Privacy Policy
Last updated: February 14, 2021
Welcome to hCaptcha! This Privacy Policy describes the practices of Intuition Machines, Inc. ("IMI", "we" or "us") regarding our collection, use, and disclosure of information (including Personal Information, defined below) through our website at www.hcaptcha.com and www.botstop.com (the "Sites") and the hCaptcha application program interface and related software and materials (collectively, the "Service").
Not Applicable to Third Party Websites. Please note that this Privacy Policy does not apply to any website, offering, product or service of any third party, even if it links to our Site or incorporates the Service – please refer to the applicable privacy policies before deciding to provide any information to third parties.
A Note to Customers Outside the United States. IMI is based in the United States. The Sites and Service are controlled and operated by us from the United States. Your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers, and by using the Sites and Service you consent to the transfer of information to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.
A Note to California Residents. Please see our "Notice to California Residents" section related to your rights under the California Consumer Privacy Act ("CCPA").
A Note to European Economic Area Residents. Please see our "Notice to EU Data Subjects" section related to your rights under the General Data Protection Regulation ("GDPR") and our "EU-US Privacy Shield and Swiss-U.S. Privacy Shield" section related to IMI's Privacy Shield certification. Although Privacy Shield is no longer in force, IMI has not withdrawn from the program at this time, and thus references to it remain within this document in compliance with FTC guidelines.
Note that IMI is the controller of your personal information, except where we process personal information on behalf of our Integrators in connection with the provision of our Service, in which case we are the processor of personal information, and those Integrators are the controllers of the personal information.
Where we act as a processor for our Integrators, we do not use the data collected for any purpose other than as reasonably necessary to provide our Service, and our processing will be governed by the contracts that we have in place with our Integrators, not this Privacy Policy.
Processing of EU Data Subject data operates under the legal basis of the Standard Contractual Clauses (SCCs) integrated within the Data Processing Addendum to our Terms of Service or Data Processing Agreements with our Integrators.
If you have any questions or concerns about how such data is handled or would like to exercise your rights, you should contact the person or entity (i.e., the data controller) who has contracted with us to use the Service to process this data. We will, however, provide assistance to our Integrators to address any concerns you may have, in accordance with the terms of our contract with them.
A Note to Residents of Switzerland. Please see our "EU-US Privacy Shield and Swiss-U.S. Privacy Shield" section related to IMI's Privacy Shield certification.
We collect information from individuals who interact with our Sites and Services, including those who incorporate our Service into their website ("Integrators"), those who utilize our services for data labeling ("Customers"), and the end users who interact with the our Service through the websites of our Integrators ("End-Users").
We collect the following categories of information:
- Information that can be used to identify or contact an individual ("Personal Information"), such as name, email address, and country. We collect Personal Information from our current and prospective Integrators and Customers when they give it directly to us (for example, by filling in a form when signing up for an account, or applying to receive email notifications from us). We may also verify the identity of our Integrators and Customers by comparing personal information against third party databases or official legal documents.
- Information collected automatically as a result of an Integrator’s or Customer’s use of the our Sites or the Services ("Analytics Information"), such as IP addresses, browser type, Internet service provider, platform type, device type, operating system, date and time stamp of access, and other similar information. Some Analytics Information is collected on our behalf by third parties we engage for that purpose, and some Analytics Information is collected through a variety of tracking technologies, including cookies (see "Third Party Analytics and Tracking Technologies" below).
- Information collected as a result of End-Users answering prompts through the Service ("Labeled Data"), such as image labeling data, text converted from audio files played to those End-Users, answers to questions, and other prompts generated by the Service for purposes of labeling data for use in machine learning applications. Note that Labeled Data is not tied to any identified individual.
- Other information collected from End-Users as part of the Service to that is required to determine whether they
are human, such as mouse movements, scroll position, keypress events, touch events, and gyroscope / accelerometer information as applicable. - We may collect additional information from End-Users who wish to work with us as Individual Data Labelers.
We use the information we collect for the following purposes:
- To administer Integrator and Customer accounts and provide the Service. We use Personal Information in order to associate specific accounts with Integrators and Customers and to provide them the Service, to respond to requests or inquiries, to provide support or technical assistance, and to facilitate payments.
- To improve to Site and the Service. We use Analytics Information to improve our existing and develop new services and offerings and to customize existing and future product offerings.
- To derive market insights. We use Analytics Information to analyze the market and conduct business analyses related to the Site and our Services, and for other research purposes.
- To provide a market for Labeled Data. Our Service enables high volume data labeling and human review for machine learning systems as a service to website owners and companies who need help getting their data labeled. To that end, we disclose Labeled Data to our Customers interested in acquiring Labeled Data.
- To secure our services and systems. We use Analytics Information to secure our systems by identifying potential threats and vulnerabilities, and to otherwise protect the information we collect.
- For any legitimate business purpose, provided that the information is de-identified or aggregated such that it cannot be reasonably tied to an individual..
We share or disclose personal information in the following cases:
- Upon direct request from an Integrator to identify the fraud risk of a specific CAPTCHA challenge request or IP address, or otherwise where specific consent was given.
- With vendors we engage to provide essential aspects of the Sites and the Service, such as data storage, hosting, and Analytics, and only for those purposes.
- As necessary to comply with applicable law, including governmental requests, law enforcement requests, and otherwise to public and private entities in order to protect the rights, privacy, safety, or property of you, us, or others.
- With others for any legitimate business purpose, provided the information is de-identified
or aggregated such that it cannot be reasonably tied to an individual.
As discussed above, we (and our third party vendors) collect Analytics Information in part through the use of cookies, web beacons, and other tracking technologies. In some instance, we work with third party vendors to employ cookies for the purposes of collecting Analytics Information.
We use Sentry to collect debugging data when a user experiences an error. For information on how Sentry collects and processes data, please click here.
We use Cloudflare to optimize our web traffic. For information on how Cloudflare collects and processes data, please click here.
If you would prefer not to block the use of cookies or other tracking technologies, please see "Managing Your Information," below. Please note that doing so may negatively impact your experience using the Sites or Service, as some features may not work properly.
We implement appropriate technical and organizational measures to protect the information we collect and store, and require all agents who carry out our processing on our behalf to do the same. Unfortunately, no security measures are 100% foolproof, and as such no network or system (including ours) can be guaranteed to be 100% secure against destruction, loss, alteration, unauthorized disclosure of, or access to information we collect and store. If you believe your information may not be secure for any reason, please contact us immediately at support@hcaptcha.com.
To the fullest extent permitted by law, the Site and the Service (and any other associated services, information, data, features, and other content or materials) are provided on an “as-is” and “as-available” basis. To the fullest extent permitted by law, IMI excludes all warranties, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
You may access, correct, amend, or delete certain Personal Information you may have provided us through your Integrator, Customer, or Accessibility User account (if you are an Integrator, Customer, or Accessibility User). If you are unable to do so, or have any questions about Personal Information we have collected and/or shared about you, or would like to withdraw your consent for our processing (i.e. entirely delete your account) please contact us at support@hcaptcha.com.
If you would prefer to block cookies or other tracking technologies, most browsers and mobile devices all you to change your settings so as to notify you when you receive cookies or other tracking technologies are being used, and to choose whether or not to accept/allow it. Most browsers also allow you to disable or delete existing cookies or to automatically reject future cookies. You may also use third party tools, including browser plug-ins, to control your cookie preferences. Note, however, that if you disable all cookies, some portions of our Sites may not function properly.
Our Sites and Service are not directed to children under the age of 13 and we do not knowingly collect Personal Information from children under the age of 13. If we learn that we have collected Personal Information of a child under the age 13, we will take reasonable steps to delete such information from our files as soon as is practicable, unless we have a legal obligation to retain it. Please contact us at support@hcaptcha.com if you believe we have any information from or about a child under the age of 13.
Under California Civil Code Section 1789.3, California users are entitled to the following consumer rights notice: California residents may reach the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by mail at 1625 North Market Blvd., Sacramento, CA 95834, or by telephone at (916) 445-1254 or (800) 952-5210.
This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or "CCPA."
For the categories of personal information we have collected from you in the preceding 12 months, please see the "Information We Collect" section above. We collect this information for the business and commercial purposes described in the "How We Use Personal Information" section above. In the preceding 12 months, we have shared the following categories of information with third parties for a business purpose:
The Company does not "sell" (as this term is defined in the CCPA) the personal information we collect. Please refer to the "Third Party Analytics and Tracking Technologies" section above for more information regarding the types of third-party cookies, if any, that we use.
Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any "sales" that may be occurring, as well as the right to not be discriminated against for exercising these rights.
California consumers may make a request pursuant to their rights under the CCPA by contacting us at support@hcaptcha.com. Please note that you must verify your identity and request before further action is taken, such as by providing your government identification. Consistent with California law, you may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government issued identification, and the authorized agent’s valid government issued identification.
Personal Data collected from individuals in the European Economic Area ("EEA") or Switzerland may be transferred, stored and processed by us and our services providers, partners and affiliates in the United States and potentially other countries whose data protection laws may be different to the laws of your country.
IMI's commitment to comply with the Privacy Shield Principles
IMI has self-certified to the Privacy Shield framework. IMI confirms its commitment to comply with the EU-US Privacy Shield and Swiss-U.S. Privacy Shield as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries and Switzerland. IMI has certified that it adheres to each of the Privacy Shield Principles: Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit www.privacyshield.gov.
Accountability for onward transfers
IMI's accountability for Personal Data that it receives under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, IMI remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the Personal Data on its behalf do so in a manner inconsistent with the Principles, unless IMI proves that it is not responsible for the event giving rise to the damage.
Right of access
You have a legal right to request the Personal Data about you held by us. On request, we will provide you with a copy of this information. You also have a right to correct, amend or delete such Personal Data where it is inaccurate or has been processed in violation of the Privacy Shield Principles.
Resolution of disputes and complaint mechanism
In compliance with the Privacy Shield Principles, IMI commits to resolve complaints about your privacy and our collection or use of your Personal Data. If European Union or Swiss citizens have any queries related to the processing of your Personal Data under the Privacy Shield framework, we encourage you to contact us directly in the first instance at: support@hcaptcha.com.
Independent recourse mechanism
For any complaints that cannot be resolved with IMI directly, we have agreed to cooperate with JAMS. If you are unsatisfied with the resolution of your complaint, you may contact JAMS at https://www.jamsadr.com/eu-us-privacy-shield for further information and assistance. These recourse mechanisms are available at no cost to you.
Binding arbitration
A binding arbitration option will also be made available to you in order to address residual complaints not resolved by any other means.
Enforcement
IMI is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).
Disclosure of EU or Swiss Personal Data to public authorities and law enforcement agencies
IMI may be required to share your Personal Data in response to lawful by public authorities, including to meet national security and law enforcement requirements.
Personal Information
With respect to EU data subjects, the term "personal information" as used in this Privacy Policy is equivalent to "personal data" as defined in the European Union General Data Protection Regulation (GDPR).
Sensitive Data
Some of the information you provide us may constitute sensitive data as defined in the GDPR (also referred to as special categories of personal data), including identification of your race or ethnicity on government-issued identification documents.
Legal Bases for Processing
We only use your personal information as permitted by law. We are required to inform you of the legal bases of our processing of your personal information, which are described below. If you have questions about the legal bases under which we process your personal information, contact us at support@hcaptcha.com.
Processing Purposes
To communicate with you
To optimize our platform
For compliance, fraud prevention, and safety
To provide our service
Legal Basis
These processing activities constitute our legitimate interests. We attempt to consider and balance any potential impacts on you (both positive and negative) and your rights before we process your personal information for our legitimate interests. We do not use your personal information for activities where our interests are overridden by any adverse impact on you (unless we have your consent or are otherwise required or permitted to by law).
Processing Purpose
With your consent
Legal Basis
Where our use of your personal information is based upon your consent, you have the right to withdraw it at any time in the manner indicated in the Service or by contacting us at support@hcaptcha.com.
Your Rights
Under the GDPR, you have certain rights regarding your personal information. You may ask us to take the following actions in relation to your personal information that we hold:
Opt-out
Stop sending you direct marketing communications which you have previously consented to receive. We may continue to send you Service-related and other non-marketing communications.
Access
Provide you with information about our processing of your personal information and give you access to your personal information.
Correct
Update or correct inaccuracies in your personal information.
Delete
Delete your personal information.
Transfer
Transfer a machine-readable copy of your personal information to you or a third party of your choice.
Restrict
Restrict the processing of your personal information.
Object
Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.
Data Subject Access Rights Requests
We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or response to your requests regarding your personal information, you may contact us at support@hcaptcha.com or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator at this location.
Cross-Border Data Transfer
As described in our "A Note to Customers Outside the United States" section, please be aware that your personal data will be transferred to, processed, and stored in the United States. Data protection laws in the U.S. may be different from those in your country of residence. You consent to the transfer of your information, including personal information, to the U.S. as set forth in this Privacy Policy by visiting our Sites or using our Service.
Use for New Purposes
We may use your personal information for reasons not described in this Privacy Policy, where we are permitted by law to do so and where the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we may notify you and explain the applicable legal basis for that use. If we have relied upon your consent for a particular use of your personal information, we may seek your consent for any unrelated purpose and allow you to terminate your use of the service at that time if you object.
We store your Personal Data securely throughout the life of your account with us. We will only retain your Personal Data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting obligations or to resolve disputes. The criteria we use to determine storage periods include the applicable contractual provisions that are in force, legal statutory limitation periods, applicable regulatory requirements, and industry standards.
While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal data are described below.
Contact information for marketing purposes is retained on an ongoing basis until you un-subscribe. Thereafter we will add your details to our suppression list indefinitely. Email information collected from Accessibility Users will never be used for marketing purposes.
Records of communications with you (e.g. support tickets opened via email or Twitter) may be kept indefinitely.
Information collected via technical means such as cookies, webpage counters and other analytics tools is discarded as soon as practical, but may be kept for a limited period of up to one year from expiry of the cookie, typically in a de-identified and aggregated form unless we detect potential abuse of our service, in which case we will retain that information to aid us in preventing future abuse. We are unable to link this anonymized and aggregated information to you, your household, an IP address, or any personal information based on the information stored.
If you have any questions about this Privacy Policy, please contact us at support@hcaptcha.com.
Any information that we collect is subject to the Privacy Policy in effect at the time such information is collected. We may, however, revise the Privacy Policy from time to time. If a revision is material, as determined solely by us, we will notify you, for example via email. The current version will always be posted to our Privacy Policy page.
If you have any questions about this Privacy Policy, please contact us at support@hcaptcha.com.