Privacy Policy

1. Personal data we collect

Your account details, your submitted tasks and reviews, payment and tax details, two preference cookies, a session cookie, and server logs. No analytics, no advertising.

Personal data is collected from you directly, automatically from your device, and from third parties.

From you:

• Account data. The name, email address, and scientific fields Blotdle records when it adds you to the experts list, and any identity, credential, or eligibility information you provide when we verify you.
• Contributions and files. Every task you submit and every file inside it, the note you write to reviewers, and the metadata you enter in the task, which the task guide asks to include your name, email address, organisation, professional profile link, relevant experience, conflicts of interest, and optionally your research advisor and who referred you.
• Review data. Review notes written about your Contributions, dispute correspondence, and the outcome of each review.
• Payment and tax data. The fee recorded for each Accepted Contribution and when it was settled, and the tax forms and payment details you give us so we can pay you, including your taxpayer identification number and bank or payment account details.
• Correspondence. Anything you send to the address in Section 13.

Automatically: a session cookie set by our authentication provider when you sign in; two cookies that remember your chosen theme and language; and service usage information logged by our hosting provider, such as IP address, browser and device information, the date and time of requests, and the pages requested. The Service uses no analytics products, no advertising cookies, no web beacons in email, and no tracking beyond what is named here.

From third parties: when you sign in with Google, we receive your Google account identifier, name, and email address from Google based on your settings there. The Blotdle team member who invites you supplies your name, email address, and fields. Other experts who review your work supply their notes about it.

Do not put personal data about other people in a Contribution. If a Contribution's data files must include personal data, contact us first at the address in Section 13.

2. How we use personal data

To run the workspace, review and pay for your work, credit you, keep the Service secure, and build and publish Benchmarks.

We use personal data for the following purposes.

• Service provision. To deliver and update the Service, sign you in, show you the Deliveries you are assigned to, and store your Contributions.
• Review. To route Contributions to reviewers, record review notes, resolve disputes, and run automated and human checks, including with AI tools, on Contributions.
• Business operations. To pay you, keep accounting and tax records, and report payments to tax authorities where required.
• Attribution. To credit you as an author when an Accepted Contribution is published, as described in Section 6.
• Communication. To send confirmations, review outcomes, payment notices, technical notices, security alerts, administrative messages, and notices of changes to the Service or these policies. We do not send marketing email.
• Safety and security. To promote safety, integrity, and security across the Service, we process personal data, using both automated and, at times, manual techniques for abuse detection, fraud prevention, sanctions screening, and detection of violations of the Terms of Service, including undisclosed AI use.
• Benchmarks. To build, evaluate, publish, and license Benchmarks made from Contributions, and to let Blotdle and its Partners evaluate and improve AI systems, as licensed in the Terms of Service.
• Complying with and resolving legal obligations. Including responding to data subject requests, tax requirements, agreements, and disputes.

When carrying out these activities, Blotdle practices data minimisation and uses the minimum amount of personal data required. We do not make decisions about you by solely automated means that have legal or similarly significant effects; review outcomes are decided by people.

3. Lawful bases for processing (EEA and UK)

If you are in the EEA or the UK, this is the legal basis for each kind of processing.

Blotdle processes personal data in compliance with the GDPR and the UK GDPR, ensuring a lawful basis for each processing activity. Our processing activities fall under these lawful bases:

• Contractual necessity. Processing is required to fulfil our contractual duties to you under the Terms of Service: providing the Service, reviewing your work, paying you, and communicating with you about it. Providing your name, email address, and tax and payment details is necessary for us to accept and pay for Contributions; without them we cannot pay you.
• Legal obligation. We process data when it is necessary to comply with applicable laws, including tax reporting and sanctions screening, or to protect the rights, safety, and property of Blotdle, its Partners, experts, or third parties.
• Legitimate interests. We process data for purposes that are in our legitimate interests, such as securing the Service, detecting fraud and undisclosed AI use, crediting authors accurately, and building, publishing, and licensing Benchmarks, which includes letting Partners evaluate and improve AI systems. This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms, and you may object as described in Section 9.
• Consent. We process data when you have explicitly consented to such processing, for example when you choose to include your email address or profile link in a task's published metadata. When we rely on consent, you have the right to withdraw it at any time, without affecting earlier processing.

4. How we share personal data

With Blotdle staff and reviewers, with the providers that run the Service, with Partners who receive Benchmarks, and with authorities when the law requires. We never sell it.

We may share personal data with the following recipients.

• Blotdle staff and reviewers. Blotdle admins, engineers, and the experts who review your work see your name, email address, Contributions, and review notes. A new submission is announced in Blotdle's internal team chat with your name and email address so that a reviewer can pick it up.
• Partners and the public. Accepted Contributions are published and licensed as described in Section 6, with the author metadata described there.
• Subprocessors and service providers. We use vendors to provide services on our behalf, including hosting, database and file storage, authentication, team chat, payment, and tax reporting. They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information. The current providers are listed in Section 8.
• Abuse and fraud prevention entities. We may disclose personal data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on the Service, or to protect the safety of Blotdle and our experts.
• Competent authorities. We may disclose personal data to authorized law enforcement, regulators, courts, tax authorities, or other public authorities in response to lawful requests or to protect our rights and safety.
• Corporate transaction entities. We might disclose personal data within the limits of the law and in accordance with this Privacy Policy for strategic business transactions such as a sale, financing, reorganisation, or merger.
• With your direction. Where you ask us to share it.

We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act.

5. Cookies

Three cookies: one to keep you signed in, one for your theme, one for your language. Nothing else.

The Service uses cookies to provide and secure the Service. We use them to (i) keep you logged in and (ii) remember your preferences. We set no analytics, social media, or advertising cookies, and we do not use pixel tags in email.

• Session cookie. Set by our authentication provider when you sign in. A session cookie stays on your device until it expires or you sign out.
• theme. Remembers whether you chose the day or night theme. A persistent cookie that stays for one year unless you delete it.
• locale. Remembers your chosen language. A persistent cookie that stays for one year unless you delete it.

Many browsers provide cookie controls which let you delete or block cookies. Blocking the session cookie prevents sign-in. Because the Service sets no non-essential cookies and does no tracking, a Do Not Track or Global Privacy Control signal from your browser changes nothing about how it behaves. These choices are specific to the browser you are using.

6. Publication of Accepted Contributions

Accepted tasks are published openly and licensed to AI laboratories. Your name and organisation go with them by default; your email and profile link only if you leave them in.

Accepted Contributions are published as part of a Benchmark under an open licence and are also licensed to Partners, including commercial AI laboratories, as described in the Terms of Service. Some Accepted Contributions are held out and kept private instead.

A published Contribution carries the author name and organisation you entered in its metadata, unless you ask us to omit them before publication. Your email address and profile link are published only as you entered them, and you may ask us to omit them before publication. Once a Benchmark is published, copies may be redistributed by anyone who obtains it, and we cannot recall them, so write only what you are willing to make public.

Held-out Contributions are shared with Partners under confidentiality terms together with the same author metadata.

7. International data transfers

Your data is stored in the United States. Transfers from the EEA, UK, and Switzerland rely on the Standard Contractual Clauses.

Blotdle stores and processes personal data in the United States and in other countries where Blotdle or its subprocessors have operations. We transfer personal data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. When we engage in such transfers, we rely on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, together with the UK International Data Transfer Addendum where applicable, to help protect your rights and enable these protections to travel with your data. You may ask for a copy of the relevant safeguards at the address in Section 13.

Blotdle is working to appoint representatives in the European Union and the United Kingdom under Article 27 of the GDPR and will publish their details in this Policy once appointed.

8. Service providers, security, and retention

Who hosts your data, how it is protected, and how long we keep each kind.

The Service runs on the following providers.

• Neon (Databricks, Inc.) hosts our Postgres database, object storage, and authentication service, which together hold account data, Contributions, review records, payment records, and session data.
• Vercel Inc. hosts and serves the application and keeps the service usage logs described in Section 1.
• Google LLC provides sign-in when you choose Google.
• A team chat provider receives the submission announcement described in Section 4, and a payment provider and, where applicable, a tax reporting provider process the payment and tax details you give us. We will tell you which providers these are on request.

Blotdle uses appropriate administrative, technical, and physical security controls to protect your personal data. Data is encrypted in transit, our providers encrypt it at rest, access is restricted to staff and reviewers who need it, and administrative actions are logged. No system is perfectly secure, and you should keep your sign-in account and mailbox protected. If we learn of a breach affecting your personal data we will notify you and any regulator as the law requires.

We retain your personal data as long as your account is active and as needed to fulfil contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The retention duration depends on the purpose of collection and any legal obligations. Specifically: account data is kept while you are on the experts list and for three years afterwards; Accepted Contributions and their review records are kept indefinitely, because a published Benchmark must remain auditable and its authorship traceable; unaccepted Contributions and their review records are deleted within two years after your last activity, except where material from them has been incorporated into a Benchmark; payment and tax records are kept for as long as tax and accounting law requires, typically seven years; service usage logs are retained by our hosting provider for a limited period, typically no more than 30 days; correspondence is kept for as long as needed to resolve the matter and for two years afterwards. When a retention period ends we delete or anonymise the data, though some information may remain in encrypted backups for a limited time. Published Benchmarks and copies held by others are outside our control.

9. Your privacy rights

Depending on where you live, you can ask to see, correct, delete, or export your data, object to some processing, and complain to a regulator.

Depending on your residence location, you may have specific legal rights regarding your personal data:

• The right to access the data collected about you.
• The right to request detailed information about the specific types of personal data we have collected over the past 12 months, including data disclosed for business purposes.
• The right to rectify or update inaccurate or incomplete personal data under certain circumstances.
• The right to erase or limit the processing of your personal data under specific conditions.
• The right to object to the processing of your personal data, as allowed by applicable law, including processing based on our legitimate interests.
• The right to withdraw consent, where processing is based on your consent.
• The right to receive your collected personal data in a structured, commonly used, and machine-readable format to facilitate its transfer to another company, where technically feasible.

To exercise these rights, please send an email to founders@blotdle.com with "Privacy" in the subject line and follow the instructions provided. To verify your identity for security, we will ask you to confirm the request from the email address on the experts list and, for requests to delete or to receive specific pieces of data, we may request extra information that matches our records before addressing your request. You may designate an authorised agent to make a request on your behalf; please ensure they have your signed permission or power of attorney as required.

We respond within one month under the GDPR, extendable by two months for complex requests, and within 45 days under United States state privacy laws, extendable by a further 45 days, and we will tell you if we need an extension. Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims, and that Accepted Contributions and their authorship records are licensed to us irrevocably and may already be published, so a deletion request removes your account data and unaccepted work but not published Benchmarks.

Depending on your region, you have the right to complain to your local data protection authority. In the United Kingdom that is the Information Commissioner's Office. We will not treat you differently for exercising any of these rights.

10. United States state disclosures

The disclosures California and other US state privacy laws require.

These rights are common to the US state privacy laws: the right to know what personal information we have collected about you and to correct inaccurate information; the right to know the categories of recipients, which are the service providers and other recipients in Section 4; the right to request deletion, barring exceptions such as where we are required to retain data to comply with legal obligations, detect fraud, investigate violations of the Terms of Service, or rectify security issues; the right to a timely response, with two free requests in any 12-month period and a response within 45 days, extendable by an additional 45 days in complex cases; and non-discrimination for exercising any of these rights.

We also make the following disclosures for purposes of compliance with California privacy law. We collected the following categories of personal information in the last 12 months: identifiers and contact information; professional and employment-related information; commercial information, namely payment records; internet or other electronic network activity information, namely service usage logs; and the contents of Contributions and correspondence. We collected sensitive personal information consisting of government identification numbers and financial account information, used only to pay you and meet tax obligations, and we do not use or disclose it for any purpose that would give rise to the right to limit. The sources of personal information are directly from you, automatically from your device, and from the third parties named in Section 1. The business purposes are those summarised in Section 2. We disclosed each of these categories for a business purpose to the service providers and other recipients described in Section 4. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months.

11. Minors

The Service is for adults only.

The Service is not intended for individuals under the age of 18. We do not intentionally gather personal data from such individuals. If you become aware that a minor has provided us with personal data, please notify us and we will remove it.

12. Changes to this Policy

We will give at least 30 days' notice of material changes.

Blotdle may periodically revise this Privacy Policy. If there are material changes to the Policy, we will provide at least 30 days' prior notice by updating the Service or sending an email to the address on the experts list. We will refresh the effective date at the top of this page whenever we change it.

13. Contact and translations

How to reach us, and which language version controls.

Contact us about this Policy, or to exercise your rights, at founders@blotdle.com. Our postal address is available on request.

This Policy is written in English. In the event of any conflict, uncertainty, or apparent inconsistency between any translation and the English version, the English version is the controlling version.