Privacy Notice
Effective Date: November 8, 2019
Last Updated: October 4, 2024
Please note that before engaging a new service provider, we subject it to security and privacy compliance review and onboarding processes to ensure the safe and compliant processing of your personal data. Transfers of your personal data to Labelbox are protected in multiple ways, including through the obligations in the Standard Contractual Clauses that we include in our Data Protection Agreements with third-party vendors and customers, and supplementary measures implemented to protect Customer Personal Data outlined in our Data Transfer Impact Assessment, and our self-certification with the Department of Commerce’s Data Privacy Framework (DPF). Please see the “Supplemental Notice for EEA, UK, and Switzerland Residents” section below and our Data Transfer Impact Assessment for further details regarding the safe transfer of your personal data.
Third-Party Responsibilities – Each third party that we share personal information with is responsible for maintaining its own privacy notice and practices related to the use and protection of personal information. Labelbox requires third-party service providers acting on our behalf or with whom we share personal information to also provide appropriate security measures under industry standards. We will always ensure that any third parties with whom we share personal information are subject to privacy and security obligations consistent with this Notice and applicable laws.
Legal, Regulatory, and Compliance Purposes – We may share your information as required by law, such as responding to lawful requests by public authorities, including to meet national security or law enforcement requirements, investigate fraud, comply with a subpoena, bankruptcy proceedings, or similar legal process.
Sale, Merger, or Acquisition – In the event we sell or transfer all or a portion of our business or assets, we will use reasonable efforts to direct the transferee to use your personal information in a manner that is consistent with the terms in this Notice.
INTRODUCTION
At Labelbox Inc. (“Labelbox,” “us,” or “we”), we respect and protect the privacy of our customers and individuals who use our website, products, and services. Please read this Privacy Notice (“Notice”) carefully to understand how we collect, use, store, share, process, and protect personal information across our website, products, and services. This Notice also describes the rights and choices that individuals have with respect to their personal information, and how to contact Labelbox to learn more about our privacy practices.1. ABOUT LABELBOX
Founded in 2018, Labelbox is an enterprise data solution used to train machine learning models. Our Artificial Intelligence (“AI”) enabled labeling tools, partners, and Application Programming Interface (“API”) help developers and organizations annotate their data.2. SCOPE AND APPLICABILITY
This Notice describes how we collect, use, store, share, protect, and otherwise process personal information across Labelbox products, services, the Labelbox website at www.labelbox.com (“Site”), and through other standard business practices (collectively, “Services”). For the purposes of this Notice, personal information means any information relating to an identified or identifiable individual. Examples of personal information include name, email address, and phone number. This Notice applies to all Labelbox prospective and current customers, including free tier and paying customers that use our Services. This Notice also applies to our customers’ end-users, partners, and other individuals that we collect personal information from through the course of providing our Services and operating our Site. This Notice does not apply to Labelbox employee and job applicant personal information.3. PERSONAL INFORMATION WE COLLECT
We collect a limited amount of personal information from individuals through your use of our Services, and otherwise with your consent. In some cases, we receive information directly from you, such as your name and email address when you sign up for our Services. In other cases, we receive information through your use of our Services, or from third parties. We collect different types of personal information in the situations described below.- Registration and Account Information – When you sign up for a Labelbox account, we collect your name, phone number, email address, and company role/title, username, and password. You provide this information to us directly during the account registration process.
- Product Demonstrations – When you request a product demonstration through our Site, we collect your name, company email address, job title, and phone number, and other company-related information.
- Customer Support – When users of our Services submit support issues when using our Services, we collect their email and customer support issue details.
- Customer and Business Partner Information – We collect personal information from individuals working for our customers or business partners, including suppliers, vendors, and other partners. This information includes name, job title, department and organization name, business email, business mailing addresses, and business phone number.
- Third Parties – We collect information about you from certain third-party services for marketing purposes. We receive this information from sales intelligence software firms and publicly available resources, such as LinkedIn.
- Marketing Activities – We collect personal information from individuals when we attend events, conferences, and other business meetings. This includes business contact information such as name, email address, and phone number.
- Browser and Device Information – We automatically collect information from users of our Services and Site visitors, including unique device identification numbers, operating system version, browser type, pages viewed, links clicked, IP address, date and time of Site visit, and the number of times you return to our Site.
4. HOW WE USE PERSONAL INFORMATION
We use collected personal information to: Communicate with you – We may contact you to respond to your inquiries, requests, and/or send important notices via email or our live chat service on our Site. This includes, for example, providing you with customer support or informing you about new features and updates to our Services. Provide our Services – We use collected information to register, administer, and manage your account, verify your identity, and provide our Services to users. We may also use your information to diagnose and resolve issues with our Site or Services. Market our Services – We use your collected information to market our Services, such as to send you email communications about our products and offerings. To learn more about how we collect information when you visit our Site, see our Cookie Notice. Comply with the law – We use your information as needed to carry out appropriate compliance and/or security checks, such as when we need to enforce our contracts and agreements with our customers or comply with applicable law enforcement obligations.5. HOW WE SHARE PERSONAL INFORMATION
We disclose your personal information only with selected recipients for specific purposes, including:- Service Providers and Other Third Parties – We use a limited number of third-party service providers to assist us in making our Services available to you. We share personal information with the following third parties, business partners, vendors, service providers, and suppliers, as well as consultants and Workforce Partners, who need access to your information to assist us with providing our Services. Labelbox does not share personal information with third parties for direct marketing purposes.
| Service provider. | Activities | Location |
|---|---|---|
| Amazon Web Services | Application AI inference | USA |
| Anthrophic | Application AI inference | USA |
| Auth0 | Identity management | USA |
| BigQuery by Google | Application data warehouse and analytics | USA |
| Census Data | Data warehouse connector | USA |
| CloudAMQP | Application queue | USA |
| Cloudflare | Application CDN | USA |
| Datadog | Devops software | USA |
| DocuSign | Electronic signature and contract solution | USA |
| Elastic | Application text search | USA |
| Google Cloud Platform | Cloud storage | USA |
| Intercom | Customer communication service | USA |
| Jira Service Management by Atlassian | Customer support and service queue management | USA |
| LaunchDarkly | Operations and service maintenance | USA |
| Marketo | Marketing email service | USA |
| Microsoft Azure | Application AI inference | USA |
| OpenAI | Application AI inference | USA |
| Redis | Application memory cache | USA |
| Replicate | Application AI inference | USA |
| Salesforce | Customer relationship management | USA |
| Stripe | Payment processing | USA |
| Fireworks AI | Application AI Inference | USA |
| Together AI | Application AI Inference | USA |
6. HOW WE PROTECT INFORMATION
We use reasonable and appropriate physical, technical, and administrative safeguards to prevent unauthorized use, access, loss, misuse, alteration, or destruction of your personal information. We periodically review our policies and procedures to ensure they are effectively upholding our commitment to protecting your personal information. We also require third-party service providers, who may act on our behalf or with whom we share your information, to also demonstrate appropriate security measures in line with industry standards. Notwithstanding our security safeguards, it is impossible to guarantee absolute security in all situations. If you have any questions about the security of our Services, please contact us at privacy@labelbox.com.7. DATA STORAGE AND RETENTION
Labelbox uses U.S.-based data hosting service providers to store the data we collect from individuals and employ appropriate technical measures to secure this data. We maintain strict privacy and security compliance practices to ensure that your personal information is protected from unauthorized access and against unlawful processing. Please visit our Privacy & Security Program page for more information on our specific controls to safeguard your information.8. YOUR CHOICES AND RIGHTS
Where appropriate or legally required, we will describe how we use your personal information, so you can make choices about how your data is used. You can notify us of your preferences during the information collection process and change your selection at any time by contacting us directly.- Marketing emails – You can choose to stop receiving marketing emails by following the unsubscribe instructions included in these emails, or by contacting us at privacy@labelbox.com.
- Account information – You can contact us at privacy@labelbox.com to deactivate or delete data associated with your Labelbox account.
Accessing, Correcting, and Updating Your Information
You may have certain rights in connection with the personal information we obtain about you. To update your preferences, correct your information, limit the communications you receive from us, or submit a request to exercise your data rights, contact us as specified in the “Contact Us” section below. As required by applicable law, including provisions in the General Data Protection Regulation (“GDPR”) and other privacy laws and regulations, you may have the right to:- Request access to certain personal information we maintain about you;
- Request that we update, correct, amend personal information where it is inaccurate or incomplete;
- Request to erase, restrict use, or object to processing of certain personal information; and
- Exercise your right to data portability to request a copy of your data.
Exercising Your Rights
If you wish to exercise any of these rights above, please visit our website (www.labelbox.com) and submit a request using our online support function or contact us as specified in the “Contact Us” section below. To help protect your privacy and maintain security, we take steps to verify your identity before granting you access to your information. We may also decline your access request, but if we do, we will provide an explanation for our decision. Please note that your request and choices may be limited in certain cases: for example, if fulfilling your request would reveal information about another individual or you ask to delete information that we are permitted by law to retain. If you have unresolved concerns, you may have the right to complain to a data protection authority or supervisory authority in the country where you live, where you work, or where you feel your rights were infringed. If you have any questions, contact us as specified in the “Contact Us” section below.9. COOKIES AND TRACKING TECHNOLOGIES
We use cookies and other similar technologies to collect information about your browsing activities when you navigate through our Site. Cookies help make interactions with our Site easier and faster for you. We also use cookies to analyze trends, administer our Services, and track activity and interactions with our Site. For more information about how we use cookies and to learn how to manage cookies, please see our Cookie Notice. We do not respond to web browser “Do-Not-Track” signals. We do not serve targeted advertisements in our Services at this time.10. SUPPLEMENTAL NOTICE FOR EEA, UK, AND SWITZERLAND RESIDENTS
LEGAL BASES FOR PROCESSING FOR EEA USERSIf If you are an individual from the European Economic Area (“EEA”), we collect and process your personal information only where we have legal basis for doing so under applicable EU laws. The legal basis depends on the Services you use and how you use them. This means we collect and use your personal information only:- To fulfill our contractual obligations to you;
- To operate our business, including to improve and develop our services, for fraud prevention purposes, improve user experience, or other legitimate interest; and/or
- As otherwise in compliance with law.
International Data Transfers
To provide our best-in-class Services, including technical support, we may disclose your personal information to countries outside of your data residence. Specifically, we may transfer the personal information you provide to the United States and other countries where our affiliates, business partners, and service providers are located. Labelbox ensures the protection of your personal information in accordance with this Notice and applicable data protection laws. When sharing the personal information of customers in the European Economic Area, the UK, or Switzerland, we ensure protection through the following mechanisms:- Incorporating both the European Commission-approved Standard Contractual Clauses (SCCs) and the UK-approved International Data Transfer Addendum into Data Protection Agreements (DPAs) with us.
- Implementing SCCs with our third-party service providers, guaranteeing equal or greater data protection under applicable laws;
- Applying supplementary measures to protect personal data as outlined in our Data Transfer Impact Assessment; and
- Upholding certification to the U.S. Department of Commerce’s Data Privacy Framework (DPF). For more details, please refer to the “Data Privacy Framework Certification” section below; and
- Utilizing other appropriate legal mechanisms to safeguard data transfers.
Data Privacy Framework Certification
Labelbox has self-certified its commitment to comply with the Data Privacy Framework Principles (DPF Principles) as established by the U.S. Department of Commerce, and relies on the following frameworks for the processing of personal data transfers in unique data residencies:- The EU-U.S DPF for personal data transfers from the European Union and European Economic Area;
- The UK Extension to the EU-U.S. DPF for personal data transfers from the United Kingdom and Gibraltar; and
- The Swiss-U.S. DPF for personal data transfers from Switzerland.
Onward Transfers
If Labelbox transfers information onward to a third-party service provider acting as Labelbox’s our agent, Labelbox continues to remain liable under the DPF Principles if the agent processes the information in a manner inconsistent with the DPF’s Principles, unless Labelbox is not responsible for the event giving rise to the damage.Complaints
Your concerns are important to us and the avenues for addressing them are readily available. If you have concerns or wish to file a complaint, you have the option to address a data protection authority in your country or region. This applies to the place where you habitually reside, your workplace, or if you believe there has been an alleged breach of applicable data protection law. A comprehensive list of EEA data protection authorities is available. You can also contact the UK Information Commissioner’s Office.11. SUPPLEMENTAL DISCLOSURE FOR UNITED STATES RESIDENTS
This section provides additional details about the personal information we collect about individuals and the rights afforded to them under various applicable U.S. state data protection and privacy laws, including:- The California Consumer Privacy Act (CCPA);
- The Colorado Privacy Act (CPA);
- The Connecticut Data Privacy Act (CTDPA); and
- The Virginia Consumer Data Protection Act (VCDPA).
- Identifiers/Contact information, like your real name, postal address, unique personal identifier, online identifier, internet protocol address, and email address;
- Information under Cal. Civ. Code §1798.80(e), such as your name, address, telephone number, or any financial information;
- Commercial information, such as information related to products or services you have purchased;
- Internet or other electronic network activity information, such as information regarding your interaction with Labelbox Products;
- Geolocation data; such as approximate location data based on your IP address;
- Audio, electronic, visual, or similar information, such as audio recordings of calls with you;
- Inferences drawn on the information above, such as aggregated metrics; and
- Account log-in credentials, allowing access to your account.
Additional Privacy Rights for California Residents
- Non-Discrimination — California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.
- Authorized Agent — Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent, please contact us as set forth below.
- Verification — To protect your privacy, we will take steps to verify your identity before fulfilling your request. When you make a request, we will ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include asking you to log in to your account or verify your email address.