Privacy policy

1. Scope and responsible entity

This policy applies to the company information, research, model and legal pages provided under the OneZero Labs brand. “Personal information” means information that can directly or indirectly identify a specific individual; what qualifies as such is determined by applicable law.

The final policy must identify the legal entity responsible for processing personal information on this website, together with its registered address, mailing address and contact details for receiving requests. This page currently refers only to the brand name, which must not be taken to mean that the contracting party or the data controller has been determined.

Amicura, SociaBench and external model platforms are separate services. What this website states does not automatically extend to how those services handle accounts, conversations, voice, images, payments or training data. When you use one of those services, refer to the policy that actually applies to it.

2. Information the website may currently involve

The website currently presents mainly public content. Its front end offers no registration, sign-in, payments, chat input, subscriptions or file uploads, and it does not include third-party advertising pixels or analytics scripts. This statement must be reviewed again whenever the website’s functionality changes.

When you browse, your network connection sends the website’s servers and hosting infrastructure the technical information needed to deliver the pages. Which logs are actually kept, by whom and for how long must be confirmed against the final deployment configuration.

3. Purposes of processing and legal bases

The proposed purposes of processing are limited to providing and maintaining the website, understanding and fixing faults, keeping the network secure, and responding to requests you choose to submit. Each purpose must be matched to the information actually necessary for it; collection must not be expanded merely because information is technically obtainable.

Before formal launch, the responsible entity must confirm the legal basis for processing under applicable law and in light of the specific context. Where consent is required, valid consent must be obtained before processing and the means of withdrawing it explained. Where processing relies on the performance of a contract, a legal obligation or another basis, its scope must be stated clearly.

If processing is added in the future for purposes clearly different from the original ones, such as marketing subscriptions, cross-site analytics or research recruitment, separate notice must be given and, where the law requires, choice or consent must be obtained again.

4. Conversations, media and model training

The website currently has no means of submitting user conversations, recordings, camera footage or training material. Browsing its public pages does not create, through this website, a record of user conversations that could be used for model training.

If demo, upload, feedback or training features are offered in the future, the point of entry must explain whether inputs, outputs and feedback will be stored or used to improve models, and must make clear the available settings, retention period, parties involved and how to opt out. Visiting the website must not be treated as blanket authorization for future training uses.

Whether a separate product uses user content to train models is governed by that product’s actual configuration and policy. Users should not infer how other services handle data solely from the research descriptions on this website.

5. Service providers and disclosure of information

Providers of website hosting, content delivery, network protection or technical support may process information to the extent necessary to provide their services. The final policy must, based on the final deployment inventory, describe their categories, roles, processing purposes and the necessary safeguards.

Apart from disclosures you expressly request, any other disclosure must have an appropriate basis, such as complying with a legal obligation, handling a security incident or protecting lawful rights and interests, and its scope must be kept limited. In the event of a business reorganization or transfer of assets, notice obligations and the limits on the recipient’s processing must be reassessed.

This document does not constitute a statement about any unconfirmed provider, cross-border destination or specific certification. Such information must be completed on the basis of actual data flows and contracts.

6. Retention, deletion and security

Retention periods must be determined according to the specific purpose, legal obligations and the time needed to handle requests. Once the purpose has been fulfilled or the basis for retention no longer exists, the information must be deleted or anonymized by appropriate means, except for records that the law requires to be kept.

Logs, backups, support emails and records of rights requests may have different retention periods. The final policy must state the period, or the criteria used to determine it, for each, and must not substitute indefinite retention for clear management rules.

The responsible entity must take technical and organizational measures proportionate to the sensitivity of the information and the risks involved, and must put in place access management and incident response arrangements. Any specific security capability, certification or zero-data-retention commitment may be stated publicly only after it has been verified in practice.

7. Cross-border processing

Hosting locations, content delivery nodes and where providers are based may determine the countries or regions in which information is processed. Before formal deployment, the actual destinations, parties and transfer routes must be verified, and the notices, contracts or other arrangements required by applicable law must be put in place.

That the website can be accessed worldwide does not mean that the data processing requirements of every country or region have been met, nor that data residency in any particular region has been promised. For cross-border arrangements involving separate products, refer to their own notices.

8. Your choices and rights

Depending on applicable law and the specific circumstances, you may have rights such as the right to be informed, the rights of access, rectification and erasure, the rights to restrict and to object to processing, the right to data portability and the right to withdraw consent. The scope of and exceptions to each right may differ.

The final policy must provide a request channel that can actually be used. In your request, you can state the service you use, what you would like done and the information needed to locate the relevant records. To protect the security of information, the party handling the request may need to carry out reasonable identity verification.

If a request cannot be met, the reasons and the possible next steps must be explained. Where applicable, you may also lodge a complaint with a competent supervisory authority. The website does not yet have an email address or form through which requests can be submitted directly.

9. Information about minors

The website currently provides public informational content. Before any account, interaction, research or data collection feature directed at minors is opened, the age requirements, how parents or guardians are involved, content boundaries and a dedicated privacy notice must be verified.

If sensitive or unnecessary information that may belong to a minor is found to have been received through other channels, the responsible team must assess whether it needs to be kept and handle it appropriately. The specific procedure and contact person must be set out in the final version.

10. External links and embedded content

External links on the website may open other websites, whose pages, accounts and technical services may be provided by different entities. Once you click through, the destination site receives visit information according to its own settings, and its privacy practices are not automatically replaced by this policy.

Media currently shown on the website are served from the website’s own resource addresses. If external players, analytics services or social embeds are added in the future, third-party requests, cookies and notice requirements must be reviewed again before they are integrated.

11. Updates and contact

Updates to this policy must clearly state the revision date and give appropriate notice of significant changes in processing. Changes that require separate consent may be implemented only after the necessary steps have been completed.

The update history of this policy is kept in step with the page’s revision date. For the processing of personal information in a specific product, please also read the privacy notice published for that product.