Privacy Policy

Last updated: 2 October 2026

This policy explains what personal data LabelArk collects, why we collect it, who else handles it and what you can ask us to do with it. It covers labelark.com and the LabelArk service.

1. Who we are

LabelArk operates labelark.com from Vietnam. LabelArk is a human verification service for AI: business partners post projects with AI output to check, and contributors check that output in their spare time and are paid for their work.

We handle personal data in line with the personal data protection law of Vietnam. For any privacy question or request, write to support@labelark.com.

2. What we collect

What we hold about you depends on how you use LabelArk.

Account data

• Your name, your email address and the role of your account (contributor, partner or administrator).
• Your password, which we store only as a one-way hash and never in plain text. A partner account is created without a password: we email a link and the partner sets the password through it.
• Optional profile details you choose to add: a short bio, languages, fields of expertise, skills and hours available per week.
• How you work on LabelArk: a reputation based on the accuracy of your answers, whether your account is active or suspended and the reason if it is suspended, a verified badge, and when you were last active.

Work data

• The items you open and when you open them, and the answers you submit: your True, False or Cannot tell choices and any text you write.
• The results of quality checks on your work: status, score and notes.
• Your attempts at qualification tests: your answers, your score and whether you passed.
• Ratings and notes that partners give about your work.

Payment data

• Your wallet balance and the history of your credits, deposits, charges and withdrawals.
• For a withdrawal, the PayPal email address, or the bank name, account number and account holder name, that you enter.
• For a partner deposit, the amount and a reference to the PayPal or VNPay payment. Payment details such as card numbers are entered on the PayPal or VNPay page, and LabelArk does not receive or store them.

Partner content

• Projects, instructions, items to check and files that partners create or upload. Files are stored in Amazon S3.
• API keys that partners create. We keep the key name, a short prefix and a hash of the key, never the key itself.

Agreements

• When you accept an agreement, such as the confidentiality agreement: the name you type, the time, the IP address and browser details (user agent) of your request, and a hash of the agreement text.

Agents platform

• If you use the LabelArk Agents platform: the name of your workspace (tenant), its members and their roles, its settings, its access tokens (kept only as hashes) and a usage record for each tool call with the tool, the model, token counts, duration, cost and time. Usage records do not contain the content of prompts or answers.

Technical data and cookies

• IP address: when someone signs up, we use the IP address of the request to limit repeated sign-ups. This counter is kept only in the memory of the server, is not saved in our database and is cleared when the service restarts. We also read the IP address when you accept an agreement (saved with the record above) and when a partner starts a VNPay deposit (sent to VNPay).
• Sign-in attempts are counted for each email address, also only in the memory of the server, to slow down password guessing.
• Cookies: we set only the cookies that keep you signed in. They are the session cookie next-auth.session-token, which lasts up to 30 days, the security cookie next-auth.csrf-token and the cookie next-auth.callback-url, which remembers the page to open after you sign in. On our HTTPS site your browser shows these names with a __Secure- or __Host- prefix.
• We do not use advertising or analytics cookies, and we do not load third-party trackers.

3. Why we use it

We use personal data for these purposes only:

• To create and secure your account and to sign you in.
• To give contributors tasks, to combine the answers of several contributors into results for partners, and to check the quality of the work.
• To pay contributors, take deposits from partners, bill usage and process withdrawals.
• To keep a record of the agreements you accept and to prevent abuse such as repeated sign-ups and password guessing.
• To send the account set-up email described in section 5.
• To meet our legal obligations.

We do not sell your personal data, and we do not use it for advertising or marketing.

4. Who processes it

Your data is stored and processed on servers in Singapore (AWS region ap-southeast-1). These providers and people handle it:

• Amazon Web Services (AWS) hosts the LabelArk application and database, stores uploaded files in Amazon S3 and sends our email through Amazon SES. All three run in the Singapore region.
• PayPal processes partner deposits and pays out contributor withdrawals to PayPal accounts. We send PayPal the amount, a short description and, for a payout, the recipient email address.
• VNPay processes partner deposits made through VNPay. We send VNPay the amount, a payment reference, a short description and the IP address of the partner making the deposit.
• Partners can see the name and email address of contributors who apply to or work on their projects, with their languages, fields of expertise, reputation and submitted work. Results that an AI agent retrieves through the LabelArk API identify a contributor only by a short code.
• A partner can set a web address for automated quality checks. If they do, we send that address the task title, the instructions and your submitted answer. That address belongs to the partner, not to LabelArk.
• LabelArk staff with administrator access can see account, work and payment data, including withdrawal requests, so that they can run the service.

5. Email we send

Today the only automatic email the LabelArk service sends is the account set-up message for new partner accounts. It goes through Amazon SES to the address entered at sign-up and contains a link for setting a password. The link expires after one hour.

We do not send marketing email, newsletters or promotions.

6. How long we keep it

We keep your account and the data linked to it while your account is active. After that we keep data only for as long as the law requires.

Some data is short lived. The sign-up and sign-in counters described in section 2 exist only in the memory of the server. A password set-up link stops working after one hour, and once it has been used.

7. Your rights and how to use them

Under the personal data protection law of Vietnam you have rights over your personal data. These include the rights to know how your data is used, to access it, to correct it, to ask for it to be deleted, to withdraw your consent, to restrict or object to its use, and to complain to the competent authority.

To use any of these rights, write to support@labelark.com from the email address on your account and tell us what you want us to do. We will reply and act on your request as the law requires.

After you sign in you can also change your name, your profile details and your password yourself on your Profile page.

8. Security

We protect personal data in these ways:

• labelark.com is served over HTTPS, and our servers tell browsers to use HTTPS only (HTTP Strict Transport Security).
• Passwords are stored only as bcrypt hashes. API keys, agent access tokens and password set-up tokens are stored only as SHA-256 hashes.
• Uploaded files are kept in a private Amazon S3 bucket and are opened only through signed links that expire.
• Access is limited by role. Contributors, partners and administrators can open only the pages and data that their role allows.
• Sign-in attempts are rate limited for each email address.

If you think your account is at risk, write to support@labelark.com.

9. Changes to this policy

We may change this policy. When we do, we will publish the new version on this page and update the date at the top.