Legal
Privacy Notice
Last updated: October 1, 2026
1. Who we are and how to contact us
Your Personal AI AS ("YPAI", "we", "our" or "us") is a Norwegian private limited company, organisation number 933 915 778, with its registered office at Lysaker torg 5, 1366 Lysaker, Norway.
This notice explains how personal data is handled across our websites, platforms, data services, AI systems, research and commercial relationships. Personal data means information relating to an identified or identifiable person. A recording, identifier, inference or technical record can be personal data even when it does not contain a name.
For privacy questions, requests or complaints, contact contact@ypai.ai, addressed to YPAI Privacy, or write to our registered office. You can also use the data-request facility on our website. No account is required to contact us. We route requests to the person responsible for the processing concerned.
Management is accountable for privacy governance. Our internal policy distinguishes the operational Privacy Lead from the independent statutory Data Protection Officer (DPO). Where a DPO or local representative is appointed, the applicable notice identifies that role and provides its contact details.
2. Activities and people covered
This notice covers business contacts and prospects; website and demonstration users; customer and partner representatives; platform users; contributors, annotators, evaluators and research participants; job applicants and contractors; and people whose information is included in data we receive or process.
Our work includes AI consulting and system implementation; assistants, chatbots and voice systems; retrieval-augmented generation (RAG) and enterprise knowledge systems; document intelligence; agents, integrations and workflow automation; private deployments and managed operations; data collection and sourcing; annotation, transcription and expert review; model and agent evaluation, human feedback and red-teaming; synthetic-data production; and dataset licensing and distribution.
Data modalities include speech, audio, images, video, text, documents, three-dimensional data, location and sensor data, movement and physical-AI demonstrations. Project-specific notices address additional requirements for healthcare, biometrics, education, employment, financial services and other sensitive contexts.
A short notice at collection explains the particular activity before it starts. This general notice does not itself provide consent, authorise a new dataset use or replace an organisation's notice to its own users. Separate workforce notices provide the employment-specific detail required for employees.
3. Our role depends on the activity
Our own activities. YPAI is a controller when we determine the purposes and essential means of processing, including our business administration, contributor accounts, recruitment, website operations and collections or datasets that we independently organise.
Customer-directed services. When a customer determines the purposes and essential means and we act on documented instructions, YPAI is a processor or subprocessor. This includes customer-controlled annotation, evaluation, hosting, AI implementation and managed operations. The customer's notice explains its purposes and legal basis; our processing agreement governs our instructions and assistance obligations.
Dataset licensing. For datasets that YPAI independently collects and licenses, YPAI is ordinarily a controller for its collection and disclosure. A marketplace, distributor or buyer may be an independent controller, a processor or another legally defined recipient, depending on what it actually does. Buying a dataset does not automatically make a buyer our processor.
Joint decisions. Where YPAI and another organisation jointly determine processing purposes and essential means, we document the joint-controller arrangement and make its essential allocation of responsibilities available to affected people.
Roles follow the actual processing, not a label in a contract. The same engagement can involve different roles for project content, account administration and legally required records.
4. Information we process and where it comes from
We collect only information relevant to the activity. Not every category below applies to every person or project.
| Category | Examples |
|---|---|
| Identity and contact | Name, work or personal contact details, country, age eligibility, contributor or participant ID, and proportionate identity-verification results. |
| Professional and participation information | Employer, role, qualifications, languages, skills, availability, task applications, eligibility answers, training and review records. |
| Commercial and payment records | Contracts, orders, invoices, compensation amounts, payment references, necessary payment details and tax information. |
| Contributions and project content | Audio, voice, photographs, video, text, documents, transcripts, annotations, reviewer comments, recordings of tasks and human-feedback responses. |
| Device, location and physical data | Device and browser information, IP address, timestamps, referring pages and campaign tags, recording conditions, approximate location, and project-specific precise location, sensor, movement or vehicle data. |
| AI and interaction data | Prompts, uploaded files, outputs, retrieval results, embeddings, agent actions, tool interactions, evaluation scores and relevant execution traces. |
| Sensitive information | Health and clinical information, racial or ethnic origin, biometric identifiers or templates and other specially protected information, only within a specifically authorised activity. |
| Security and governance records | Access and delivery logs, consent receipts, policy versions, fraud indicators, privacy requests, incident records and documented decisions. |
Sources include you; your device and interactions; an organisation providing a service to you; customers and authorised suppliers; recruiters and research platforms; dataset licensors; and professional sources such as company websites, professional directories and business-contact services, including Apollo where used for relevant business outreach.
For indirect collection, we provide the source, purposes and other required information within the applicable period, normally by first communication or disclosure, or within one month under the GDPR, unless a documented legal exception applies. Public availability is not, by itself, permission to reuse personal data for any purpose.
5. Purposes and legal bases
The following table explains our principal controller activities under the GDPR. Equivalent local requirements are applied where relevant. When we are a processor, the customer determines the legal basis for its processing; a commercial contract with that customer is not automatically a legal basis for processing another person's data.
| Purpose | Information used | Principal GDPR basis |
|---|---|---|
| Answer enquiries, arrange meetings and manage business relationships | Business contact details, correspondence, project requirements and meeting information | Legitimate interests in responding and managing relevant business relationships, Article 6(1)(f); Article 6(1)(b) for necessary steps requested by a person contracting directly with us. |
| Register contributors and administer agreed work | Account, eligibility, skills, task and payment information | Article 6(1)(b), where necessary for the contributor's agreement; Article 6(1)(c) for applicable legal obligations. |
| Collect contributions for a specified research, development, evaluation or licensing activity | The project-specific contribution and associated metadata | Consent under Article 6(1)(a) for consent-based collections. A different lawful basis is used only when appropriate, documented and explained before that processing. |
| Process special-category information | The specific sensitive information required for the authorised activity | An Article 6 basis together with a valid Article 9 condition, normally explicit consent under Article 9(2)(a) for our voluntary collections. Other conditions require the applicable legal foundation and safeguards. |
| Operate requested platform functions and demonstrations | Account information, inputs, outputs and necessary technical data | Article 6(1)(b) where necessary for a direct service agreement; otherwise Article 6(1)(f) for providing the function requested and operating it securely. |
| Protect systems, prevent fraud and verify contribution quality | Security signals, task records and proportionate verification information | Article 6(1)(f), following a necessity and balancing assessment; additional consent or statutory conditions where biometric or other sensitive processing requires them. |
| Measure optional website analytics and advertising conversions | Cookie identifiers, interaction events and, for enhanced conversions, hashed contact information | Consent under Article 6(1)(a), together with applicable rules on cookies and similar technologies. |
| Conduct relevant business outreach | Professional contact details, source records and correspondence | Article 6(1)(f) where appropriate; separate permission is obtained where electronic-marketing law requires it. |
| Recruit personnel, administer suppliers and meet legal duties | Applications, contracts, accounting, tax and compliance records | Article 6(1)(b), Article 6(1)(c), or Article 6(1)(f), according to the particular activity. |
| Handle rights, disputes and accountability | Necessary correspondence, decisions and limited evidence | Article 6(1)(c) for legal duties and Article 6(1)(f) for establishing or defending claims; an additional Article 9 condition where required. |
Our legitimate interests do not override your interests or fundamental rights. You can object to processing based on legitimate interests. We do not retrospectively replace withdrawn consent with another basis simply to continue the same processing.
Where information is necessary for an agreement or required by law, we explain this and the consequence of not providing it. Optional information is identified as optional.
6. Contributors, recording participants and research platforms
Before a task or recording begins, you receive a project notice explaining who is responsible; what is recorded; the purposes and legal basis; whether data is for one customer or a licensable dataset; relevant recipients; international access; retention; payment terms; and how to exercise your rights.
Consent is specific and recorded through a clear affirmative action. Separate choices are used for materially different optional purposes, including public samples, identifiable publicity, biometric identification or identifiable voice and likeness replication. Accepting a general privacy notice is not consent to every possible AI use.
Our consent record links the notice version, project, purposes, participant identifier, time and affirmative action. Identity and payment records are separated from project content where practicable. We provide a consent receipt or another accessible record of your choices.
Our direct contributor programmes are for adults aged 18 or over. Age and eligibility checks are proportionate. Other recognisable people must not be included in a recording without the required information and authorisation. Unexpected third-party material is restricted, redacted or removed before further use, unless there is another documented lawful basis for retaining it.
You can decline a task, stop participating or withdraw consent through the method supplied with the project or by contacting YPAI Privacy. Withdrawal does not invalidate earlier lawful processing, but it stops future processing that depends on that consent. It does not cancel compensation already earned for accepted work. Any necessary limits on future participation are explained without penalising the exercise of privacy rights.
Recruitment platforms. For participation through a platform such as Prolific, we receive platform, study and session identifiers and the information specified in the study notice. The platform administers its own account and payment functions under its own notice. YPAI's study records and consent records are handled separately from the platform's records. A request to one organisation does not automatically delete records held independently by the other; we explain and assist with the relevant route.
7. Dataset licensing and onward distribution
YPAI supplies both customer-commissioned datasets and datasets made available for licensing through direct sales, marketplaces and authorised distributors. Licensable datasets can be provided to more than one authorised buyer where that use is covered by the applicable notice, lawful basis and rights permissions.
A project notice explains the relevant uses, which can include model training, fine-tuning, evaluation, validation, research and commercial AI development. It explains whether identifiable audio, images or video are delivered and identifies recipients or sufficiently specific recipient categories. Where another controller relies on your consent, that controller is identified before consent for its processing is obtained.
A licence to a dataset does not remove privacy rights or transfer ownership of a person. Copyright and contractual permissions are distinguished from the legal basis for processing personal data. A broad reference to "partners" is not unrestricted permission for any recipient or use.
Recipients are bound by applicable purpose, access, security, transfer, retention and rights-handling restrictions. Onward licensing is permitted only within the authorised distribution arrangement. It is not an automatic right for every buyer. New recipients, purposes or uses are assessed against the original information and permissions; new notice and consent are obtained where required before release.
We keep a record connecting dataset versions and deliveries to their source, permitted uses and recipients. Requests and restrictions are propagated to affected recipients where required. Re-identification, unrelated contact with participants, unauthorised profiling, and identifiable voice or likeness impersonation are not permitted by a general dataset licence.
In jurisdictions such as California, paid licensing of identifiable or pseudonymised information can constitute a "sale" of personal information. We address that classification directly in the applicable notice and rights controls rather than relying on a blanket statement that we never sell data. Business contact lists, account credentials and payment details are not included in our training-data licensing products.
8. Customer AI systems, evaluation and model development
Customer content processed under instructions is used for the contracted service, not automatically for YPAI's general model training, another customer's datasets or an external provider's independent product development. Additional use requires the necessary instructions or authorisation and a valid legal basis; permission from a customer does not replace any rights required from affected people.
This separation applies to source documents, prompts, recordings, annotations, embeddings, vector indexes, retrieval results, evaluation sets, human feedback, outputs and agent traces. Account access to a source does not by itself authorise disclosure to every user or agent. Systems preserve the applicable user, tenant, source and project permissions.
AI providers and processing regions are selected for the authorised workflow. The use of external model APIs, diagnostic logging, provider retention and any permitted human review are governed by the relevant processing terms. Customer data is not silently routed to an unapproved model provider or region as a fallback.
Evaluation and red-teaming can include authorised human review of model inputs and outputs. Reviewers receive only the access needed for the assignment and are subject to confidentiality and project restrictions. Synthetic data and model outputs are assessed for personal information and memorised content; they are not assumed to be anonymous merely because a model generated them.
Public demonstrations are not an intake channel for patient records, identification documents, confidential customer datasets or other sensitive material. A demonstration identifies any relevant external provider before submission. Users should not upload another person's personal information without authority.
9. Health, biometric and other sensitive information
Sensitive information receives activity-specific review, restricted access, purpose limitations and enhanced controls. We establish both the ordinary lawful basis and any additional condition required for special-category data, criminal-offence data or locally protected information. A research label or approval by an ethics committee is not, by itself, a complete legal basis.
Ordinary photographs and recordings are not automatically biometric identifiers under every law. Voiceprints, face-geometry templates and processing for unique identification require a separate assessment. We explain when biometric processing occurs, what it does, who receives its results and how long they are retained.
Where the Illinois Biometric Information Privacy Act applies, we obtain the required written notice and release before collection, limit disclosure to legally permitted circumstances and do not sell, lease, trade or otherwise profit from covered biometric identifiers or biometric information. A consent form does not remove that statutory prohibition.
Biometric retention and destruction. Covered Illinois biometric information is permanently destroyed when its initial collection purpose is satisfied or within three years of the individual's last interaction with YPAI, whichever occurs first, unless the law specifically permits or requires otherwise. A shorter disclosed period applies where relevant. Destruction covers templates and copies under our control and instructions to relevant service providers. Encryption, hashing or removal of a name alone is not destruction. We record completion without retaining the biometric material as proof.
US health-data obligations are evaluated independently of GDPR. Where HIPAA applies to an engagement, the required business-associate arrangements and safeguards apply to YPAI and relevant downstream services. For covered consumer-health activities outside or alongside HIPAA, a separate Consumer Health Data Privacy Notice and any required collection, sharing and sale authorisations apply. General participation consent is not a substitute for a legally required separate sale authorisation.
10. Who receives information
Access is limited to the people and organisations needed for the authorised activity: authorised YPAI personnel; contracted contributors, reviewers and experts; customers and approved dataset recipients; technology and operational service providers; recruitment and payment platforms; professional advisers; and authorities where disclosure has a valid legal basis.
Providers used for website, enquiry or demonstration functions include the following. This is not a representation that every provider receives every category of project data.
| Provider or service | Relevant function |
|---|---|
| Cloudflare | Website delivery and security, form infrastructure, selected storage and platform functions. |
| Turso | Business-enquiry database. |
| Google Workspace | Email, enquiry administration including Google Sheets, calendars and meeting services. |
| Resend | Transactional enquiry and notification email. |
| Sentry | Website and application error monitoring; the website uses its EU region. |
| Google Fonts | Font delivery on document-signing pages that request fonts from Google; Google receives the requesting IP address. |
| Google Ads, Google Analytics and PostHog | Optional conversion measurement and analytics, subject to the applicable choices. |
| Amazon Web Services, including Amazon Bedrock, and Anthropic | AI processing for the specified demonstration or authorised service. |
| Recruitment platforms, including Prolific where used | Participant sourcing and the platform's own participation and payment administration. |
The applicable subprocessor and recipient register identifies additional project providers, their role, purpose, access and processing locations. Processor access requires appropriate contractual controls. Independent controllers receive the information and restrictions relevant to their own responsibilities; they are not described as subprocessors merely because they are suppliers or buyers.
For a business reorganisation, merger or acquisition, disclosures are limited to what is necessary and protected by appropriate restrictions. A transaction does not automatically authorise unrelated use of personal data. We assess legal demands and disclose only what is required or otherwise lawfully justified.
11. International processing and transfers
EEA processing is our default for EEA-governed project environments unless the engagement specifies an authorised alternative. Storage location alone does not determine every transfer: remote reviewer access, support access, external AI processing and delivery to a customer or marketplace can involve another country.
We assess transfers to service providers, contributors, customers, licensees and onward recipients. Applicable safeguards include a valid adequacy decision; EU Standard Contractual Clauses with the appropriate module; the UK International Data Transfer Agreement or Addendum; and other mechanisms recognised by the relevant law. Reliance on the EU-US Data Privacy Framework requires an applicable, valid decision and a recipient whose certification covers the transfer concerned.
Where required, we assess the destination's laws and practical risks and apply supplementary contractual, organisational or technical safeguards. Project residency and onward-transfer restrictions remain applicable after the initial delivery. Routine international processing is not justified merely by general participation consent.
You may ask for information about the mechanism used for your data and a copy of relevant safeguards, with necessary redactions to protect others and confidential information.
12. Security and privacy by design
We use risk-based technical and organisational controls across collection, storage, human work, AI processing and delivery. They include encrypted transport and storage; managed keys and secrets; least-privilege and time-limited access; multi-factor authentication for privileged and sensitive access; tenant and project separation; access logging; controlled exports; and secure development, monitoring and incident-response procedures.
Sensitive workflows use additional controls such as pseudonymisation, separation of identity records, restricted processing environments, approved reviewer locations and data-loss prevention. Personal content is minimised in operational logs and excluded from advertising tools and general session recordings. Access is removed when work ends and reviewed periodically.
Staff and contractors receive role-appropriate privacy and security instruction before accessing personal data and refresher instruction thereafter. We assess service providers, test relevant controls and maintain records of privacy decisions. These measures are selected for the processing concerned, not presented as a claim of universal risk elimination or a particular certification.
13. How long information is kept
We use category-specific periods and event-based deletion, rather than keeping all data indefinitely. The following defaults apply unless a shorter legal, consent or contractual limit applies. A longer period requires a documented lawful reason and, where relevant, disclosure before collection.
| Record category | Default period or deletion rule |
|---|---|
| Business enquiries and prospects | Up to 24 months after the last substantive interaction, unless an active customer relationship or documented dispute requires relevant records. Unresponsive sourced prospects are reviewed after 12 months. |
| Contributor accounts | While active. After 24 months without meaningful activity, we give notice and remove inactive account information within 30 days unless the person renews participation or another lawful reason requires specific records. Closure requests are handled sooner under applicable rights. |
| Unsuccessful recruitment applications | Six months after the recruitment decision; up to 12 months in a separate talent pool with permission. |
| Raw identity-verification documents | Not retained by default after verification. Any necessary temporary copy is deleted within 30 days after the check, unless a specific legal duty requires longer. A minimal result may be kept separately. |
| Customer-controlled project content | For the instructed service period, then returned or deleted under the processing agreement. Our default working-copy limit is 90 days after final acceptance or termination; earlier instructions and rights deadlines take precedence. |
| YPAI-controlled research and licensable datasets | For the specific term or objectively defined end event disclosed before collection, subject to continuing necessity and at least annual review. No dataset receives an automatic perpetual personal-data retention period. |
| Public demonstration content | Session-only where feasible; any retained diagnostic content is minimised and deleted within 30 days unless you request continued support or a specific lawful hold applies. |
| Routine technical and security logs | Normally 30 days for diagnostic content and up to 12 months for necessary security-event metadata. Higher-assurance access evidence may be kept for up to 24 months with a documented need. |
| Consent, licence and rights evidence | Limited evidence for the relevant processing or rights period, then normally up to five years for accountability and claims where necessary. This does not extend retention of the underlying recordings, biometric templates or other source content. |
| Privacy-request and complaint records | Three years after closure, limited to evidence needed to document handling, unless a different legal period applies. |
| Accounting, tax and statutory records | The applicable statutory period, separately from project content. |
| Backups | Removed through a defined rotation, normally within 90 days after deletion from active systems. Shorter mandatory destruction deadlines also apply to backup copies. |
A legal hold preserves only necessary records, restricts their use and is reviewed until released. Deleted information in backups is not returned to ordinary use; restoration procedures reapply outstanding deletion restrictions before production use. Truly anonymous information may be retained without identifying a person, but pseudonymised information remains subject to personal-data rules.
14. Your rights and how requests are handled
Depending on the applicable law, you can obtain information and access; correct inaccurate data; request deletion; restrict processing; receive eligible data in a portable format; object to processing; withdraw consent; and exercise applicable opt-out and automated-decision rights. You can always object to direct marketing.
Contact YPAI Privacy using section 1. Include enough information to identify the relevant account, study or contribution, but do not send unnecessary identity documents or sensitive information. We use proportionate verification for requests that require it. A sale or sharing opt-out does not require an account or the same identity verification as an access request. Authorised representatives can act with the evidence of authority required by law.
For GDPR requests, we respond without undue delay and normally within one calendar month. A legally permitted extension is explained within the original period. Other jurisdictions' deadlines and appeal rights apply where relevant. Requests are normally free; any lawful exception or refusal is explained with the available challenge route.
When acting as a processor, we promptly route the request to the responsible customer and assist under its instructions. We do not use this role distinction to obstruct contact or fail to act on data for which we are independently responsible.
Deletion and withdrawal handling consider original data, identifiable derivatives, working copies, indexes, embeddings and distributed releases. We notify recipients where required and track the resulting action. A completed delivery, licence agreement or technical inconvenience does not itself override statutory rights.
Where a model or other derivative still contains personal data, the appropriate restriction, deletion or remediation is assessed, including retraining or unlearning where necessary and suitable. We do not promise that every trained model allows individual contributions to be mechanically removed, and we do not treat completed training as an automatic exemption. We explain the actual outcome, any applicable exception and the available remedies.
15. Matching, scoring and automated decisions
We use automated tools to support task matching, eligibility checks, quality review, security, fraud detection and the prioritisation of business enquiries. Inputs can include declared skills and languages, task performance, technical quality and relevant security signals. These tools may affect suggested opportunities, review queues or temporary security restrictions.
Material adverse decisions about contributor eligibility, permanent account restrictions or disputed compensation receive meaningful review by an authorised person who can change the outcome. You can provide additional information, challenge the decision and request human review through YPAI Privacy.
For customer-operated AI systems, the customer's notice explains the decision-making purpose and available remedies. Where legally significant solely automated decisions are used, the relevant activity-specific notice identifies the use, meaningful information about the logic and likely consequences, the applicable legal conditions and the safeguards or opt-outs required by the relevant jurisdiction. EU, UK and US requirements are assessed separately.
17. California and other US privacy rights
Where the CCPA, as amended by the CPRA, applies, California residents can request access, correction and deletion; obtain information about relevant collection and disclosures; opt out of sale or sharing; limit eligible uses of sensitive personal information; and exercise rights without unlawful discrimination. Applicable rights may also cover business contacts and workers.
The categories in section 4 can correspond to statutory identifiers; customer-record information; protected characteristics; commercial information; internet or electronic-network activity; geolocation; audio, visual and similar information; professional or employment information; education information where supplied for a project; inferences; and sensitive personal information. The sources, purposes, recipients and retention rules are explained in sections 4 to 13 and in the relevant collection notice.
Sale and sharing. Dataset licensing involving personal information can constitute a sale. Certain advertising disclosures can constitute sharing for cross-context behavioural advertising. These are assessed separately. Service-provider disclosures are not treated as exempt simply because a recipient is called a supplier; the applicable statutory and contractual conditions must be met.
You can opt out by contacting YPAI Privacy or using Your Privacy Choices / Do Not Sell or Share My Personal Information where provided. Applicable opt-out preference signals are honoured. Where we can associate a signal with an account, the applicable choice is applied to that account; otherwise it applies to the browser or device information we can recognise. We do not create additional identity profiles merely to identify a signal's sender.
Requests to know, correct or delete are acknowledged within ten business days and ordinarily completed within 45 calendar days, with any permitted extension explained. Sale and sharing opt-outs and eligible sensitive-information limits are implemented as soon as feasible and within the applicable regulatory deadline. Authorised agents can make requests subject to proportionate authority checks.
Our dated California activity statement identifies the categories actually collected, disclosed for business purposes, sold or shared during the preceding 12 months and the relevant recipients and purposes. It accompanies this notice when California disclosure obligations apply. It records actual activity, not merely the capabilities offered by YPAI.
Contributor payment terms are disclosed before participation. Where an arrangement is legally a financial incentive tied to personal information, a separate notice explains its material terms, participation and withdrawal, and the required valuation method. Payment for completed work is not treated as a waiver of privacy rights.
Additional state rights, including appeals, targeted-advertising opt-outs, profiling protections, biometric requirements and consumer-health protections, apply where the relevant law covers the activity. Our directly recruited contributor and licensing programmes do not accept participants under 18.
18. Children and customer-directed services
Our public demonstrations and direct contributor programmes are intended for adults aged 18 or over. We do not knowingly enrol children in those programmes.
Customer-directed education, healthcare or other services may involve children where the project is expressly authorised for that purpose. Such processing uses the appropriate controller instructions, age-appropriate information, lawful basis, parental or guardian permission where required, and additional protections. This is not general permission to upload children's information to public demonstrations or ordinary contributor tasks.
19. Complaints, changes and further information
You can raise a complaint with YPAI Privacy. We acknowledge privacy complaints promptly, and within 30 days where the UK complaint-handling requirement applies, investigate without undue delay and communicate the outcome and available next steps. You may complain to the Norwegian Data Protection Authority, Datatilsynet, or the authority available to you under the applicable law. UK residents may contact the ICO; relevant US residents may contact their state regulator or attorney general.
We review this notice at least annually and when processing materially changes. Significant changes are communicated through an appropriate channel. A changed notice does not retrospectively authorise a new purpose, recipient or sensitive-data use; additional notice, assessment or consent is obtained where required.
Privacy contact: contact@ypai.ai, addressed to YPAI Privacy.
Postal contact: Your Personal AI AS, Lysaker torg 5, 1366 Lysaker, Norway.