Kappabara privacy policy
Version: 2 November 2026
Kappabara is a service where people answer questions about items such as images, video, text and other data (choosing categories, drawing boxes, marking areas and more) for a team that invited them. This policy covers all of Kappabara: the Kappabara app, the web app at kappabara.com/app, and kappabara.com, where companies ask to join the pilot and their people sign in to design and manage their tasks. It explains what we collect, why, who we share it with, and your rights. If you answer questions, everything up to Deleting your account applies to you; companies' people will also find what applies to them in Designing tasks on kappabara.com, Requests to join the pilot and Requests to see the demo.
Who we are. Francisco Javier Molina Vela ("Kappabara", "we") runs Kappabara and is the controller of your personal data. Questions about privacy: privacy@kappabara.com.
The short version
- We collect what we need to sign you in, give you your team's work and deliver your answers to that team.
- The organization whose team invited you sees your answers, and your score on questions whose answer is already known, next to the name you gave when you joined the team, and the people who manage the team see the email you signed in with. Nobody else does.
- No ads, no advertising IDs, no analytics or tracking tools, and we don't sell your data.
- The app doesn't use your location, contacts, camera, microphone, photos or files, and doesn't access other apps.
- You can delete your account in the app or at kappabara.com/app (Account → Delete account). If you're the only owner of an organization on kappabara.com that has other members, make one of them an owner first.
What we collect
| Data | Example | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Account | Email address, an account ID, sign-in records. Your password is held by our sign-in service and never seen by us | Signing you in | Contract |
| Consents | Which terms and privacy policy versions you accepted and when; your confirmation that you're 18 or over | Proving what you agreed to | Legal obligation, contract |
| Teams | The teams you belong to, and the name you gave each one when you joined (or the one on your invitation, if it came with one). On an organization's own team (Our team), the name is the part of your email before the @ | Giving you that team's work, and showing it who gave each answer | Contract |
| Your work | Your answers, when you answered, skipped or gave back a question, the app version; how you answered (how long it took, your touches, undos and zooms) and which way the question was shown to you | Delivering answers to the team, measuring how much annotators agree, checking answers against questions whose answer is known, and making the questions easier to answer | Contract, legitimate interest |
| Content reports | Questions you reported as harmful or private, and why | Removing harmful content, protecting you and the people in the media | Legitimate interest, legal obligation |
| Notifications, only in the Android app and if you allow them | A token that lets us send notifications to the app on your phone, which phone system it's for, when it was added; which notifications you turned off; when a team last told you it had new questions | Telling you a team invited you or has new questions for you | Contract |
| Problem reports, only if you send one | What you wrote, a screenshot of the app's screen, the app's recent log (screens opened, requests and errors), the app version and your phone's system, the question on screen | Fixing problems, and making the questions clearer | Legitimate interest |
| Technical logs | IP address, app version, request times and errors | Security, fixing problems | Legitimate interest |
Checking answers and improving the questions. Some of a task's questions are ones whose answer is already known. Your answers to them are compared with it, and the organization whose team invited you sees your score in the task's report. We also measure how questions are answered (how long it took, touches, undos and zooms), and may show a question in different ways to find which works best: that's only to improve the tasks, not to rate or pay anyone. Your score isn't used to pay you or to stop giving you work; if that changes, this policy will say so first.
Who we share it with
| Who | What | Why |
|---|---|---|
| The team that invited you, and its organization | Your answers and your score on questions whose answer is known, next to the name you gave the team, in its tasks' reports and downloads, which everyone in the organization on kappabara.com sees (its owners, admins and viewers); the people who manage the team (its owners and admins) also see the email you signed in with | It's the reason the work exists; knowing who's in the team and who gave each answer |
| Amazon Web Services | Everything above, stored and processed for us | Hosting and sign-in, in the United States (us-east-1) |
| Google (Firebase Cloud Messaging) | Your phone's notification token, and each notification's text: the team's name and what it's about | Delivering notifications to the app on your phone |
| Atlassian (Jira, our issue tracker) | Problem reports | Working on fixing them |
| ImprovMX and Google (Gmail) | Email you send to support@kappabara.com or privacy@kappabara.com, forwarded by ImprovMX to our Gmail inbox | Reading and answering it |
| Authorities | What the law requires | Legal requests |
We don't sell your personal data or share it for advertising.
International transfers. Your data is stored in the United States. If you live in the EU or UK, it's transferred there under the safeguards our hosting provider offers, including the European Commission's standard contractual clauses. Google delivers the app's notifications from its own data centers, under the same kind of safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Account, consents, teams, notification settings and tokens | Until you delete your account; a phone's token also goes when you sign out on it, or when the app on it no longer has it |
| Answers | With no set end: they're the team's data, the work it asked for. After you delete your account, they're linked only to an account ID that no longer leads to you |
| Content reports | Until they're reviewed, then as long as needed to keep the content removed |
| Problem reports | Two years after you send one, then deleted. In our issue tracker, the problem you described stays as the record of its fix, without the screenshot, the log or anything that says who sent it |
| Technical logs | One month |
| Backups | Data we delete can still be recovered from our backups (our database can be restored to any moment of the last 35 days) and from earlier versions of our stored files for up to 35 days, then it's gone |
Deleting your account
You can delete your account in the app or at kappabara.com/app (Account → Delete account); kappabara.com/delete-account explains how. If you're the only owner of an organization on kappabara.com that has other members, make one of them an owner first (Your organization). We remove your sign-in, email, teams and the names you gave them, and your phones' notification tokens, and give back any questions you held. Within a few days we also delete the problem reports you sent, and remove their screenshots, logs and who sent them from our issue tracker. Answers already delivered to a team stay with that team, since they're its data, the work it asked for, linked only to an account ID that no longer leads to you; downloads the organization made before then keep the name you gave the team. What we delete stays in our backups for up to 35 days.
Designing tasks on kappabara.com
A company's people sign in to kappabara.com to design their tasks with our assistant, which turns what they need labeled into a task, and to manage them. This section covers what we keep about them.
| Data | Example | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Who you are | Your Kappabara account and the company it belongs to; the name and email we sent your invitation to | Knowing whose conversations are whose, and whose limit they count against | Steps before a contract |
| Your conversations | What you wrote, the files you attached, the assistant's replies, when | Answering you and designing your task | Steps before a contract |
| Proposals | The task the assistant designed, its sample report and questions | Showing you the task before you commit to it | Steps before a contract |
| Pictures from your dataset, only if you agree | Up to 10 pictures picked at random from a dataset you chose, made smaller, when the assistant asks to look at them and you say yes | Designing a task that fits what your pictures show | Steps before a contract |
| Usage | How many replies the assistant wrote, and the computing they took | Keeping its use within limits | Legitimate interest |
| Problem reports from the website, when you send one or the assistant files one | What you wrote, a screenshot of the page, its recent log (pages opened, requests and errors), your browser, the page and your company. When the assistant files one (it does when you tell it something doesn't work, or one of its tools keeps failing), its description of the problem and which conversation it came from | Fixing problems | Legitimate interest |
We also read conversations to make the assistant better and to resolve any disagreement about what it proposed (legitimate interest). We don't train AI models on your conversations. General lessons we draw from them, with nothing that identifies you or your company, may shape how the assistant works, including the examples a model of ours learns from.
The assistant's replies are written by an AI model that Amazon Web Services runs for us, in the United States. Amazon doesn't use what you write to train models or share it with the model's maker. The assistant may ask to look at a few pictures from a dataset you chose; only if you say yes do up to 10 of them, picked at random and made smaller, go to that model as part of your conversation, and they are kept with it. If you say no, it doesn't look. When you reach the assistant's limit, your name and usage go to Jira, our issue tracker (by Atlassian), so we can approve more. When you launch a task that we review before it starts, your email, the task's name and its datasets go there too. A problem report the assistant files goes there as well, with its description of the problem and which conversation it came from; the conversation itself stays with us. We don't share your conversations with anyone else.
Crowd (experimental). If you choose Crowd (experimental) for a task, its items and questions are shown, after we've reviewed the task, to Kappabara's internal testers, who answer them under the same terms as any annotator: they may not copy, download or share them. Their answers show in the task's report as the crowd's, without their names.
Removing a conversation. You can remove a past conversation from your list (Remove from my list). You won't see it again, but we keep a copy, for the reasons above and for the time below. Deleting your account erases all your conversations for good.
How long we keep it. Conversations, the files attached to them, the pictures the assistant looked at, proposals, sample reports and questions: two years after a conversation last changes, removed from your list or not, then deleted. If you go on to work with us, the task you agree to is kept with that agreement. Usage figures: as long as our accounting records.
Requests to join the pilot
When a company asks to join the pilot at kappabara.com/pilot, we keep what the form asks for: your name, company, work email, what you'd like labeled and who would label it, with the time you sent it. Asking from your demo, with Request my own organization, sends the same request with no form: the name and email you gave for the demo, the task the assistant proposed there if there is one, and that it came from your demo. We use it only to review the request and write back to you (steps before a contract). It's stored with Amazon Web Services in the United States, and goes to Jira, our issue tracker (by Atlassian), and by email to our Gmail inbox (forwarded by ImprovMX), so we see it. The copy stored with Amazon Web Services is deleted a year after you send it; the Jira task and the email stay as the record of your request. If you go on to work with us, what you agreed to is kept with that agreement. To have any of it deleted, email privacy@kappabara.com.
Requests to see the demo
When you ask to see the demo at kappabara.com/demo, we keep what the form asks for: your name, your email and, if you say, where you heard about Kappabara, with the time you sent it. We use it only to send you the demo and write back to you (steps before a contract). It's stored with Amazon Web Services in the United States and goes by email to our Gmail inbox (forwarded by ImprovMX), so we see it. The copy stored with Amazon Web Services is deleted a year after you send it; the email stays as the record of your request.
The demo is an organization of your own on kappabara.com, which only you and Kappabara are in. What you do there is kept as in Designing tasks on kappabara.com, with your answers to its task as in What we collect. Thirty days after it was made, the organization is deleted, with your conversations with the assistant in it, and we email you that it ended; your answers stay as for any task, and your Kappabara account stays until you delete it. To have any of it deleted sooner, email privacy@kappabara.com.
Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or Californian law), you can ask to see the personal data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent at any time. For a copy, you don't need to ask: in the app or at kappabara.com/app, Account → Download my data downloads one file (JSON) with everything we hold about your account. For anything else, email privacy@kappabara.com and we'll reply within one month. You can also complain to your data protection authority.
Adults only
Kappabara is only for people aged 18 or over. If we learn that an account belongs to someone younger, we delete it.
Security
Your data is encrypted in transit and at rest, access is limited to the people who need it, and the app keeps your sign-in in the phone's secure storage.
Changes
When this policy changes, the date at the top changes too, and the app asks you to accept the new version before you continue working.
privacy@kappabara.com