Privacy & Data Protection

1. Who is processing your data

Fourthuman (the Data Fiduciary under the DPDP Act) is an India-based training-data company. For anything in this notice: privacy@fourthuman.ai.

Grievance Officer, at privacy@fourthuman.ai. We respond to a grievance within 30 days.

2. What we collect, and what each item is for

Itemised as the Act requires: each category tied to its purpose, no bundling.

2.1 · Categories of personal data, and the single purpose each is held for
Who	Personal data	Purpose, and nothing else
Capture Partners	Name, mobile number, email	Your account, and reaching you about tasks and payouts
	Registration answers: city, the places you could record, the hours you could give in a week, phone operating system, and how comfortable you are with a camera, whether in front of one or wearing one	Matching you to Capture Briefs you can record
	The languages you speak	Contacting you in a language you speak
	The languages you speak	Matching you to Capture Briefs recorded in that language
	Gender and age range (optional)	Matching you to briefs that need people of a particular age or gender, or a spread of them. Leaving them blank never stops you registering
	How you heard about us (optional)	Learning which places bring people to us. It is never used to decide anything about you
	Your confirmation that you are 18 or over, and when you ticked the agreement on the registration form	Showing that the registration was made by an adult who agreed to be contacted
	UPI / bank details (VPA)	Paying you: from ₹229/hr, on QA approval. Nothing else
	Egocentric video you record	Creating annotated robotics training datasets: the purpose you consent to, per recording task, in the consent ledger
	Device identifier, city	Capture metadata inside your consent record, so the record describes the actual capture
	The Google address you use in FH Capture, when it differs from the one you registered with	Joining your app account to your registration. We email a one-time code to the address you registered with, and keep a note that we sent it and when, never the code
People who apply for a recording project	Your answers on the application form: full name, age, email address, WhatsApp number, area or town, district and State, gender, what you do most days, the languages you speak and how well, your phone and your room, whether you wear glasses, whether you have spoken on camera and how comfortable you are, how you would upload, your phone's free space, and the hours a week you could give	Choosing who records in that project, and writing to you about it
	The email address you sign in with, which Google confirms to us. We ask Google for nothing else	Checking that the invitation is yours: each link opens only for the address we wrote to
	Your agreement that we may keep your answers, which the form asks for before you send it	Inviting you to future projects
	If you name a friend: your agreement that we may tell them you did, and share your name, email and phone with them	Showing your friend that our email is real
People invited to the welcome-kit form (Getting ready to record)	Your answers on the form: name, email address, phone number, town and State, that you are 18 or over, which recording work you could do, whether you own a head mount, your phone's make, model and Android version, your internet at home, whether other people would appear when you record, whether you could wear a phone on your head, the language for your printed guide, your gender, your age, your work in detail, and what you do in your free time	Choosing who receives a welcome kit, in this round or a later one. We keep these answers with your registration so that you need not give them again; write to privacy@fourthuman.ai and we delete them
	Your delivery address, the phone number for the courier and any delivery note, with your agreement that we may keep them	Posting your head mount. Only the courier that delivers it receives them. We delete them when the next round's kits are chosen, or 12 months after this round's choice if there is no next round; if you receive a kit, we keep its tracking number and the date. When you are chosen for a head mount, FH Capture shows you the delivery address you gave, so you can check it before we post it. We keep that copy only until you confirm, or until the date to confirm by has passed
	The email address you sign in with, which Google confirms to us. We ask Google for nothing else	Checking that the invitation is yours: each link opens only for the address we wrote to
Friends and family named on an application	Your name, email address and, if given, WhatsApp number, which we receive from the person who named you, with their confirmation that you agreed	Emailing you once with the form, saying who named you, and inviting you to future projects. Reply “no” to that email, or write to privacy@fourthuman.ai, and we delete your details
Commissioning labs	Business contact details, enquiry contents	Answering the enquiry and managing the engagement
Job applicants	Your email, what you write in it, and any CV or other file you attach	Considering you for a role, and replying to you
Site visitors	Whatever you type into a contact form	Replying to you
	The pages you open, the page you came from, your country, and your type of device, browser and operating system	Counting which pages are read, as described under cookies and analytics below
	A one-way fingerprint of your IP address, made with a secret key so it cannot be turned back into the address. We delete it the next time any form is sent after the hour it was made in.	Stopping one address from sending a form many times

2.2 · The FH Capture app

FH Capture is the Android app Capture Partners record with. This is what it collects, when, why, and how long we keep it. Everything the app sends travels encrypted, over HTTPS, to our own computers in India.

2.2 · What FH Capture collects
What	When	Why, and nothing else	How long we keep it
Your name, email address and Google account ID, which Google gives us	When you sign in with Google	Making and finding your FH Capture account	While your account exists (section 4.2)
Your phone's notification address, a code Google gives FH Capture	When you sign in	To tell your phone at once that a note has reached your Inbox. The message carries nothing else	Until you sign out or delete your account
Your answers in Tell us about you: full name, phone number, email address, date of birth, your gender if you give it, the languages you speak, your city, the places you could record, the hours a week you could give, which kind of camera work you would like to do, whether you could wear a phone on your head, whether you own a head mount, and a referral code if someone gave you one; and your phone's make, model and Android version, which the app reads itself. The app keeps these on your phone until our computers can take them	When you fill in Tell us about you	Your account; checking you are 18 or over; matching you to Capture Briefs you can record, including briefs that need people of a particular gender or a spread of them (leaving gender blank never stops you registering); choosing who receives a welcome kit; reaching you about tasks and pay; and counting who referred you	While your account exists
Your approximate location, if you allow it, used once on your phone to suggest your town	In Tell us about you	Filling in your town for you. Your phone's location service (Google's, on most phones) turns the location into a town name	Never kept. We keep only the town, and whether it came from your location, with your account while it exists
Your approximate location, if you allow it, sent once from your browser on the Partner console to suggest your town	In Tell us about you on the Partner console	Filling in your town for you. Our engine finds the nearest town on its own list (from GeoNames); no other service sees the location	Never kept. We keep only the town, and whether it came from your location, with your account while it exists
That you are 18 or over, that you agree to the Terms of Service, and that you have read this notice, each with the time you confirmed it	In Tell us about you	Showing that an adult agreed	While your account exists
Your answers when you ask to join a Capture Brief	When you ask	Deciding whether the brief suits you	While your account exists
Your answers in Getting ready to record: the same questions as the welcome-kit form (section 2.1, its row), and your delivery address, the phone number for the courier and any delivery note	When you fill in Getting ready to record	Choosing who receives a head mount, and posting it	As the welcome-kit form's answers and address (section 2.1)
Your confirmation before we post your head mount: which words you agreed to, their fingerprint (SHA-256), the time, and whether you changed your address	When you tap Confirm and ship	Showing what you agreed to before we posted your head mount	With your kit's record
Your kit card's scan: a fingerprint of the card's code (never the code itself) and the time	When you scan the card in the box	Showing that your head mount arrived, and opening the briefs that need one	With your kit's record
That you joined the Trial recording, and when	When you tap Join	Opening your Trial recording once your own head mount should have arrived	While your account exists
Your agreement before each sitting: its number, the brief, the time, and a fingerprint of the words you agreed to	When you tap I agree to record; sent with your consent	Showing what you agreed to before you recorded	With your consent receipt
Your recordings: video only, with no sound	Only after you give your consent and send them	The purposes you consent to on the app's consent screen	As in section 5, or until you withdraw your consent
Your Trial recording: video only, with no sound, made wearing your own head mount	Only after you give the Trial recording's consent and send it	Checking that you record wearing a head mount: someone at Fourthuman watches a copy with faces blurred first. If it is accepted, it may later be used like your brief recordings, for the purposes you consented to	Deleted at once if it is not accepted. If it is accepted, as your recordings (section 5), or until you withdraw your consent
Each recording's record: its file name, size and fingerprint, start and stop times, the parts you trimmed, any frames lost, your phone's make and model, its Android version and the app version, and a key made for that sitting with Android's proof that it was made on a real phone (the key names no phone)	With each recording	Proving that the file we hold is the one you sent, unchanged	With the recording
App reports: when the app starts or fails, the type of fault and where in the app it happened, your phone's make, model and Android version, the app version, its free storage, which permissions the app has, and which recordings are still waiting on your phone (never what is in them)	Sent automatically once app reports are switched on	Fixing faults, and knowing which phones can record our briefs	90 days
Which briefs you open in FH Capture, and when you use Try it out (the practice camera): the brief's code and the time, nothing else	Sent automatically once app reports are switched on	Seeing who is getting ready to record, when we choose who receives a head mount	90 days
Camera check: your phone's make, model, Android version and app version, and whether its camera can record 1080p video at 30 frames a second	When the app checks your camera, once for each app version	Knowing which phones can record our briefs	Kept only as a count for each phone model, never with your account
Your consent receipt: the choices you ticked, a fingerprint of each recording it covers, and a fingerprint of the words you saw	When you tap I agree and send	Proof of your consent	Always, as proof of what you agreed to and when, including after you withdraw or delete your account (section 4.2)

Town names and locations on the Partner console: GeoNames (geonames.org), CC BY 4.0.

What stays on your phone. Recordings you delete, or choose not to send, never reach us. What the app does not collect: sound, your contacts, your photos or advertising identifiers.

2a. Cookies, analytics, and what is kept in your browser

This site sets no cookies. Not for advertising, and not to remember that you read this sentence.

Cloudflare Web Analytics runs on the public pages of this site. For each page view it records the page, the page you came from, your country, your type of device, browser and operating system, and how quickly the page loaded and responded. It sets no cookie and stores nothing on your device. Its script loads from static.cloudflareinsights.com and reports to this site's own address. Cloudflare, which delivers every page of this site, processes this for us.

Two things can be kept in your browser's local storage on this site. fh_theme remembers the appearance you chose in the footer, and is removed when you choose System; fh_consent remembers your privacy choices. Neither is sent to anyone, and clearing your browser data removes both.

Cloudflare Web Analytics, described above, runs without asking. Anything that would set a cookie, or store something on your device beyond the keys above, is asked for first: refusing takes exactly one click, and it does not run unless you say yes. The Your privacy choices link, in the footer of every page, shows what runs.

3. What never leaves, and what is removed

Faces the detector finds are blurred before any human reviews the footage. Automated detection and redaction runs as a pipeline stage; if the detector cannot run, the pipeline stops rather than passing footage through unblurred.
Your identity is never shipped to a buyer. Delivered datasets and their audit records carry a consent receipt (proof consent exists), never your name, Capture Partner identifier, or device identifier.
External AI processing is off by default and consent-gated. A captioning stage can send blurred frames to a third-party AI provider. It refuses to run unless production use has been deliberately switched on and the consent for that footage is active in the ledger and allows AI training use. No provider receives a frame before this notice names it.
Model-generated labels are marked as such. Anything a model derived from your footage is labelled derived in the dataset itself.

3a. Data protection, and what checks it

Each protection in this table is enforced in code and checked by a named test.

3a.1 · Each protection, and the test that checks it
Protection	What it does	Checked by
Face blurring	Faces the detector finds are blurred before any person reviews the footage. A request to skip blurring is refused, and if blurring cannot run, the pipeline stops with an error rather than use the unblurred original.	`test_fail_closed.py` · `test_upload_reaches_redaction.py`
Consent ledger	Every consent and every withdrawal is a new entry, linked by hash to the entry before it. The database refuses to edit or delete an entry, and a changed or removed entry is detected when the chain is checked.	`test_consent_ledger_chain.py`
External AI captioning	Runs only when production use is switched on and the consent for that footage is active and allows AI training use.	`test_claude_caption.py`

A Commissioning lab's duty to delete its copies when consent is withdrawn is set in Terms of Service, clause 2.2, and how we answer a grievance in clause 1.

Processors now:

Google: email sent to us; sign-in to our application forms, which tells us only your email address; and the copies of what you send through a form that reach our mailbox and a Google Sheet (clause 5).
Cloudflare: hosting this site, storing what is sent through its forms, counting page views with Cloudflare Web Analytics (section 2a), and storing backup copies of our records (never footage) in its Asia-Pacific region, which may be outside India. We encrypt each copy on our own computer first, so Cloudflare cannot read it, and it is deleted after 30 days.

Processors for FH Capture, our Android app:

Google: sign-in with your Google account, the mailbox that sends approval emails, notifications that tell your phone a note has reached your FH Capture Inbox (the notification carries none of our words: your phone fetches them from us), and, on most phones, naming your town from your approximate location, if you allow it.
Cloudflare: the encrypted connection between the app and our computers in India, and storage (R2) for recordings sent through an upload link.
An AI model service that captions blurred frames, named here before any footage is sent to it.
An SMS provider, named here when sign-in by phone number ships.

No third-party attestation — no SOC 2, no ISO 27001.

4. Your rights, and the actual mechanism for each

4.1 · Each right under the Act, and the mechanism that delivers it here
Right (DPDP Act)	How you exercise it here
Access your data (§11)	Email privacy@fourthuman.ai to ask for your data, including your consent history (every grant and withdrawal, hash-chained)
Correction (§12)	Email privacy@fourthuman.ai
Withdraw consent / erasure (§6(4), §12)	You email partners@fourthuman.ai, and your sent mail is your record of the request and its date. We process every withdrawal request within seven business days of your asking. Business days are Monday to Friday; an Indian public holiday inside that window moves the date later. Nothing is deleted and the consent stays active until we process it, and no request is approved automatically. Processing it deletes your footage and everything derived from it (the raw video, the blurred copy, working files, and the annotation) and halts any processing job. Each deletion is recorded in an append-only log, and a fresh scan of storage confirms it. What survives is the ledger entry recording that you withdrew (the evidence your request was honoured) and a content fingerprint of the deleted file (the bytes are gone; the fingerprint proves which bytes)
Grievance redressal (§13)	Write to privacy@fourthuman.ai. The address in clause 1 reaches our Grievance Officer, and we respond within 30 days. A consent withdrawal has its own period: seven business days, in the row above
Nominate (§14)	You may nominate a person to exercise these rights for you; email us the nomination
Complain to the Data Protection Board of India	If our grievance process fails you, you may complain to the Data Protection Board of India, the adjudicating body under the Act

4.2 Deleting your FH Capture account

In the app, open Settings and tap Delete my account. Or email privacy@fourthuman.ai from the address you signed in with. We handle each request by hand, and reply when it is done, within 30 days.

What we delete: your name, email address, phone number, date of birth, and the link to your Google account. If you also registered on our website, tell us and we delete that too.

What we keep, and why:

Your consent receipts, under a random account number rather than your name, as proof of what you agreed to and when. Our consent record only ever adds entries; it never changes one.
The record of each recording you sent, under the same number: its fingerprint, size and times.
Payment records, for as long as Indian law requires.
The emails about your request, as our record of handling it.

Your recordings: deleting your account does not withdraw your consent. To have your recordings deleted too, withdraw your consent as 4.1 explains. Recordings you never sent stay on your phone and never reach us.

Your pay: deleting your account doesn't cancel your pay. The remaining amount is transferred to your payment method within 10 days.

Buyers receive datasets, not identities. If your consent is later revoked, your clips are deleted from our storage including from already-cut dataset releases, whose verification then reports the change to the buyer. Deletion obligations flow down into buyer contracts (see Terms).
Payment processors receive what a UPI payout requires, for that purpose only.
Email you send us is processed by Google. Our @fourthuman.ai addresses run on Google Workspace, so anything you write to us by email — including a privacy request or grievance sent to privacy@fourthuman.ai — is held by Google as a processor acting for us. No storage region is set for that mail. A contact form or a Capture Partner registration goes to the same place. When you submit one, we store it, send ourselves a copy by email — your name, your address and what you wrote — so a person sees it without waiting for someone to open a dashboard, add it as a row to a Google Sheet we use to track who we have replied to, and usually email you a note confirming it arrived. If you ask us to erase what you sent, we delete every copy: the stored record, the emails and the Sheet row.
An application for a recording project is stored in our website's database and copied into a Google Sheet we use to choose who records. We do not email ourselves a copy. To have it deleted, write to privacy@fourthuman.ai; our reply will say exactly what we deleted, and anything we could not.
A job application sent to our careers address is kept in our work mailbox, and any attachment is filed in our shared Drive. A program sorts applications into two folders by whether they include a link to your work; a person reads both, and the program decides nothing. We also keep a word-for-word record of work email in our private internal records. You can ask us to delete your application by writing to privacy@fourthuman.ai; our reply will say exactly what we deleted, and anything we could not.
Retention: footage and derivatives are retained while your consent is active, and for at most 90 days from the day we review your recording for quality. That ceiling covers the original unedited recording, not only the blurred copy. After 90 days it is deleted.

If you withdraw your consent before then, everything is deleted at that point instead, as described above. The 90 days is a ceiling on how long we may keep your footage, never a waiting period on your right to have it removed. Account and payout records are retained as Indian financial law requires.

6. Languages

This notice is currently available in English. Before the first capture cohort onboards, it will be provided in the languages our Capture Partners actually read; the Act entitles you to any of the languages in the Eighth Schedule of the Constitution.

7. Changes to this notice

Changes to this notice are made by publishing a new dated version here; the current version is dated at the top of this page.