Security & data handling
How Rapidata handles the data you send us and the people who label it. Every statement on this page links to the document it comes from.
Who handles your data
Rapidata AG, Binzstrasse 23, 8045 Zürich, Switzerland, is the controller for the processing described in our Privacy Policy. Data-protection concerns go to privacy@rapidata.ai.
Our Privacy Policy is aligned with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection, including the revised Swiss DPA.
Your data
We process the data you upload to run labeling and evaluation jobs on your behalf. You grant Rapidata a non-exclusive right to process those data units for the purposes of the service, and you remain responsible for having the rights to grant it.
We inspect random data points for inappropriate or malicious content, both on submission and after approval, and may remove such data and pause the service.
Annotator anonymity
Tasks reach people as short, opt-in sessions inside consumer apps. The task data we collect from them is aggregated and passed to customers, and it is not designed to contain personal information such as names, email addresses or postal addresses.
To route tasks to people who solve them well, we use anonymous identifiers supplied by our advertising partners, such as a user ID, IP address, user agent and approximate location.
In the documented result format, each response is described only by the annotator's country, language, reliability score and coarse demographic bands (age range, gender, occupation). It carries no names, email addresses or contact details.
Access and authentication
The Rapidata API uses OAuth 2.0 and OpenID Connect, with auth.rapidata.ai as the authorization server. Programmatic access uses a client ID and secret created in your account settings.
Access tokens are scoped, so a token can be limited to the scopes a script needs, and they expire after one hour.
Storage and transfers
Our technical and organisational measures include internal policies, network security, access controls and restrictions, encryption of data carriers and transmissions, and pseudonymisation.
Assets shown to annotators are hosted on assets.rapidata.ai under random UUID file names, so they cannot be found by guessing URLs. These hosted files are not encrypted.
Our service providers are located in Switzerland, Europe and the USA (for example Microsoft, Amazon and Google). Where a recipient sits in a country without adequate data protection, we require the European Commission's standard contractual clauses or an equivalent safeguard.
Retention
We keep personal data for as long as the business relationship and our legal retention and documentation obligations require, and delete or anonymise it when it is no longer needed.
Operational data such as system logs is generally kept for no more than twelve months. Session recordings from our websites are deleted after 30 days.
Your rights
Under the GDPR and Swiss law you can request access to, rectification or erasure of your personal data, restrict or object to its processing, and ask for data portability. Write to privacy@rapidata.ai.
You can also complain to a data protection authority; in Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC).