Privacy Policy

1. Personal data we collect

Your account details, an identity check run by Persona, your submitted tasks and reviews, payment and tax details, two preference cookies, a session cookie, server logs, and product analytics with session recordings run by PostHog. No advertising.

Personal data is collected from you directly, automatically from your device, and from third parties.

From you:

• Account data. The name, email address, date of birth, address, and scientific fields Blotdle records when it adds you to the experts list, and any identity, credential, or eligibility information you provide when we verify you.
• Identity verification data. Before you work on a Delivery, our identity verification provider, Persona Identities, Inc. ("Persona"), collects on our behalf a photo of your government-issued identity document, a selfie, the details it reads from the document, such as your name, date of birth, and document number, and the result of comparing the face in your selfie with the photo on the document. Persona may also check those details against other sources, such as government and commercial databases. To decide the outcome of the check, Blotdle's systems read its result from Persona, and that result includes the details Persona read from your document. We keep only the outcome (started, in review, verified, or failed) and Persona's reference for the check, and we store both with your account. Persona keeps the images and the details read from them, and we do not store them. Blotdle staff who administer the check can view the full check in Persona's dashboard.
• Contributions and files. Every task you submit and every file inside it, the note you write to reviewers, and the metadata you enter in the task, which the task guide asks to include your name, email address, organisation, professional profile link, relevant experience, conflicts of interest, and optionally your research advisor and who referred you.
• Review data. Review notes written about your Contributions, dispute correspondence, and the outcome of each review.
• Payment and tax data. The fee recorded for each Accepted Contribution and when it was settled, and any tax form you give us. Your taxpayer identification number and bank details go to Stripe, which collects them during payout onboarding as described in Section 8. From Stripe we keep your Stripe account reference and the date your payouts became ready. When you open your payments page, the Service reads from Stripe the name of your bank, the last four digits of your account number, and the account's country, currency, and type, and shows them to you without storing them.
• Correspondence. Anything you send to the address in Section 13 of this Policy.

Automatically: a session cookie the Service sets when you sign in; two cookies that remember your chosen theme and language; service usage information logged by our hosting provider, such as IP address, browser and device information, the date and time of requests, and the pages requested; and the product analytics, session recordings, and page-view counts described in the next paragraph. The Service uses no advertising cookies, no web beacons in email, and no tracking beyond what is named here.

Product analytics and session recordings. The Service uses PostHog to record how it is used: the pages you view, what you click, the forms you submit, and session recordings that replay what the Service showed on your screen and what you typed into it. Recordings mask what you type into password and email address fields and the text shown in parts of the Service marked private. Everything else you type is recorded, so a recording can include parts of your Contributions, notes, and messages. When you are signed in, PostHog links these events and recordings to your email address. PostHog keeps a random identifier for your browser in a cookie and in your browser's local storage, as described in Section 5. Vercel Web Analytics also counts page views. For each page view it records the page, the referring page, your browser, operating system, device type, and approximate location. It sets no cookies and recognises a visit by a hash of the request, which it discards after 24 hours.

From third parties: when you sign in with Google, we receive your Google account identifier, name, and email address from Google based on your settings there. Persona sends our systems the result of your identity check, including the details it read from your document. We use that result to decide the outcome and keep only the outcome and Persona's reference. The Blotdle team member who invites you supplies your name, email address, and fields. Other experts who review your work supply their notes about it.

Biometric data. The face comparison in the identity check uses biometric identifiers and biometric information as defined in the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Washington's biometric identifiers law, and similar laws, and it is special category data under the GDPR and the UK GDPR. We use it only to confirm that you are the person on your identity document. The first screen of Persona's flow, shown before any image is captured, asks for your consent and explains how the data is retained. Blotdle does not store biometric data itself. Persona keeps it under its retention schedule and our instructions, and permanently destroys it once the purpose of verifying your identity has been met, and in any case no later than three years after your last interaction with Blotdle, whichever comes first, or sooner if the law where you live requires it. If you withdraw your consent or your account is deleted, we instruct Persona to delete it. We do not sell, lease, or trade biometric data or otherwise profit from it, and we disclose it to no one other than Persona, except where the law requires.

Do not put personal data about other people in a Contribution. If a Contribution's data files must include personal data, contact us first at the address in Section 13 of this Policy.

2. How we use personal data

To run the workspace, confirm who you are, review and pay for your work, credit you, keep the Service secure, and build and publish Benchmarks.

We use personal data for the following purposes.

• Service provision. To deliver and update the Service, sign you in, show you the Deliveries you are assigned to, and store your Contributions.
• Identity verification. To confirm that you are the person you say you are before you work on a Delivery, to prevent fraud and duplicate accounts, and to meet our payment and sanctions obligations.
• Review. To route Contributions to reviewers, record review notes, resolve disputes, and run automated and human checks, including with AI tools, on Contributions.
• Business operations. To pay you, keep accounting and tax records, and report payments to tax authorities where required.
• Attribution. To credit you as an author when an Accepted Contribution is published, as described in Section 5 of the Terms of Service.
• Communication. To send confirmations, review outcomes, payment notices, technical notices, security alerts, administrative messages, and notices of changes to the Service or these policies. We do not send marketing email.
• Improving and debugging the Service. To understand how experts use the Service, find and fix errors, and improve it, using the product analytics, session recordings, and page-view counts described in Section 1.
• Safety and security. To promote safety, integrity, and security across the Service, we process personal data, using both automated and, at times, manual techniques for abuse detection, fraud prevention, sanctions screening, and detection of violations of the Terms of Service, including undisclosed AI use.
• Benchmarks. To build, evaluate, publish, and license Benchmarks made from Contributions, and to let Blotdle and its Partners evaluate and improve AI systems, as licensed in the Terms of Service.
• Complying with and resolving legal obligations. Including responding to data subject requests, tax requirements, agreements, and disputes.

When carrying out these activities, Blotdle practices data minimisation and uses the minimum amount of personal data required. We do not make decisions about you by solely automated means that have legal or similarly significant effects; review outcomes are decided by people.

3. Lawful bases for processing (EEA and UK)

If you are in the EEA or the UK, this is the legal basis for each kind of processing.

Blotdle processes personal data in compliance with the GDPR and the UK GDPR, ensuring a lawful basis for each processing activity. Our processing activities fall under these lawful bases:

• Contractual necessity. Processing is required to fulfil our contractual duties to you under the Terms of Service: providing the Service, reviewing your work, paying you, and communicating with you about it. Providing your name, email address, and tax and payment details is necessary for us to accept and pay for Contributions; without them we cannot pay you.
• Legal obligation. We process data when it is necessary to comply with applicable laws, including tax reporting, sanctions screening, and confirming the identity of the people we pay where those laws require it, or to protect the rights, safety, and property of Blotdle, its Partners, experts, or third parties.
• Legitimate interests. We process data for purposes that are in our legitimate interests, such as securing the Service, understanding how it is used and finding and fixing its errors through product analytics and session recordings, verifying your identity, detecting fraud, duplicate accounts, and undisclosed AI use, crediting authors accurately, and building, publishing, and licensing Benchmarks, which includes letting Partners evaluate and improve AI systems. This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms, and you may object as described in Section 9.
• Consent. We process data when you have explicitly consented to such processing, for example when you choose to include your email address or profile link in a task's published metadata. When we rely on consent, you have the right to withdraw it at any time, without affecting earlier processing.
• Special category data. The face comparison in the identity check is biometric data processed to identify you, which the GDPR and the UK GDPR treat as special category data. We rely on your explicit consent for it, which Persona's flow asks for before it captures your selfie. Without it we cannot verify you, and you cannot work on a Delivery.

4. How we share personal data

With Blotdle staff and reviewers, with the providers that run the Service, with Partners who receive Benchmarks, and with authorities when the law requires. We never sell it.

We may share personal data with the following recipients.

• Blotdle staff and reviewers. Blotdle admins, engineers, and the experts who review your work see your name, email address, Contributions, and review notes. A new submission is announced in Blotdle's internal team chat with your name and email address so that a reviewer can pick it up.
• Partners and the public. Accepted Contributions are published and licensed as described in Section 5 of the Terms of Service, with the author metadata described there.
• Subprocessors and service providers. We use vendors to provide services on our behalf, including hosting, database and file storage, authentication, identity verification, product analytics and session recording, team chat, payment, and tax reporting. They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information. The current providers are listed in Section 8.
• Abuse and fraud prevention entities. We may disclose personal data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on the Service, or to protect the safety of Blotdle and our experts.
• Competent authorities. We may disclose personal data to authorized law enforcement, regulators, courts, tax authorities, or other public authorities in response to lawful requests or to protect our rights and safety.
• Corporate transaction entities. We might disclose personal data within the limits of the law and in accordance with this Privacy Policy for strategic business transactions such as a sale, financing, reorganisation, or merger.
• With your direction. Where you ask us to share it.

We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act.

5. Cookies

Four cookies: one to keep you signed in, one for your theme, one for your language, and one for PostHog's product analytics. No advertising cookies.

The Service uses cookies and your browser's local storage to provide, secure, and improve the Service. We use them to (i) keep you logged in, (ii) remember your preferences, and (iii) let PostHog recognise your browser for the product analytics and session recordings described in Section 1. We set no social media or advertising cookies, and we do not use pixel tags in email.

• Session cookie. Set by the Service when you sign in. A session cookie stays on your device until it expires or you sign out.
• theme. Remembers whether you chose the day or night theme. A persistent cookie that stays for one year unless you delete it.
• locale. Remembers your chosen language. A persistent cookie that stays for one year unless you delete it.
• PostHog cookie. Named ph_ followed by our PostHog project key and _posthog, set on the blotdle.com domain, with a copy in your browser's local storage. It holds a random identifier for your browser and the current session, and once you sign in, the email address PostHog links your activity to. A persistent cookie that stays for one year unless you delete it.

Vercel Web Analytics sets no cookies.

Many browsers provide cookie controls which let you delete or block cookies and local storage. Blocking the session cookie prevents sign-in. Blocking the PostHog cookie and local storage stops PostHog recognising your browser from one visit to the next. The Service does not change how it behaves in response to a Do Not Track or Global Privacy Control signal from your browser. These choices are specific to the browser you are using.

6. Publication of Accepted Contributions

Accepted tasks are published openly and licensed to AI laboratories. Your name and organisation go with them by default; your email and profile link only if you leave them in.

Accepted Contributions are published as part of a Benchmark under an open licence and are also licensed to Partners, including commercial AI laboratories, as described in the Terms of Service. Some Accepted Contributions are held out and kept private instead.

A published Contribution carries the author name and organisation you entered in its metadata, unless you ask us to omit them before publication. Your email address and profile link are published only as you entered them, and you may ask us to omit them before publication. Once a Benchmark is published, copies may be redistributed by anyone who obtains it, and we cannot recall them, so write only what you are willing to make public.

Held-out Contributions are shared with Partners under confidentiality terms together with the same author metadata.

7. International data transfers

Your data is stored in the United States. Transfers from the EEA, UK, and Switzerland rely on the Standard Contractual Clauses.

Blotdle stores and processes personal data in the United States and in other countries where Blotdle or its subprocessors have operations. We transfer personal data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. When we engage in such transfers, we rely on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, together with the UK International Data Transfer Addendum where applicable, to help protect your rights and enable these protections to travel with your data. You may ask for a copy of the relevant safeguards at the address in Section 13 of this Policy.

Blotdle is working to appoint representatives in the European Union and the United Kingdom under Article 27 of the GDPR and will publish their details in this Policy once appointed.

8. Service providers, security, and retention

Who hosts your data, how it is protected, and how long we keep each kind.

The Service runs on the following providers.

• Cloudflare, Inc. hosts our database, which holds account data, sign-in and session data, applications, Contributions, review records, chat messages, and payment records.
• Neon (Databricks, Inc.) hosts our object storage, which holds the files you upload, such as Contribution bundles, attachments, and résumés, and keeps a copy of our former database until we delete it.
• Vercel Inc. hosts and serves the application, keeps the service usage logs described in Section 1, and counts page views through Vercel Web Analytics.
• PostHog, Inc. receives the product analytics events and session recordings described in Section 1, linked to your email address when you are signed in, and stores them in the United States.
• Google LLC provides sign-in when you choose Google.
• Persona Identities, Inc. runs the identity check described in Section 1. It collects and stores your identity document images, your selfie, the details read from the document, and the biometric comparison, in the United States. Blotdle's systems read the result of the check from Persona to decide its outcome, and keep only the outcome and Persona's reference.
• Stripe, Inc. and its affiliates run payout onboarding and send your payments. Stripe collects your legal name, tax information, bank details, and the other information it needs to verify you and pay you.
• A team chat provider receives the submission announcement described in Section 4, and, where applicable, a tax reporting provider processes the tax details you give us. We will tell you which providers these are on request.

Blotdle uses appropriate administrative, technical, and physical security controls to protect your personal data. Data is encrypted in transit, our providers encrypt it at rest, access is restricted to staff and reviewers who need it, and administrative actions are logged. No system is perfectly secure, and you should keep your sign-in account and mailbox protected. If we learn of a breach affecting your personal data we will notify you and any regulator as the law requires.

We retain your personal data as long as your account is active and as needed to fulfil contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The retention duration depends on the purpose of collection and any legal obligations. Specifically: account data is kept while you are on the experts list and for three years afterwards; the Persona reference and the outcome of your identity check are kept with your account and deleted when your account is deleted; the identity verification data Persona holds is kept and destroyed as described in Section 1; Accepted Contributions and their review records are kept indefinitely, because a published Benchmark must remain auditable and its authorship traceable; unaccepted Contributions and their review records are deleted within two years after your last activity, except where material from them has been incorporated into a Benchmark; payment and tax records are kept for as long as tax and accounting law requires, typically seven years; service usage logs are retained by our hosting provider for a limited period, typically no more than 30 days; product analytics events and session recordings are kept by PostHog for the retention period set in our PostHog account and then deleted; correspondence is kept for as long as needed to resolve the matter and for two years afterwards. When a retention period ends we delete or anonymise the data, though some information may remain in encrypted backups for a limited time. Published Benchmarks and copies held by others are outside our control.

9. Your privacy rights

Depending on where you live, you can ask to see, correct, delete, or export your data, object to some processing, and complain to a regulator.

Depending on your residence location, you may have specific legal rights regarding your personal data:

• The right to access the data collected about you.
• The right to request detailed information about the specific types of personal data we have collected over the past 12 months, including data disclosed for business purposes.
• The right to rectify or update inaccurate or incomplete personal data under certain circumstances.
• The right to erase or limit the processing of your personal data under specific conditions.
• The right to object to the processing of your personal data, as allowed by applicable law, including processing based on our legitimate interests.
• The right to withdraw consent, where processing is based on your consent.
• The right to receive your collected personal data in a structured, commonly used, and machine-readable format to facilitate its transfer to another company, where technically feasible.

To exercise these rights, please send an email to founders@blotdle.com with "Privacy" in the subject line and follow the instructions provided. To verify your identity for security, we will ask you to confirm the request from the email address on the experts list and, for requests to delete or to receive specific pieces of data, we may request extra information that matches our records before addressing your request. You may designate an authorised agent to make a request on your behalf; please ensure they have your signed permission or power of attorney as required.

We respond within one month under the GDPR, extendable by two months for complex requests, and within 45 days under United States state privacy laws, extendable by a further 45 days, and we will tell you if we need an extension. Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims, and that Accepted Contributions and their authorship records are licensed to us irrevocably and may already be published, so a deletion request removes your account data and unaccepted work but not published Benchmarks.

Depending on your region, you have the right to complain to your local data protection authority. In the United Kingdom that is the Information Commissioner's Office. We will not treat you differently for exercising any of these rights.

10. United States state disclosures

The disclosures California and other US state privacy laws require.

These rights are common to the US state privacy laws: the right to know what personal information we have collected about you and to correct inaccurate information; the right to know the categories of recipients, which are the service providers and other recipients in Section 4; the right to request deletion, barring exceptions such as where we are required to retain data to comply with legal obligations, detect fraud, investigate violations of the Terms of Service, or rectify security issues; the right to a timely response, with two free requests in any 12-month period and a response within 45 days, extendable by an additional 45 days in complex cases; and non-discrimination for exercising any of these rights.

We also make the following disclosures for purposes of compliance with California privacy law. We collected the following categories of personal information in the last 12 months: identifiers and contact information; professional and employment-related information; commercial information, namely payment records; internet or other electronic network activity information, namely service usage logs, product analytics events, session recordings, and page-view counts; and the contents of Contributions and correspondence. We collected sensitive personal information consisting of government identification numbers and financial account information, used only to pay you and meet tax obligations, and, through Persona, images of your government identity document and biometric information, used only to verify your identity, and we do not use or disclose it for any purpose that would give rise to the right to limit. The sources of personal information are directly from you, automatically from your device, and from the third parties named in Section 1. The business purposes are those summarised in Section 2. We disclosed each of these categories for a business purpose to the service providers and other recipients described in Section 4. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months.

11. Minors

The Service is for adults only.

The Service is not intended for individuals under the age of 18. We do not intentionally gather personal data from such individuals. If you become aware that a minor has provided us with personal data, please notify us and we will remove it.

12. Changes to this Policy

We will give at least 30 days' notice of material changes.

Blotdle may periodically revise this Privacy Policy. If there are material changes to the Policy, we will provide at least 30 days' prior notice by updating the Service or sending an email to the address on the experts list. We will refresh the effective date at the top of this page whenever we change it.

13. Contact and translations

How to reach us, and which language version controls.

Contact us about this Policy, or to exercise your rights, at founders@blotdle.com. Our postal address is available on request.

This Policy is written in English. In the event of any conflict, uncertainty, or apparent inconsistency between any translation and the English version, the English version is the controlling version.