately one per minute while you are recording — to an automated AI service, the Google Gemini API, which returns a relevance result. Only individual still frames are sent for this check; your full recordings, your motion data, and the on-device biometric landmarks are not. Under our arrangement with this provider, the frames are used solely to return the relevance result, are not retained by the provider after the check, and are not used to train the provider's models. We disclose this check to you in the app before you record, and you consent to it as part of recording. We do not otherwise transmit your recordings or the biometric landmarks derived from them to any third party for automated quality review.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Analytics, security, fraud-detection, and reliability vendors — used to operate, secure, and improve the Service.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may combine the personal information we receive from you with information falling within one of the categories above that we receive from third parties, such as:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business-transaction counterparties — we may receive personal information in connection with an actual or prospective merger, acquisition, financing, or similar transaction described in Section 6.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share personal information with vendors that provide services on our behalf, under written contracts that restrict their use of personal information to providing services to us. We currently use, or expect to use, vendors in the following categories:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We require each service provider to use personal information only to provide services to us and in accordance with our instructions, to maintain appropriate confidentiality and security measures, and to comply with applicable law.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Service providers. Real-time conversation audio is carried and recorded via LiveKit; automated assessment scoring uses the Google Gemini API; recordings are stored with our cloud hosting provider. These providers process voice data on our behalf under contract.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ International transfer. Voice data may be processed and stored outside your country, including in the United States, subject to appropriate safeguards (section 11).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may share personal information when we believe disclosure is necessary or appropriate to: comply with applicable law, legal process, or lawful requests from public authorities; enforce our terms; detect, prevent, or address fraud, security or technical issues; or protect the rights, property, or safety of Human Archive, our contributors, our customers, or others.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Submission review and quality-assurance tools — used to evaluate submissions through automated review and, where applicable, through review platforms used by our trained reviewers.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payout providers — who may share back account-status, identity-verification status, tax-status, or transaction-status information so that we can manage eligibility and reconcile payouts.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ A core purpose of the Service is to license approved recording datasets to AI and robotics customers. When we approve a submission, we may include the recording itself (first-person video, IMU and motion data, camera-calibration data, and associated metadata) in datasets that we license to AI and robotics labs and similar customers under a written agreement. Those agreements restrict the customer’s use of the data to the purposes specified in the agreement, prohibit re-identification of contributors except as expressly permitted, and require the customer to keep the data confidential and secure. We do not license your account profile, payment, or government-issued identification information to AI or robotics customers.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Authentication, contributor database, and backend services — used to manage accounts, sign-in, and our core backend.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.