Privacy Policy

This Privacy Policy explains how Born Labs, Inc., a Delaware corporation with offices at 183 Madison Ave, Ste 1415, New York, NY 10016, USA (“Onsite,” “Born Labs,” “we,” “us,” or “our”), collects, uses, shares, and protects information when you visit joinonsite.com and its localized versions, apply to the Onsite partner program or sign up as an individual, buy or receive a head mount, use the Onsite mobile app, or apply for a job with us (together, the “Service”). It also describes your privacy rights and how to exercise them.

Important: the app records first-person video and audio and may collect biometric-type information (such as faces, voices, body pose and hand movements), precise location where you allow it, and photos of receipts, documents and your home when you choose tasks that ask for them. Please read Sections 3, 4, 6 and 7 carefully. If the app presents its own privacy policy when you create an account (including under another Born Labs brand such as “Reps”), that policy applies to the app; this Policy applies to the website, the partner program, the head mount program and our careers pages, and to the app only to the extent the app does not present its own policy.

1. Who we are and how to reach us

Born Labs, Inc. is the controller responsible for your personal information. For any privacy question or request, contact us at support@born.com or by mail at the address above. If you are in the European Economic Area, the United Kingdom or Switzerland, see Section 12 for your rights and legal bases.

2. Website visitors, leads and partner applications

Information you give us. When you fill in the sign-up, partner or waitlist forms we collect the details you enter: company name and website, type of business, team size, country and business address, your name, role, work email and phone number, which phones your team uses, whether you have ordered or already own a head mount, and any answers to our earnings calculator (people, hours, days). If you book an intro call, Calendly collects the details you enter in its widget under its own privacy policy, and we receive the booking.

Information collected automatically. We collect the campaign parameters (UTM) and a random first-party click identifier when you land on the site and keep them in your browser’s session storage so that a sign-up or booking can be attributed to the campaign that brought you here. We also collect standard server logs (IP address, browser, pages viewed).

Analytics and advertising. With your consent where required (see the cookie banner and Section 11), we use Mixpanel to measure how visitors move through the sign-up funnel, and the Meta Pixel and Meta Conversions API to measure our advertising. When you submit a form, we may send Meta a conversion event containing your email address and phone number in hashed (SHA-256) form, your IP address and browser type, together with an event identifier, so that Meta can match the conversion to an ad. We do not send Meta the content of your forms. You can decline these technologies in the banner, change your choice via the “Cookie settings” link in the footer, or use your browser’s Global Privacy Control signal, which we honor as an opt-out.

Where leads are stored. Form submissions are stored in a Google Sheet operated by us through Google Workspace and may be mirrored to our internal Slack and customer-relationship tools so that our team can follow up. We keep lead data for as long as we are in contact with you or your business and for up to 24 months after our last interaction, unless a partner agreement is signed (in which case Section 9 applies) or you ask us to delete it sooner.

3. Information we collect in the app

• Account and identity information — your mobile phone number (verified by SMS code through our verification provider, Prelude, which also collects device-integrity signals), name or display name, email, avatar, country, timezone and language, and, if you use Sign in with Apple, the identifier and email Apple shares with us. The app may ask for an age bracket and gender for task matching, and a one-time confirmation that you are 21 or older before tasks involving age-restricted products. Business accounts: the business contact details of representatives (name, work email, role), the company code and the roster of members.
• Recordings and task submissions — first-person video and audio captured with your phone in the head mount, together with sensor data captured during recording (motion and orientation, depth, camera parameters, device pose, hand-skeleton data and, for home scans, a 3D mesh of the room); photos and videos you take or select from your camera roll for tasks (which may show your home, belongings, fridge, medication labels, receipts, documents, bills, insurance or financial paperwork, or screenshots of apps and settings); voice recordings and written answers; and metadata (time, duration, task, the version of the task terms you accepted, and your answers to the “bystanders visible” and “minors visible” questions). Recording starts only when you tap record. Video may upload in chunks while you record; a take you discard is not used, and a take you leave unsubmitted may be submitted automatically after about two hours unless you discard it.
• Biometric-type data — faces, voices, body pose and hand movements contained in recordings, yours and those of anyone you do not keep out of frame, and a selfie wearing your own head mount if you verify one. See Section 4.
• Receipts and purchase information — when you submit receipt photos, we extract store, date, totals, currency, payment method and card last four digits, benefit-program flags (for example EBT or WIC), a hashed loyalty number and each printed line item (product, price, quantity), and we resolve products to brands and categories using barcode databases and AI models. See Section 6.
• Interviews and inferred traits — if you take part in voice or video interviews, we transcribe your answers, reduce them to facts, and use them (together with your approved submissions) to generate follow-up questions and to infer household traits for task matching. Facts are also stored in an index that lets us find members with similar answers; the index does not expose your identity to other members.
• Payout and tax information — your balance, ledger and payout history; the legal name, date of birth and last four digits of your Social Security number (or local equivalent) that you enter for identity verification, which are transmitted to Stripe; bank account holder name, bank country and last four digits for display (full account numbers go directly to Stripe and are not stored by us); and any tax forms or identification numbers we are legally required to collect.
• Location — see Section 7.
• Device, usage and fraud-prevention data — device model and identifiers, operating system, app version, language, timezone, SIM country, whether a VPN is active, IP address (stored as a hash) and the network it belongs to, push token, battery and network state, crash and diagnostic logs (Sentry), product analytics and screenshot events (Mixpanel), and, with your permission through Apple’s App Tracking Transparency prompt, the advertising identifier used by AppsFlyer and Apple SKAdNetwork to attribute app installs to our ads on Meta, TikTok and similar platforms.
• Orders and hardware — your shipping address and recipient name if we ship you a head mount (validated through Google Address Validation), tracking information from our shipping partners, and the Amazon order confirmation you tick when you buy your own mount.
• Subscriptions — if you subscribe to a premium tier, our subscription provider (RevenueCat) and Apple or Google process the purchase; we receive the subscription status and renewal dates, never your card number.
• Referrals — invite codes you share or redeem, the resulting relationship and rewards. The person you refer sees your display name.
• Communications — support tickets (text, an optional screenshot, device details), your SMS and push preferences, and, where available, your conversations with an in-app assistant, including the goals, services and instructions you give it and the “memories” it keeps for you until you delete them.

4. Recordings and biometric information

Because the app captures first-person video and audio, recordings may contain biometric identifiers and biometric information— face geometry, voice, gait, body pose and hand movement — of you and of other people who appear. Some jurisdictions (for example Illinois under BIPA, Texas, Washington, and the EU and UK, where biometric data used to identify a person is a special category) regulate this information.

• Purpose. We process faces and voices only to review submissions, run our redaction pipeline (which detects faces, license plates, screens and documents in order to blur them), prepare redacted, de-identified datasets, and verify your own head mount from a selfie. We process body-pose and hand data to build motion and manipulation datasets for robotics. We do not use recordings to identify individuals and do not build face or voice recognition profiles.
• Consent. You consent when you accept the recording and task terms in the app before submitting content, and your consent to the processing scopes shown in the app (AI training, robotics training, inclusion in commercially licensed datasets, pose processing and redaction) is recorded with a version and timestamp. Do not submit content showing another person without first obtaining that person’s consent; the in-app terms require you to confirm this.
• Redaction happens on our servers after upload, and only for footage that is approved for inclusion in datasets. Our reviewers and annotation vendors may see unredacted footage during review, under confidentiality and access controls. The app does not blur on your device before upload, except that for gallery screenshots the app detects and blurs personal details on your phone before the file uploads.
• No sale of biometric data. We do not sell, lease or trade biometric identifiers or biometric information, and we contractually prohibit dataset licensees from attempting to re-identify anyone.
• Retention and destruction. We destroy biometric identifiers when the purpose for collecting them has been satisfied and in any event within three (3) years after your last interaction with us, unless a longer period is required by law or legal hold. Redacted data from which identifiers have been removed is not subject to this schedule. See Section 9.

5. How we use your information

• To provide, operate, maintain and improve the Service and hardware, and to match you with tasks (including by city).
• To review, score and accept submissions using automated systems (including machine-learning models, image-provenance checks and large-language-model services) and human reviewers, including trained personnel of annotation vendors under confidentiality obligations; and to calculate, credit and pay your earnings, operate the wallet and process withdrawals.
• To develop, train, validate and improve machine-learning datasets and models for artificial-intelligence and robotics systems, to create derived data (annotations, language labels, 3D reconstructions, robot motion trajectories) and to license data products to third parties, as described in the Terms.
• To build aggregated insights about which stores people visit and what households buy (from location and receipt data) and share those insights with brands and commercial partners in aggregated or de-identified form only.
• To operate the partner program, business accounts and revenue share, and to let business owners and administrators see their team’s activity, earnings and recordings made under the business account.
• To communicate with you about your account, orders, deliveries, reviews and payouts, by push, email and SMS, and, with your permission, to send marketing messages and daily reminders; and to operate waitlists and referral programs.
• To detect, prevent and address fraud, abuse, multiple-account schemes, reused devices or phone numbers, non-eligible locations, security incidents and violations of our Terms (see Section 13).
• To measure and improve our marketing on the website and in app stores.
• To comply with legal, tax, anti-money-laundering and sanctions obligations and to establish, exercise or defend legal claims.

6. Dataset licensing, brand insights, and your opt-out

Our business is building consented datasets of everyday human activity and licensing them to third parties, including AI research labs, robotics companies, technology companies, research institutions and other commercial partners. What we license consists of redacted, de-identified recordings and sensor data (video, depth, motion, hand pose, language labels and robot-motion data) with task metadata. We do not license your name, phone number, contact details, payment information or account credentials, and we do not sell biometric identifiers. Every license requires the licensee not to attempt to re-identify anyone, to use the data only for the licensed purpose, to keep it secure, to report and delete any residual personal information and to flow these restrictions down to sub-recipients. Items already delivered in a dataset or incorporated into a trained model cannot be recalled.

Receipt and location data are used to produce aggregated purchase and store-visit trends. Brands and other partners receive only trends across many members, never your name, address, receipts or location history.

“Sale” and “sharing” under U.S. state law. Some state laws define “sale” broadly enough that licensing de-identified recordings or sharing hashed identifiers with advertising partners could be treated as a sale or sharing. Out of caution we treat them as such and offer an opt-out: email support@born.com with the subject “Do Not Sell or Share My Personal Information,” decline advertising cookies in the banner, or enable Global Privacy Control in your browser. If you opt out of dataset licensing, your future recordings will not be included in newly licensed datasets, and because paid tasks are funded by licensing you may become ineligible for some or all paid tasks (see the Notice of Financial Incentive in Section 11).

7. Location

Approximate location. We infer your country and region from your IP address, SIM country, phone-number country and device timezone to check eligibility (the app currently pays only members in the United States), to tailor tasks to your city and to comply with law.

Precise and background location (with your permission). Where you turn on location in the app and allow “Always” in your phone settings, the app sends your device’s position in the background, roughly every 15 minutes or 200 metres, to our servers. We use it to work out stays of eight minutes or more (“visits”), to label the places you visit using OpenStreetMap data (the coordinates of a place, not your identity, are sent to the OpenStreetMap Overpass service for labelling), to classify places as home, work, store or other, to pay you the daily amount shown in the app for each day your phone reports in, to verify task eligibility and authenticity, and to build the aggregated store-visit trends described in Section 6. Raw location fixes and visits are deleted after 90 days; the list of labelled places is kept while your account exists and deleted with it. You can pause sharing in the app or revoke the permission in your phone’s settings at any time; daily payments stop when sharing is off. The camera does not geotag your recordings.

8. How we share information

We do not sell your personal information for money. We share information only as follows:

• Service providers (processors) working on our behalf under contracts that limit their use of your data: cloud hosting and storage (Amazon Web Services, in the United States), Stripe (payouts and identity verification), Prelude (phone verification and device signals), Knock and Expo (push and SMS delivery), Mixpanel (analytics), Sentry (crash reporting), AppsFlyer (install attribution), RevenueCat (subscriptions), IPinfo (IP geolocation and VPN detection), Google (address validation, lead storage in Google Sheets), AfterShip and shipping carriers (deliveries), Calendly (call scheduling), Slack and customer-support tooling (internal order, support and lead notifications), ClickHouse Cloud (analytics database for receipt and purchase data), Barcode Lookup and Open Food Facts (product resolution), OpenStreetMap Overpass (place labelling), data-annotation and labeling vendors whose trained personnel view and label recordings under confidentiality obligations, and AI model providers that process data on our instructions through an API gateway (OpenRouter) configured not to retain or train on our data, including models from Google, OpenAI, DeepSeek, Alibaba (Qwen), Perplexity and Anthropic, used to transcribe, extract, classify, review and label submissions and support tickets.
• Data licensees and commercial partners, who receive redacted, de-identified recordings and sensor data, or aggregated purchase and store-visit trends, under the restrictions in Section 6.
• Advertising and attribution partners (Meta, TikTok, Apple SKAdNetwork, AppsFlyer), which receive limited, hashed or aggregated conversion and install signals as described in Sections 2 and 3. We never provide them with your recordings.
• Your business (business accounts): if you record under an employer’s or other organization’s account, the organization’s owners and administrators, and other members of that account, can see activity and acceptance status for the account and can view recordings made under it; owners and administrators also see amounts credited. They do not see your personal contact details or bank information.
• Providers the in-app assistant acts with, where you ask it to contact or log in to a provider on your behalf; what you type into a provider’s login page in the assistant’s remote session goes to that provider.
• Legal and safety recipients, when we believe disclosure is required by law or legal process, or is necessary to protect the rights, safety and property of you, us or others, to prevent fraud or abuse, or as required by child-safety reporting laws; and our professional advisers.
• Business transfers — in connection with a merger, financing, acquisition, reorganization or sale of assets, subject to this Policy.
• With your direction or consent.

We do not disclose your phone number or contact details to other users. People you refer, or who refer you, see your display name and referral status only.

9. Data retention and deletion

• Account data is kept while your account exists. When you delete your account in the app (Settings → Delete account) or by emailing us, we delete or anonymize your phone number, email, name, avatar, saved addresses, location data, receipts and purchase data, interview data, inferred traits, quest media, support screenshots and head-mount selfies within a commercially reasonable period.
• Recordings. Unredacted originals are kept under restricted access and permanently deleted within twelve (12) months after review is complete, unless needed for a specific fraud or safety investigation, a legal hold or applicable law. Redacted, de-identified versions that have been included in datasets, trained models or deliverables may be retained and remain in licensed datasets, because removing individual items is generally not feasible. Deleting your account stops all future collection and stops your recordings from being included in newly licensed datasets.
• Fraud-prevention records. To prevent a deleted account from being re-created to claim one-time credits, we keep keyed hashes of your phone number, install identifier and push token, your member number, consent records, and eligibility and sign-in sightings (hashed IP, country, network and device facts) after deletion. These records cannot be used to contact you.
• Financial records (ledger, payouts, tax information, order records without addresses) are kept as required by tax and financial regulations, typically seven years.
• Location: raw fixes and visits 90 days; places while the account exists.
• Website leads: up to 24 months after our last contact (Section 2). Job applications: Section 10.
• Analytics and logs are retained on rolling schedules and then deleted or aggregated. Biometric-type data: per Section 4.

10. Job applicants

If you apply for a role through our careers pages, we collect your name, email, phone, LinkedIn or XING profile, your answers to the application questions, your availability and, if you upload one, your CV. Your CV is stored in our file storage (Vercel Blob) at an unguessable address, and your application is posted to a private channel in our internal Slack workspace where our hiring team reviews it. If we invite you to a call, we email you a Calendly link. We use this information only to assess your application, to contact you and, where required, to comply with legal obligations (for example documenting the process under anti-discrimination law). We keep applications for six months after the process ends, or longer with your consent for future roles, and then delete them. You can withdraw your application or ask for deletion at any time at support@born.com. The legal basis for EEA, UK and Swiss applicants is pre-contractual measures at your request and our legitimate interest in running a hiring process (and, in Germany, § 26 BDSG).

11. Your U.S. privacy rights

Depending on your state (including California, Colorado, Connecticut, Delaware, Montana, New Jersey, Oregon, Texas, Utah, Virginia and others), you may have the right to know and access the personal information we hold about you, correct it, delete it, obtain a portable copy, opt out of “sale,” “sharing” and targeted advertising, limit the use of sensitive personal information (which may include precise geolocation, biometric data, health, financial and benefit-program information you choose to submit in tasks), and not be discriminated against for exercising your rights, subject to the financial-incentive terms below.

Categories collected. In the past 12 months we have collected the categories described in Sections 2, 3 and 7: identifiers, customer records, commercial and transaction information (including purchases from receipts), internet and device activity, approximate and precise geolocation, audio, visual and sensory information, biometric information, professional information (job applicants and business contacts), sensitive personal information you choose to submit, and inferences for task matching and fraud prevention. We treat dataset licensing and advertising measurement as potential “sales” or “sharing” as described in Section 6; we do not otherwise sell personal information for money, and we do not knowingly sell or share personal information of anyone under 18.

Notice of Financial Incentive. The app is a financial-incentive program: we pay you for recordings, task submissions, receipts, interviews and location sharing, which fund the Service through dataset licensing and aggregated insights. The material terms (what each task pays, the daily location amount, the review criteria) are shown in the app before you opt in by accepting a task or turning on sharing. You can withdraw at any time by not accepting tasks, pausing location sharing, opting out of licensing or deleting your account. Our good-faith estimate of the value of your data is the compensation shown for each task, which is reasonably related to the licensing value we expect it to have.

How to exercise your rights. Email support@born.com with the right you wish to exercise, or use the in-app controls, the cookie banner and the unsubscribe or STOP mechanisms. We will verify your request using your account phone number or email and respond within the time required by your state’s law. You may use an authorized agent with written proof of authority. If we deny a request you may appeal by replying to our decision. Nevada residents may submit opt-out requests to the same address. California “Shine the Light” requests may be sent to the same address. We honor Global Privacy Control signals on our website as an opt-out of sale or sharing.

12. EEA, UK, Swiss and other international users

Legal bases. Where the EU or UK GDPR or the Swiss FADP applies, we rely on: performance of a contract or pre-contractual steps at your request (operating the website sign-up and partner program, shipping a head mount, operating the app and paying you); your consent (analytics and advertising cookies, the Meta Pixel and Conversions API, marketing messages, precise location, and the processing of biometric and other special-category data contained in your recordings and submissions, which you may withdraw at any time without affecting prior processing); our legitimate interests (securing the Service, preventing fraud, improving the product, and building and licensing de-identified datasets, balanced against your rights); and compliance with legal obligations (tax, accounting, platform reporting).

Your rights. You have the right to access, rectify, erase, restrict or object to processing, to data portability, to withdraw consent, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 13). To exercise them contact support@born.com. You may also lodge a complaint with your local supervisory authority (for example a German Landesdatenschutzbehörde, the Italian Garante, the Spanish AEPD, the French CNIL, the Polish UODO or the UK ICO).

Transfers. Our services are hosted in the United States, and the recipients in Section 8 may be located there or in other countries. Where we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum), on adequacy decisions such as the EU-US Data Privacy Framework where a recipient is certified, and on supplementary measures where needed.

Brazil (LGPD), Mexico, Argentina and Turkey (KVKK). Residents of these countries have comparable rights of access, correction, deletion, portability, information about sharing and revocation of consent, exercisable at support@born.com. Where the law of your country requires explicit consent for the international transfer of your data or for the processing of sensitive or biometric data, we obtain it in the app or on the website before processing. We may act as the data controller located abroad; Turkish residents may also complain to the Personal Data Protection Authority (KVKK).

13. Automated decision-making and fraud prevention

We use automated systems to review submissions (including detecting AI-generated, duplicated or non-compliant content), to check that a submission comes from an eligible location, to detect multiple accounts, shared devices, bank accounts or addresses and reused phone numbers, to compute a contributor quality score that can affect the rates and tasks offered to you, and to decide whether an account may be admitted or must be blocked. An eligibility check runs each time the app opens and may block access permanently when signals indicate that the account is not operated from an eligible household (for example mismatched IP, SIM, timezone, bank country or VPN use). Decisions with significant effects on you — rejecting a body of work, withholding a payout, blocking or suspending an account — can be contested by contacting support@born.com, and we will have a person review them. Where the law of your state or country gives you rights regarding profiling or automated decision-making, you may exercise them the same way. Some support replies are automated templates; you can always ask for a human response.

14. Communications and SMS

We send one-time passcodes by SMS to verify your phone number and may send transactional texts and push notifications about your account, reviews, payouts and shipments. We send marketing texts only with your prior express consent, which is never a condition of using the Service; reply STOP to opt out of non-essential texts and HELP for help. Message and data rates may apply; frequency varies. We do not sell or share your mobile number or SMS opt-in information with third parties or affiliates for their own marketing. Marketing emails contain an unsubscribe link, and you can turn off push notifications in your phone settings. Lifecycle reminders are capped and paused during night hours.

15. Cookies and tracking on the website

Our website uses strictly necessary storage (your cookie choice and the attribution values in session storage) and, with your consent where required, analytics (Mixpanel) and advertising (Meta Pixel) technologies. You can accept or decline non-essential technologies in the banner, change your choice via “Cookie settings” in the footer, and control cookies through your browser. We honor Global Privacy Control signals as an opt-out. Because there is no common standard for “Do Not Track,” we do not respond to it separately.

16. Security

We use technical and organizational measures designed to protect your information, including encryption in transit and at rest, access-controlled storage in regions we control, hashing of identifiers used for fraud prevention, least-privilege internal access, and contractual security obligations for processors and licensees. No method of transmission or storage is completely secure. If we learn of a breach affecting your personal information, we will notify you and regulators as required by law. Report suspected vulnerabilities to support@born.com.

17. Children

The Service is for adults. You must be at least 18 to create an account, and some tasks require you to be 21 or older. We do not knowingly collect personal information from anyone under 18 and do not knowingly allow minors to appear in recordings; minors cannot consent for these purposes. If you believe a person under 18 has provided us information or appears in a recording, contact support@born.com and we will delete it.

18. Third-party links and services

The Service may link to or rely on third-party services (for example Amazon product pages, Stripe, Calendly, Discord, carrier tracking pages and the App Store). Their privacy practices are governed by their own policies, and we are not responsible for them.

19. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, in particular to how recordings are used or licensed, we will update the “Last updated” date above, notify you in the app or by other prominent means and, where required by law, obtain your consent before the change applies to previously collected information.

20. Contact us

Born Labs, Inc., 183 Madison Ave, Ste 1415, New York, NY 10016, USA. Questions about this Policy or your data? Email support@born.com.