KLKT App — Privacy Policy

1. Definitions

Capitalised terms used but not defined in this Privacy Policy have the meaning given to them in the Terms.

2. Who We Are and Our Role as Controller

2.1 CNTXT is the controller of Personal Data processed in connection with the App, for the purposes of the Data Protection Laws.

2.2 In respect of Users, CNTXT is the controller of the Personal Data described in Clause 3 below, including account, KYC, usage and Submitted Content data submitted by the User.

2.3 In respect of Bystanders, CNTXT is also a controller and not merely a processor acting on the User's instructions of any Bystander personal data that is incidentally contained within Submitted Content once it is submitted through the App. This is because, from the point of submission, CNTXT determines the purposes and means of processing that data, including its storage, review, retention, use for AI/robotics training and research, and transfer to Clients, independently of the User who made the recording.

2.4 CNTXT's lawful basis for processing Bystander personal data is CNTXT's legitimate interests (and those of Users and Clients) in developing and validating datasets for artificial intelligence and robotics training, research, and related purposes, balanced against the impact on Bystanders. CNTXT considers this impact to be limited because:

• a. Bystander capture is incidental and non-targeted, arising only where the User records in a home or private environment;
• b. the filming protocol and Submission Guidelines require Users to minimise the presence of other individuals and to obtain a release from any Bystander who is or may be captured;
• c. facial images and other direct biometric identifiers of any person, including Bystanders, must not be submitted and must be obscured before submission (see Clause 5); and
• d. CNTXT does not process Submitted Content for the purpose of identifying any Bystander.

2.5 Because CNTXT cannot practicably identify or directly notify individual Bystanders at the point of collection, CNTXT satisfies its transparency obligations under the Data Protection Laws by:

• a. making this Privacy Policy publicly available within the App; and
• b. requiring, under the filming protocol, that Users take reasonable steps to inform any Bystander that recording is taking place and to obtain that Bystander's consent through the in-App release process before submission.

3. Personal Data We Collect

3.1 Account and identity data: name, email address, phone number, account credentials, profile information, and KYC/identity verification documents (e.g., government ID, proof of address, tax and banking details).

3.2 Payment data: payment details, payout method, and transaction history.

3.3 Usage, device and log data: device type and identifiers, IP address and approximate location derived from it, app usage, timestamps, and diagnostic/quality-control data.

3.4 Submitted Content: content submitted by Users in connection with the Services, which may include speech audio, images of handwritten or printed text, video (including first-person/egocentric recordings), motion and inertial measurement unit (IMU) data, hand- and head-tracking data, electromyography (EMG) and other wearable or virtual/augmented-reality sensor data, associated task metadata, and any other data types made available through the App from time to time.

3.5 Bystander data: to the extent incidentally contained within Submitted Content notwithstanding the safeguards in Clause 5, limited personal data of Bystanders (excluding facial images and other direct biometric identifiers, which must not be submitted).

3.6 Communications data: records of correspondence between you and CNTXT, including support requests and consent/release records.

4. Purposes of Processing and Lawful Bases

CNTXT processes Submitted Content and other personal information for the following purposes and on the following lawful bases:

Where CNTXT relies on legitimate interests, it has weighed those interests against your interests, rights and freedoms, and will provide further information about that assessment on request. Where processing is based on your consent, including for voice samples and marketing, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal and without affecting any processing carried out on another lawful basis.

5. Biometric and Sensitive Personal Data

5.1 No facial or biometric capture. The App and the Submission Guidelines are designed so that no facial image or other direct biometric identifier of any person is captured in the Submitted Content. Users must not submit, and must obscure before submission, any such identifier. This requirement is reflected in the filming protocol (Clause 5.2 of the Terms) and the Submission Guidelines and applies equally to Users and any Bystander who may be captured.

5.2 No-identification position. CNTXT does not process Submitted Content for the purpose of identifying any individual, whether a User or a Bystander.

5.3 Motion, IMU and tracking data. Motion, IMU, and hand- and head-tracking data are treated by CNTXT as personal data (rather than sensitive personal data). CNTXT applies the following safeguards to this data:

• a. it is not used, and must not be used by any Client, to identify or re-identify any individual;
• b. access is restricted to personnel and systems with a legitimate business need; and
• c. it must not be linked or combined with other data for the purpose of identifying any individual.

5.4 Voice. Where a task requests voice samples, voice is treated as a biometric-capable data channel. CNTXT will obtain the User's explicit consent to the recording and processing of voice samples for that specific task, on the same no-identification basis described in Clause 5.2, before any such samples are collected.

5.5 Residual sensitive data. Where Submitted Content nonetheless contains personal data from which an individual could be identified, or any Sensitive Personal Data, notwithstanding the safeguards above, CNTXT shall process it only on a lawful basis available under applicable Data Protection Laws and shall apply appropriate technical and organisational safeguards, including restricted access, data minimisation, and, where appropriate, deletion or obscuring of the relevant data.

6. Use of Submitted Content for AI Training, Research and Commercialisation

6.1 CNTXT uses Submitted Content, and any personal data lawfully contained within it (subject to Clause 5), to train, test, validate, evaluate and improve artificial-intelligence, machine-learning and robotics models, to conduct research, and to develop and commercialise datasets, models and products, including by licensing, disclosing or transferring Submitted Content to Clients.

6.2 CNTXT relies on performance of its contract with the User for the use of the User's own Submitted Content for the purpose for which it was submitted, and on its legitimate interests for further research and commercialisation, as set out in Clause 4. Ownership of the Submitted Content is dealt with separately under Clause 9 of the Terms.

6.3 This use is carried out on the no-identification basis described in Clause 5.2: CNTXT's purpose is to train models to understand tasks, movement, objects and environments, and not to identify, profile or make decisions about any individual.

7. Data Retention

7.1 Account data. We retain account and profile data for as long as your account remains active, and for 12 months following account closure or deemed inactivity (in line with Clause 3.8 of the Terms), after which it will be deleted or anonymised, save as set out below.

7.2 KYC and payment data. We retain KYC, identity verification and payment records for the period required by applicable anti-money laundering, tax and financial services laws, currently anticipated to be 5 to 7 years from the end of the relationship, or such other period as required by law.

7.3 Accepted Submitted Content. Once accepted, Submitted Content (including any personal data it contains, subject to Clause 5) is retained for as long as reasonably necessary to fulfil the purposes described in this Policy, including the anticipated development and operational lifecycle of the AI/robotics models trained using it, and any retention period agreed with a Client under the data-sharing arrangements described in Clause 9. Because such data is assigned to CNTXT and may be incorporated into trained models, it may not always be practicable to apply a fixed retention period; CNTXT will review retained Submitted Content periodically and delete or anonymise it where it is no longer needed for these purposes or where required by applicable law or a valid erasure request.

7.4 Bystander data. Personal data of Bystanders incidentally contained in Submitted Content is subject to the same retention approach as the Submitted Content in which it appears, save that CNTXT will give particular weight to a Bystander's request for deletion under Clause 12.3, including by seeking to obscure, remove or delete the relevant data or, where technically feasible, the specific Submitted Content in which it appears.

7.5 Communications and support records. Retained for 24 months from the date of the last communication, or longer where necessary to resolve a dispute or comply with a legal obligation.

8. How We Share Personal Data — Including Onward Transfer to Clients

8.1 CNTXT discloses and transfers Submitted Content including any personal data of Users and Bystanders it contains, subject to the safeguards in Clause 5, to Clients (third parties including AI, robotics and technology companies) and their service providers, for the purposes of AI/robotics training, testing, research, and the other purposes described in Clause 6.

8.2 Clients may be located in the United Arab Emirates or in other jurisdictions, including outside the UAE. See Clause 9 (International Transfers) for how CNTXT safeguards such transfers.

8.3 Controller-to-controller basis. Because ownership of Submitted Content vests in CNTXT upon acceptance under Clause 9 of the Terms, and each Client subsequently determines its own purposes and means for processing the Submitted Content it receives (for example, to train its own models), CNTXT's disclosure of Submitted Content to a Client is a controller-to-controller transfer and not a processor engagement. Before any such transfer, CNTXT puts in place a data-sharing and transfer agreement with the relevant Client addressing, among other things, the Client's obligations regarding security, confidentiality, retention, onward transfer, and cooperation with data-subject and Bystander requests as described in Clause 12.3.

8.4 We also share personal data with:

• a. service providers who support the App, including cloud hosting and storage providers, payment processors, and KYC/identity verification providers, acting as processors on CNTXT's behalf;
• b. professional advisors, including legal, tax and audit advisors;
• c. regulators, courts, law enforcement and other public authorities, where required by law or to protect CNTXT's rights; and
• d. a successor entity in the context of a merger, acquisition, financing, or sale of assets.

8.5 We do not sell Personal Data to data brokers, and we do not sell Google user data. Any disclosure of Google user data is limited as described in Clause 3.4 of the Terms.

9. International Transfers

9.1 The User acknowledges and agrees that CNTXT may store, process, and transfer the Submitted Content and associated personal data outside the United Arab Emirates, including to CNTXT's Clients and their service providers, for the purposes set out in these Terms and this Privacy Policy.

9.2 Storage location. Submitted Content and associated personal data are primarily stored on servers located in Mumbai, India. Where CNTXT changes its primary storage region, it will update this Privacy Policy accordingly.

9.3 Where any transfer described in this Clause 9 is to a jurisdiction that does not ensure an adequate level of data protection, CNTXT shall put in place appropriate safeguards in accordance with applicable Data Protection Laws before making the transfer. CNTXT will rely first on an adequacy decision or on appropriate safeguards, such as standard contractual clauses or an equivalent mechanism recognised under the PDPL and its executive regulations, together with contractual security and confidentiality commitments from the recipient. Only where no such route is available will CNTXT rely on a derogation permitted under applicable Data Protection Laws, such as your explicit consent to a specific and identified transfer that has been described to you.

9.4 The specific safeguard applied to a given transfer (for example, to a Client located in the United States as opposed to a Client located in the UAE) will be identified in the applicable data-sharing and transfer agreement referred to in Clause 8.3, and confirmed once the operative mechanism under the PDPL executive regulations has been finalised for that transfer.

10. Data Security

10.1 CNTXT implements technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration, including password hashing, encryption of data in transit and at rest, access controls, session timeout mechanisms, suspicious-activity monitoring, and account lockout after repeated failed login attempts.

10.2 No method of transmission or storage is completely secure. If you become aware of any actual or suspected security incident affecting your account or personal data, please contact support@klkt.ai immediately.

11. Children's Data

11.1 The App is not directed at, and Users must be at least eighteen (18) years of age. Users must not capture any individual under the age of eighteen (18) in Submitted Content in any circumstances (see Clause 5.2 of the Terms).

11.2 CNTXT does not knowingly collect personal data of children. If CNTXT becomes aware that Submitted Content contains the personal data of a child, CNTXT will remove or delete that data or content as soon as reasonably practicable.

12. Your Rights

12.1 Subject to applicable Data Protection Laws and any applicable exemptions, you may have the right to:

• a. be informed about how your personal data is processed;
• b. access a copy of your personal data;
• c. request correction of inaccurate or incomplete personal data;
• d. request erasure of your personal data;
• e. request restriction of, or object to, processing;
• f. receive your personal data in a portable format, where applicable;
• g. withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• h. lodge a complaint with the UAE Data Office or other competent supervisory authority.

12.2 Requests by Users. Users may exercise these rights by contacting support@klkt.ai. We may need to verify your identity before actioning a request. We will respond within the timeframe required by applicable Data Protection Laws. Please note that, once Submitted Content has been used to train an artificial intelligence or machine learning model, it may not be technically possible to extract or delete your specific contribution from that model; where this is the case, we will explain the position to you and take other reasonable steps available to us, such as ceasing further use of the underlying Submitted Content and removing it from future training datasets.

12.3 Requests by Bystanders. Because Bystanders are not account holders and cannot submit requests through the App, a Bystander (or someone acting on their behalf) may contact CNTXT directly at support@klkt.ai to exercise the rights described in Clause 12.1. To help us locate the relevant Submitted Content, please provide as much identifying detail as possible (for example, the approximate date, location, or task reference, and a description of the individual and how they were captured). CNTXT will use reasonable efforts to locate and address the request, including, where the relevant Submitted Content has already been transferred to a Client, by contacting that Client and requiring it, under the data-sharing and transfer agreement described in Clause 8.3, to cooperate with, and where appropriate directly respond to, the request within the timeframe specified in that agreement.

12.4 Complaints. If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office (or, where applicable, another competent supervisory authority).

13. Changes to This Privacy Policy

13.1 CNTXT may update this Privacy Policy from time to time to reflect changes in applicable law, the Services, or CNTXT's data processing practices. For material changes, CNTXT will provide at least thirty (30) days' prior notice by email, or through the App. Continued use of the App after the effective date of any update constitutes acceptance of the updated Privacy Policy, except where additional affirmative consent is required by applicable law.

14. How to Contact Us

14.1 If you have any questions, concerns, or requests regarding this Privacy Policy or CNTXT's processing of personal data, please contact at support@klkt.ai.