Rigtask Privacy Policy

VERSION 1.0 · EFFECTIVE 12 SEPTEMBER 2026
Privacy Policy
How Rigtask India Private Limited collects, uses, stores, and shares personal data on the contributor portal and website.

Effective 12 September 2026
Last updated 12 September 2026
Applies to rigtask.com, the contributor portal, apply and certification flows, the partner cockpit, and related email or Slack notices.
Does not apply to Deploy8 client contracts, the client work platform’s own policy, or sites we do not control.
Contact privacy@rigtask.com
1. Who we are
Rigtask India Private Limited (also written Rigtask India Private Ltd; “Rigtask”, “we”, “us”) is the contributor company. We run a certified task network for desk annotation and field capture that supplies programs delivered by Deploy8 to robotics and physical-AI customers.
Rigtask is the Data Fiduciary for personal data processed through the Rigtask website and portal. Particulars of incorporation and the registered office are those filed with the Ministry of Corporate Affairs and published at https://rigtask.com/legal.
Deploy8 is a separate company. It is the face a robotics lab signs with. It is not your employer. Where Deploy8 receives personal data from us — for example, to provision you on the client work platform after you pass certification — it does so as described in section 6.
This notice is the itemised notice for the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The Information Technology Act, 2000 and the SPDI Rules, 2011 also apply to the extent they remain in force.
2. Who this policy covers
If you are under 18, do not apply and do not appear in capture. We do not knowingly process children’s data.
3. Personal data we collect — itemised
We collect only what the portal needs to identify you, certify you, give you work you are allowed to see, pay accepted hours, and keep an audit trail. The portal is not a video editor. Raw media bytes live on the client work platform, not in Rigtask.
3.1 You give us
3.2 We generate
3.3 Devices and logs
On the website and portal we collect IP address, user-agent, approximate time zone, pages viewed, and security logs (failed logins, token use). We do this to keep the account safe and to debug the product. The current product does not use GPS tracking and does not ship a native mobile app. If a later field companion requests camera, microphone, or location, we will update this section before that binary ships.
3.4 We do not collect here
Pixels of your clips or labels — those stay on the client work platform.
Raw client Word files in the contributor UI.
The client’s brand name, shown to you as a task.
Biometric templates for identification. Hands-and-tools footage is work product, not a fingerprint system.
Contacts, SMS, call logs, or precise location in the current product.
Payment-card PAN or CVV. Payouts go out over UPI or a bank file.
4. Why we process it
Each purpose below is a specified purpose. We do not reuse contributor data to train a public foundation model, to sell a marketing list, or to score you for a loan.
5. Cookies and similar tech
The marketing landing page and the portal use:
Strictly necessary cookies — session, CSRF, language, load-balancer.
Preference cookies — city or track you picked on the landing page.
First-party measurement so we can read cost-per-cert-pass. We do not run a cross-site advertising graph on contributor traffic.
You can refuse non-essential cookies on the banner. The portal will not work with all cookies blocked. Ads that brought you here live on those platforms and are governed by them.
6. Who we share with
We do not sell personal data. We share it only as follows.
A partner organisation does not receive client brand, raw specifications, other suppliers, or the global mix. An individual contributor does not receive another person’s payout file.
7. Transfers outside India
The product is India-first. Primary records sit in India or in a region named in the staff runbook. Some vendors (cloud, email, Slack) may process a copy outside India.
Under the DPDP Act, transfer of personal data outside India is permitted except to a country or territory notified as restricted. We will not transfer to a restricted territory.
8. How long we keep it
We keep personal data only as long as the specified purpose — and any law that outlives it — requires. Where the Rules require it, we will notify you at least 48 hours before we erase data we no longer need.
Erasure is limited where a law requires us to keep the record, where a payable or tax line still exists, or where footage has already been licensed as part of a dataset. We will tell you which limit applies.
9. Security
We apply reasonable security safeguards appropriate to a portal that handles identity, payout rails, and pointers to licensed media:
Access control by role. Contributor, org, ops, and finance see different surfaces.
Encryption in transit (TLS) and encryption at rest for the database and object store we control.
Least-privilege staff access and an audit event on pause, rate change, override, payout, and org suspend.
Secrets and payout files are not stored in Slack, Notion, or a shared sheet as the system of record.
If a personal data breach is likely to affect you, we will intimate you and, when the Board is receiving notices, the Data Protection Board of India without delay, with a detailed report within 72 hours of becoming aware.
10. Your rights
As a Data Principal you may:
Access a summary of the personal data we hold and the processing activities.
Correct inaccurate or incomplete data.
Erase data that is no longer necessary for the specified purpose, subject to section 8.
Withdraw consent where processing is consent-based. Withdrawal does not unwind accepted, paid work or a dataset already licensed.
Nominate a person to exercise these rights in the event of death or incapacity.
Raise a grievance under the Grievance Redressal Policy.
Write to privacy@rigtask.com from the email on your account, or use the in-app request form. We will acknowledge and respond within the timelines in the Grievance Redressal Policy (privacy grievances: 90 days). We may need to verify it is you.
You also have duties under the DPDP Act: do not impersonate, do not suppress material information, and do not file a false grievance.
11. Field subjects
If you appear in footage a contributor captures for a Rigtask pack, you are a Data Principal for that image and voice. The contributor must show you the Field Subject Consent Notice and take a recorded yes before the camera runs on you.
Purpose: produce licensed training data for robotics and physical AI, delivered by Deploy8 to its customers under contract. It is not a social post and it is not a job interview.
To ask what was captured or to withdraw future use, write to privacy@rigtask.com with the date, place, and contributor name if you have it. If the clip has already been accepted and licensed, we may not be able to pull it from a finished delivery. We will say so plainly.
12. Automated decisions
Quality policy (multiplier, pause, recertify) and mix / combo caps execute in software. A person whose quality sits below floor for three packs is paused and disappears from claim lists. Recertification restores access. These rules decide who may claim work. They do not decide a government benefit. You can ask a reviewer to look at a specific reason code.
13. Other policies
The client work platform, Slack, your bank, and any ad platform that showed you a Rigtask creative have their own policies. This document governs only Rigtask.
Related documents: Terms of Service, Contributor Independent Contractor Agreement, Partner Data Processing Addendum, Field Subject Consent Notice, Grievance Redressal Policy.
14. Changes
We will post a new version at https://rigtask.com/legal/privacy and, if the change is material, notice you in-app or by email. Continued use after the effective date is acceptance of the updated notice, except where a fresh consent is required.
15. How to reach us