Privacy & licensing
Which law applies, and what you actually receive
We contract from Pakistan and sell mostly into the EU, UK and US. Where regimes conflict, we apply the stricter standard rather than the local minimum.
Regulatory posture
The regimes that actually bite
| Regime | Where it applies | Our posture |
|---|---|---|
| GDPR (EU / UK) | Most of our client base and all EU-bound transfers | Applied as our working standard everywhere. SCCs, DPA on request, named DPO, DSAR process |
| Pakistan PECA 2016 | Electronic data handling and cybercrime obligations | Documented compliance; law-enforcement request policy published |
| Pakistan draft PDP Bill | Contributor personal data | Treated as though already in force: notice, consent, purpose limitation, breach workflow |
| Provincial and sectoral rules | Health, financial and government-adjacent collection | Local counsel review before each program; ethics-board approval for clinical work |
| US state privacy law | US clients with CCPA / CPRA obligations | Processor terms, deletion support and no sale of personal information |
| Biometric-specific law | Facial and voice biometric programs | GDPR Article 9 special-category standard applied globally |
A summary of our operating posture, not legal advice. Our DPA, DPIA templates and jurisdiction memos are available to clients under NDA.
The licence
Written for model training, not for stock photos
Most data licences were drafted for content reuse and then stretched to cover machine learning. Ours names the use case directly.
- Perpetual, worldwide and irrevocable — it does not expire with the contract
- Sublicensable, so you can ship derived models to your own customers
- Derivative-model rights stated explicitly, not left to interpretation
- Commercial use included by default, not as a paid upgrade
- Exclusivity available on production contracts where terms support it
- Full assignment available where you need to own rather than licence
- Per-record consent artefacts delivered alongside, so any row is auditable
- IP indemnity available, with the exclusions stated plainly rather than buried
Legal documents, available on request
Master Services Agreement, Data Processing Agreement with SCCs, mutual NDA, consent template library, and our contributor pay disclosure. Most are sent within one business day; the NDA usually goes out the same day.
Nothing on this page is legal advice. Our commitments are the ones written into the executed contract, and where this page and the contract differ, the contract governs.
Answers
Licensing and privacy questions
You receive a perpetual, worldwide, irrevocable, sublicensable licence to use the data for training, fine-tuning, evaluating and distributing machine-learning models, including commercially and including derivative models. On production contracts we offer full assignment or exclusivity where the commercial terms support it. The Dataa retains the right to reuse non-exclusive catalog data unless you have bought exclusivity — and we state clearly which is which before you sign.
We contract from Pakistan and operate under Pakistani law, including PECA 2016 and the obligations set out in the draft Personal Data Protection Bill, which we treat as though it were already in force. Because most of our clients are in the EU, UK and US, we apply GDPR as our working standard regardless — it is the strictest regime we routinely face, so meeting it satisfies the others. EU transfers run on standard contractual clauses.
Under a separate, heightened consent that names biometric processing explicitly, states retention period and revocation rights, and is executed in the contributor's own language with a witness. We apply GDPR Article 9 special-category handling globally rather than the local minimum, whichever market the client sits in.
Yes, on production contracts, covering third-party IP and privacy claims arising from data we collected under our own consent framework, subject to negotiated caps. We do not offer indemnity on data you supply to us or on third-party-licensed content where the upstream rights-holder's terms govern — and we will point out that distinction rather than let it sit ambiguous in a schedule.
Have your counsel send us their redlines.
We would rather resolve the licence questions before you scope a program than after.
Average first response: under 6 business hours. NDAs signed same day.