Privacy Policy

1. Scope

This Privacy Policy explains how the service offered under the LabelOp name collects, uses, discloses, and protects personal data when you use the website and services.

LabelOp is currently an independently operated project, not an incorporated company. References to LabelOp, we, our, or us mean the individual operator of the hosted LabelOp service.

2. Customer Content Responsibility

You are solely responsible for personal data and other content you upload to the service. You must ensure you have all necessary rights, notices, consents, and legal bases to collect, transfer, and process that data.

You are also solely responsible for your instructions to the service, your sharing decisions, your exports, and any downstream use of uploaded data or generated output. If you upload unlawful or unauthorized personal data, you bear full responsibility for resulting claims, penalties, damages, and regulatory consequences.

3. Roles: Controller and Processor

For Customer Content processed on your instructions, you decide the purposes, legal grounds, and scope of processing. You remain responsible for handling data subject requests, notices, consent records, retention choices, and lawful use of uploaded personal data.

For account, authentication, security, support, and service administration data needed to operate the hosted service, the LabelOp operator determines the processing purposes and means.

4. Categories of Data We Collect

• Account data: name, email, authentication details, organization/workspace identifiers.
• Customer Content: files, images, annotations, labels, metadata, prompts, and model outputs.
• Usage and device data: logs, browser/device details, session events, and privacy-preserving product analytics (e.g., via Umami).
• An encrypted Vast.ai credential and validation metadata if you choose to connect that service.
• Polar customer, subscription, invoice status, package quantities, billing periods, and limited transaction identifiers. Polar handles payment-card details; LabelOp does not store your full card number.
• Support and communication data.

5. Purposes, Collection Methods, and Legal Grounds

• Provide, maintain, secure, and improve the service.
• Process workloads you request, including AI-assisted features.
• Authenticate users and manage accounts.
• Operate managed Cloudflare AI and R2, connect requested Vast.ai training, and enforce tier and package limits.
• Comply with legal obligations and enforce contractual rights.

We collect data directly from account and service forms, authentication providers you choose, uploaded content, provider integrations you configure, and security/usage logs generated when the service is used. Depending on the activity and applicable law, processing is based on steps requested before entering into or performing the service agreement, compliance with legal obligations, establishment or protection of legal claims, and legitimate interests in securing and operating the service without overriding your rights. We rely on consent only where the relevant activity specifically requires it; this notice is not a consent form.

6. Sharing and Disclosure

We may disclose personal data to:

• Infrastructure, hosting, analytics, communication, and support providers.
• Model and compute providers necessary to perform requested processing.
• Professional advisers and authorities when required by law or legal process.
• Successors in merger, acquisition, financing, or asset transfer transactions.

If you connect Vast.ai and start training, the necessary content and credential are transmitted to Vast.ai under its own terms and privacy practices. The saved credential is encrypted at rest, is not displayed back to you, and can be disconnected from Settings subject to running-job safeguards.

7. International Transfers

Depending on hosting location and the providers you choose, personal data may be processed outside your country. You are responsible for assessing transfers caused by a Vast.ai workload you request. For the hosted service, we use legally required transfer safeguards where applicable.

8. Security

We apply technical and organizational security measures designed to protect data. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

9. Retention

We retain account and Customer Content while needed to provide the hosted service and for security, legal obligations, and dispute resolution. Account deletion starts deletion of account data, projects, annotations, and stored provider credentials, subject to limited backups and legally required retention. You should keep your own exports; the hosted tiers are not a backup service.

10. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing, and to data portability. You may also have rights regarding sensitive data and marketing preferences.

If Turkish Law No. 6698 applies, you may also request information about whether and how your personal data is processed, recipients and transfer purposes, correction of incomplete or inaccurate data, deletion or destruction where the legal conditions are met, notification of corrections or deletion to recipients, objection to a result produced exclusively by automated processing, and compensation where unlawful processing causes damage.

You can submit requests at[email protected]. We may verify identity before fulfilling requests.

11. Responsibility for Uploaded Personal Data

LabelOp does not independently verify whether you are permitted to upload, annotate, export, share, or otherwise process personal data through the service. You are solely responsible for determining whether such processing is lawful and appropriate for your use case.

12. Children

The service is not intended for children under 18, and we do not knowingly collect personal data from children under 18.

13. Policy Updates

We may update this Privacy Policy. Material updates will be posted here with an updated date.

14. Contact

Privacy questions:[email protected]