Contract-based AI training data acquisition

• Every data acquisition engagement is scoped through a written agreement or project authorization.
• The client normally controls the project purpose, dataset requirements, acceptance criteria, and permitted use.
• Bracketbridge structures recruitment, collection, validation, quality control, de-identification, and delivery according to the agreed scope.

• Language, speech, accent, transcription, and evaluation data.
• Human feedback, ranking, preference, annotation, and task-response data.
• Agent trajectory data, including action traces, prompt-response flows, screen or tool-use sequences, and decision-path records.
• Specialized data collection for product testing, model evaluation, or market-specific AI workflows.

Participation must be voluntary and informed before collection begins. Project owners must explain required versus optional data, purposes and AI uses, the controller and recipients, storage and transfer locations, retention, compensation, and withdrawal routes in accessible language. Optional purposes need separate choices, not pre-selected consent. Participants may decline or stop without coercion; collecting more than the disclosed scope requires a new assessment and, where consent is required, a new choice.

Collection tools must be scoped to the authorized task before accessing a device, account or source—not only before upload. Participants should be able to understand and select the optional material they contribute. A participant cannot automatically consent for people appearing in their messages, contacts, recordings or files. Each project must resolve the lawful handling of third-party data, exclude unnecessary material and provide appropriate notices and safeguards before collection or disclosure. Broad account access is not a substitute for this review.

Minimize identifiers at collection and separate or remove them where feasible. De-identified or pseudonymized data can still be personal data; removing a name does not make a voice, image or detailed activity record anonymous. Claims of anonymization require an assessment of re-identification risk. Retention schedules must cover source data, derived data, recipients and backups, with documented deletion procedures and narrow legal exceptions.

Datasets are validated against project specifications, collection rules, duplicate or fraud checks, format requirements, market context, and client acceptance criteria. Audit records can be maintained when the client requires them.

For US-linked datasets, assess the US Department of Justice Data Security Program, including restrictions on access to covered US sensitive or government-related data by countries of concern or covered persons. De-identification and participant consent do not automatically remove those restrictions. Screen the parties, data categories, volumes, access locations and onward transfers before approval. Where California data-broker rules apply, assess registration and DROP deletion obligations separately from ordinary website privacy notices.

• Austria, Belgium, France, Germany, Italy, Poland, Portugal, Spain and Sweden: EU GDPR plus applicable national privacy, electronic-communications, recording and other local rules. Norway: GDPR through the EEA and Norwegian implementing rules. A GDPR assessment does not replace local website or recording-law review.
• Switzerland: FADP and implementing rules, including transparency, individual rights, security, overseas disclosure and any required Swiss representative. Swiss requirements are not interchangeable with GDPR.
• United States: FTC consumer-protection requirements and applicable state privacy laws, including CalOPPA and CCPA/CPRA where applicable; also assess recording consent, biometric identifiers, health data, children’s data, breach notification and data-broker obligations. Participant state and the actual transaction matter, not merely the partner’s Wyoming address.
• United Arab Emirates: assess the federal PDPL, DIFC or ADGM regime and applicable sector restrictions. Hong Kong: assess the PDPO and collection-notice requirements.
• Mainland China: assess PIPL, relevant cybersecurity/data rules, local representation and cross-border export requirements. Determine whether separate consent, a transfer assessment, standard contract, certification or another permitted route is required before transfer.
• South Korea: assess PIPA requirements for notice, rights, consent where required, overseas transfers and any required domestic representative.
• Mexico: assess the current Federal Law on Protection of Personal Data Held by Private Parties, privacy notices, ARCO rights (access, rectification, cancellation and opposition), consent and transfer requirements.
• Vietnam: assess the Personal Data Protection Law effective 1 January 2026 and current implementing rules, including notice, rights, impact assessments and overseas-transfer requirements where applicable. Do not rely solely on superseded guidance.

Legal review must cover more than privacy-page wording: verified business identity and any mandatory registry disclosures; applicable website accessibility and consumer rules; content and media permissions; marketing and tracking choices; security and incident response; vendor contracts and processing countries; workable retention and rights-request procedures; and project-specific recording, sensitive-data and children’s safeguards. Review whether local representatives, registrations, licenses, impact assessments or regulator filings are required. Do not start a collection or transfer until applicable prerequisites are satisfied. Public policies describe our requirements; they are not evidence that these checks have been completed for a particular project.

Before launch, each project must assess Hong Kong PDPO, EU/EEA GDPR, UK, Swiss, US and UAE requirements where applicable. UAE review must distinguish the federal PDPL from DIFC, ADGM and relevant sector regimes. An office or partner address does not establish compliance. The review must document controller/processor roles, lawful grounds, notices, required risk assessments, processor agreements, access controls, secure transfers, retention, rights handling and incident response. These are project requirements, not a claim that every deployment has already been independently audited or certified.