Privacy Policy

This policy covers the public website and ordinary business inquiries, and sets expectations for project notices. Before a study accesses or collects personal data, its notice must explain the specific processing and responsible entity. Project notices supplement this policy; neither a notice nor a contract removes statutory rights. Visiting this website is not consent to join a study or contribute data for AI training.

• Website operator and controller for website inquiries: Bracketbridge Limited
• Registered office: Unit 2406B, 24/F, Low Block, Grand Millennium Plaza, 181 Queen's Road Central, Sheung Wan, Hong Kong
• Privacy requests and legal inquiries: support@bracketbridge.com
• US partner: Edventure Media LLC, 30 N Gould St #56396, Sheridan, WY 82801, United States. This is a partner correspondence address where specified in your agreement; it does not change the controller identified in your project notice.

• Contact details and project information you choose to send through the brief form on our contact page or by email. Brief form submissions are stored on our own server and forwarded to hello@bracketbridge.com.
• Business context you include in an inquiry, such as company, project, budget, region, or technical requirements.
• Basic server and security logs, such as IP address, user agent, requested URL, timestamp, and error events.
• This website uses first-party, cookieless measurement, not advertising pixels or third-party analytics. It counts page views, referring website domains, language, screen-size categories and selected interactions. For daily visitor estimates, the server temporarily derives a hash from the IP address and browser user agent with a random daily salt; these hashes remain in memory until the next day’s measurement or a service restart. Saved measurement reports contain aggregate counts, not these hashes. Separate server security logs may contain IP addresses. Browsers sending Do Not Track are excluded from the website’s measurement requests.

• Participation is voluntary. You may decline a study, ask questions, or stop participating. Consent must not be obtained through pressure, pre-selected boxes, or a blanket acceptance of unrelated uses.
• Before any access, recording or upload, the project notice must describe the data and sources involved, the purpose (including any AI training or evaluation), the responsible controller, recipients, international transfers, retention period or criteria, and how to exercise your rights.
• The notice must distinguish the minimum data needed for the chosen activity from optional contributions and separate purposes. You may refuse optional data or uses without losing unrelated services. If a study cannot run without particular data, this must be explained before you choose whether to join; you do not have to join.
• Payment terms and the effect of stopping early must be explained in advance. Consent must remain freely given; withdrawal must not be used as a reason to punish you or take away compensation already earned.
• Permission for one study is not permission to access all of your accounts, files, messages or devices. Do not send passwords, one-time codes, identity documents or other people’s private information through this website’s inquiry form.

For website inquiries, we process the details you submit to respond to your request. Where GDPR applies, the relevant grounds are steps requested before a contract where applicable, or our legitimate interest in handling business correspondence. Site security serves our interest in maintaining a reliable website, subject to applicable law and your rights. Optional audience measurement relies on your choice to enable it and can be switched off in the footer. Legally required records rely on the relevant legal obligation. Each project must identify its own lawful grounds; a client contract alone is not a lawful basis for processing every participant’s data. Consent-based purposes require a specific, informed choice, with additional conditions for sensitive data where required. We do not treat an inquiry as permission for unrelated marketing or AI training.

Depending on the written scope, project data may include language or accent samples, voice or audio, transcripts, text prompts, task responses, human feedback, agent trajectory data, interaction logs, device or environment metadata, eligibility details, limited demographics, payment administration records, and quality-control annotations. Collection is contract-based and should be explained in the relevant project or participant notice before collection.

• To respond to inquiries and manage client relationships.
• To operate, secure, troubleshoot, and improve this website.
• To plan, run, validate, quality-check, de-identify, anonymize, and deliver datasets under a client agreement.
• To maintain business records and comply with legal, security, tax, accounting, or contractual obligations.

For many data acquisition engagements, the client determines the purpose, scope, acceptance criteria, and permitted use of the dataset. In those situations, Bracketbridge acts as a service provider, processor, or operations partner under contract. Bracketbridge does not claim ownership of client project data unless a written agreement says otherwise.

Website inquiries are stored on our server and sent to our business inbox using an email-delivery provider. Hosting, email and security providers may process them to supply these services. For projects, the notice must identify the relevant controller and recipients or recipient categories, including clients and any recruitment, payment, storage or quality-control providers. Only data needed for the disclosed purpose should be shared, under appropriate terms. Disclosure to advisers or authorities may be necessary for legal obligations or claims. Bracketbridge does not sell website inquiry data. The US partner is not automatically a recipient of every inquiry or dataset.

Website inquiries are kept only as long as reasonably needed for the inquiry, business relationship, security, and legal records. Project data is retained according to the applicable statement of work, data processing agreement, participant notice, or deletion schedule. Where feasible, direct identifiers are separated, reduced, de-identified, anonymized, or deleted after they are no longer needed.

Bracketbridge Limited is established in Hong Kong and works across borders. Server hosting for this website is provided by Hetzner; inquiry delivery also involves an email provider. Project notices must explain relevant processing locations and transfers. Before a restricted transfer, the responsible entity must assess the destination and put a valid legal mechanism and any necessary supplementary safeguards in place. For GDPR-covered transfers this may involve an adequacy decision or executed Standard Contractual Clauses, as applicable; UAE and other applicable transfer rules require separate assessment. A US correspondence address is not a transfer safeguard. We do not claim Data Privacy Framework certification. You may ask support@bracketbridge.com for information about the safeguards applicable to your data.

Depending on applicable law, you may request access or a copy, correction, deletion, restriction, portability, or object to processing, including processing based on legitimate interests. Hong Kong law provides access and correction rights. Send requests to support@bracketbridge.com with enough context to locate the relevant inquiry or project; do not attach sensitive identity documents initially. Any identity checks must be proportionate. We will respond within the applicable legal deadline and explain any lawful refusal or extension. You may complain to the competent data-protection authority; you do not have to contact us first. Where we act for a client controller, we will assist and direct the request to the responsible party.

Where processing relies on consent, you can withdraw it at any time through the project’s withdrawal route or by emailing support@bracketbridge.com. Withdrawing must be as easy as giving consent. Withdrawal stops further consent-based processing but does not make earlier lawful processing unlawful. We must assess deletion and notify relevant recipients where required; any necessary legal retention must be explained and limited. Data that has already been irreversibly anonymized may no longer be identifiable for removal. De-identification alone is not anonymization, and sharing data with a client does not remove your rights.

Applicable requirements depend on the activity, people affected, entity roles and data flows—not simply an office address. These may include Hong Kong’s Personal Data (Privacy) Ordinance, the EU GDPR, and the UAE’s Federal Decree-Law No. 45 of 2021. DIFC and ADGM have distinct data-protection regimes; relevant sector rules and other national laws may also apply. Project review must establish the applicable regime, lawful grounds, rights procedures and transfer conditions. This policy is not a certification of universal compliance. Security measures, retention/deletion procedures, processor terms and any required impact assessments must be verified for each collection before it starts.

Where the Swiss Federal Act on Data Protection (FADP) applies, you may request information about the processing of your data, correction of inaccurate data, and other available remedies, including deletion or cessation of unlawful processing. Data portability and human review of certain automated decisions apply where the statutory conditions are met. Contact support@bracketbridge.com or raise a concern with the Federal Data Protection and Information Commissioner (FDPIC). Relevant notices must identify the controller, purposes, recipients and countries of disclosure, together with required transfer safeguards or exceptions. Swiss transfer requirements must be assessed separately from EU requirements; a US partner address does not establish adequate protection.

• US requirements vary by state, sector and activity. Federal consumer-protection rules require truthful privacy and security representations. State privacy, breach-notification, recording, biometric and consumer-health rules may apply even when a general consumer-privacy statute does not.
• Where applicable, including under California’s CCPA as amended by the CPRA, rights may include knowing or accessing data, correction, deletion, portability, opting out of sale or sharing for cross-context behavioral advertising, and limiting certain uses of sensitive information. Other state laws may provide opt-outs from targeted advertising or certain profiling and an appeal route. Applicable thresholds and exemptions must be assessed, not assumed.
• You may submit a rights request, an authorized-agent request, or an appeal of our response to support@bracketbridge.com. Identify the relevant project and request; do not initially send sensitive identity documents. We will apply the relevant verification, response and appeal requirements. We will not unlawfully discriminate against you for exercising privacy rights.
• The public website does not sell inquiry data or use advertising pixels for cross-context behavioral advertising. This statement does not classify every project dataset transaction. Before a US project collects or discloses data, its responsible entity must assess whether the activity constitutes a sale, sharing, sensitive-data processing or data-broker activity and implement any required notices, opt-outs, consent and registrations. A client contract or paid participation does not by itself create an exemption.

Our published project-experience locations are Austria, Belgium, China, France, Germany, Italy, Mexico, Norway, Poland, Portugal, South Korea, Spain, Sweden, Switzerland, the United Arab Emirates, the United States and Vietnam. This list describes experience, not a statement that collection is currently active or legally cleared in every location. Relevant projects require a local notice in a language participants understand, the applicable rights and complaint routes, and any required local contacts, approvals or transfer arrangements. Hong Kong’s PDPO also remains relevant to our operations. See Data Governance for the regional review framework; additional locations require a fresh review.

Optional website measurement is off until you enable it through Privacy choices in the footer. You can turn it off there at any time without affecting access to the website or inquiry form. Global Privacy Control (GPC) and Do Not Track signals prevent this optional measurement even if it was previously enabled. Your choice is stored locally in this browser; clearing site storage resets it to off. The preference is not an advertising identifier. Essential server requests and security logs still occur. We do not use third-party advertising trackers on this public site. Changes to this policy are published here with a revised date; material changes require appropriate advance notice and a new choice where legally required. A policy update does not retroactively authorize a new use of previously collected data.

Bracketbridge does not intentionally collect sensitive categories of data or data from children through this public website. Any study involving minors, biometric identification, precise location, health, financial, government ID, or other sensitive data must be handled under a project-specific notice, consent process, and additional safeguards.