Privacy notice

Version 1.4 (18 October 2026). This notice applies to the site {{app_host}}, where volunteers label Croatian words (lemmas, word pairs and stems) for an open language dataset.

This notice explains which personal data we process when you take part, why, on which legal basis, how long we keep it and what your rights are under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1. Controller and contact

The controller is {{controller_name}}.

Address: {{controller_address}}

For any privacy question, to exercise your rights or to object, write to {{controller_email}}.

No data protection officer has been designated because none is required for this processing (Article 37 GDPR). Please use the address above.

2. What we process and where it comes from

Signing in with a Google account

You sign in with your Google account through a sign-in server (Keycloak) at {{identity_host}}. When you sign in, Google gives us: your Google account identifier, your email address, whether that address is verified, and your first and last name. The sign-in server stores these in your user account there. Of these, the labeling application stores only the technical identifier of your sign-in account and your email address (and the address only if it is verified).

The application creates this profile the first time you sign in, before you accept the terms and the participation statement, because it needs it to show you the acceptance step and to let you erase the account from there ("Erase account"). Until you accept, it records nothing else about you and you cannot label. If you never accept, the application erases the profile 30 days after your first sign-in (section 6).

Data you enter or that arises while you take part

Your answers to the labeling tasks, of whatever kinds the site offers, including anything you type into a task (such as a lemma), with when each answer was saved and changed, the application version, and how the task was shown to you (for example with or without the corpus suggestion).
How you work through the tasks: which items were shown to you, when and how many times, and how long you took to answer each.
Your acceptance of the terms of participation and the participation statement, and the version of this notice you were shown: document version, time of acceptance, interface language, application version and your confirmation that you are at least 18 years old.
A random participant identifier (pseudonym) assigned to your profile. All your answers are linked to that identifier, not to your name or email address.
Records of changes to your profile, such as its status (active, set aside, blocked or erased), your level or a role, with the reason.
Assessments the application computes from the data above, such as how reliable your answers are and signs of possible misuse (section 9).
If the controller gives you a role, for example trusted expert: your email address and a short note that identifies you on the list of people with that role.

Data that arises automatically at the network edge

The reverse proxy in front of the application records, for every request, the IP address, the time, the page address requested and browser details (user agent). An attack-protection system on the same infrastructure uses those records to detect and block malicious traffic. The labeling application itself keeps no access logs and does not see your IP address.

We use no cookies for tracking, analytics or advertising. What is stored in your browser is described in the cookie and storage notice.

3. Purposes and legal bases

Creating your profile when you first sign in, before you accept: steps taken at your request before you take part under the terms of participation (Article 6(1)(b) GDPR).
Running your profile and recording your answers to build the language dataset: your consent (Article 6(1)(a) GDPR), which you give separately when you start, by accepting the participation statement. You can withdraw it at any time by erasing your profile (section 7).
Keeping answers in the dataset after you erase your profile: legitimate interest (Article 6(1)(f)) in a scientific dataset, with the research exemption of Article 17(3)(d) and the safeguards of Article 89(1) (section 7).
Assessing how reliable answers are (profiling), detecting abuse, rate limiting and blocking accounts: legitimate interest (Article 6(1)(f)) in keeping a public research dataset accurate and protected from fake or automated entries. Section 9 explains what we assess, how we weighed this interest and how you can object.
Developing, operating, securing and supporting the service, including with the help of the IT service providers in section 4: legitimate interest (Article 6(1)(f)) in a service that works, is secure and answers your requests.
Security logs at the network edge: legitimate interest (Article 6(1)(f)) in protecting the service from attacks.
Keeping records of consent: the legal obligation to be able to demonstrate consent (Article 7(1) together with Article 6(1)(c)).
Keeping a short record of erasures so that they can be applied again after a restore from backup: the legal obligation to erase (Article 17 together with Article 6(1)(c)).

4. Recipients and processors

Google (Google Ireland Limited and Google LLC) as the sign-in provider. Google is an independent controller for your Google account; its privacy policy is at policies.google.com/privacy.
The hosting provider that runs the application, its database, the sign-in server and the reverse proxy: {{hosting_summary}}.
IT service providers that help us develop, operate and support the service, including AI-assisted software development and operations tools. They are our processors, bound by their data processing terms to use the data only for these purposes and on our instructions, and not to use it to train their models. They see only what a task needs: usually code, settings, figures or test data, and where real data is needed, preferably data without your name or email address. We do not give them copies of the whole database. No such tool decides anything about you.
People the controller authorises to curate the dataset or review pauses act on the controller's instructions and are bound to confidentiality.
The public, when we publish the dataset: we publish it only as files attached to releases of the croatian-stemmer repository on GitHub. Published files contain the item texts and only aggregated labels (for each item, the result combined from all answers to it), never a participant identifier, name or email address, nor answer counts, answer times or reliability assessments.
Researchers, only if we sign a written data-sharing agreement with them: a restricted data package for checking and repeating the reliability calculation. It contains answers, answer times and records of profile status under random participant identifiers, without names or email addresses. The agreement forbids attempts at re-identification and allows the package to be kept for at most one year. When you erase your profile, we ask the recipient to delete the rows with your previous identifier.

We use no analytics or advertising services. If you ask, we will tell you which providers we currently use.

5. Transfers outside the EU and EEA

The sign-in request goes to Google, which may process it in the United States as well. Google LLC is certified under the EU-U.S. Data Privacy Framework, so such a transfer relies on the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR).

The application's own data is stored with the hosting provider named in section 4. An IT service provider from section 4 may process the data it sees outside the EU and EEA, for example in the United States. We use such a provider only if the transfer relies on an adequacy decision of the European Commission (Article 45 GDPR; for the United States, the EU-U.S. Data Privacy Framework, where the provider is certified under it) or on the standard contractual clauses adopted by the Commission, which are part of the provider's data processing terms (Article 46(2)(c) GDPR). To get a copy of these safeguards, write to the address in section 1.

6. How long we keep data

Your profile in the application (sign-in account identifier, email address): until you erase your profile. If you sign in but never accept the terms and the participation statement, the application erases the profile automatically 30 days after your first sign-in; you can erase it earlier from the acceptance screen.
Your user account on the sign-in server (first and last name, email address): until you erase your profile; after an erasure request, including the automatic erasure above, we delete it within 30 days. Until then the application keeps the identifier of that account with the erasure request, only so that we can find and delete it.
Erasure record: after every erasure, including the automatic one, we keep the identifier of your sign-in account and the date of the request on a separate list outside the database for 60 days, only so that we can erase the profile again if the database is ever restored from a backup taken before the erasure.
Answers: indefinitely, as part of the dataset. When you erase your profile, they are moved to a new random identifier that is linked neither to you nor to your previous identifier, and only the day of each answer is kept, not the time (section 7). If your profile is blocked or set aside when you erase it, your answers are deleted instead.
Time taken per answer: 90 days from each answer, after which we delete it; at once when you erase your profile.
The list of items shown: records of items you did not answer are deleted 30 days after they were last shown; records of items you answered are kept until you erase your profile.
Assessments computed from the answers (yours and the results computed for individual items): 30 days after the calculation that produced them. The results of the latest calculation are kept until a new calculation replaces them.
Records of changes to your profile (status, level, role): for as long as we keep the answers, for accountability and so that calculations can be repeated. When you erase your profile, we remove the reasons, abuse signals and their values from them, so only the kind of change remains.
Consent records: for as long as we keep the answers given under that consent; on erasure they move with the answers to the new identifier, with only the day kept (or are deleted with them).
If the controller gives you a role (section 9): your email address and the note on the list of people with that role, until the role is removed or you erase your profile.
Files downloaded from the application to curate the dataset: deleted at the latest 30 days after the download, and at once when the erasure of a profile whose identifier they contain is completed. Packages shared with researchers: as the agreement says, at most one year.
Data an IT service provider sees while helping us (section 4): only as long as its data processing terms provide; it may not keep the data for its own purposes.
Database backups: {{backup_retention}}. Data erased from the application disappears from backups after that period.
Reverse proxy records at the network edge: {{edge_log_retention}}.
Published releases of the dataset (aggregated labels only): permanently; published releases are not changed.

7. Your rights

Access and portability: on the "My data" page you can download everything linked to your profile yourself, in a machine-readable format (JSON), including reliability assessments and every change to your profile status (section 9).
Rectification: you can change your answers in the application; for anything else, write to us.
Erasure: on the "My data" page you can erase your profile yourself. The application immediately deletes your email address, answer times, the list of items shown to you and your reliability assessments, removes the reasons and values from the records about your profile, and removes the link between your profile and your sign-in account. We delete your user account on the sign-in server (with your first and last name) within 30 days of the request; until then the application keeps that account's identifier with the erasure request, and signing in again shows a notice instead of creating a new profile. We also keep that identifier with the date of the request on a separate erasure list for 60 days (section 6), so that the erasure can be applied again after a restore from backup. Your answers and consent records stay in the dataset under a new random identifier, with only the day of each answer, that can be linked neither to you nor to your previous identifier; if your profile is blocked or set aside at that moment, they are deleted instead. We keep the answers under the research exemption (Article 17(3)(d) GDPR) with the safeguards of Article 89(1) (pseudonymisation, deletion of the identity, only the day of each answer, no answer times, publication of aggregated labels only), and further processing rests on our legitimate interest in a scientific dataset (Article 6(1)(f)). Remaining risk: someone holding a copy of your answers from before the erasure together with your identity (a file downloaded to curate the dataset until it is deleted, a backup until it expires, or a researcher's package whose holder ignores the deletion request) could match them to the new identifier by items, answers and days.
Restriction and objection: write to the address in section 1. Objecting to the reliability assessment and what follows from it are described in section 9.
Withdrawing consent: at any time, by erasing your profile (see the participation statement). Withdrawal does not affect the lawfulness of processing before it.
Complaint to a supervisory authority: the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr. You may also complain to the supervisory authority of the member state where you live or work.

We answer requests without undue delay and at the latest within one month.

8. Automated decision-making

The application computes reliability assessments automatically (section 9) and uses them to set the weight of your answers, how many known-answer items you get and, when two different signs of possible abuse appear in one calculation, a review pause during which your answers are temporarily disregarded. We consider that none of these decisions has legal or similarly significant effects on you within the meaning of Article 22 GDPR: participation is voluntary and unpaid, the assessments are not public and have no effect outside this site, and during a pause you can do everything as before (sign in, label, download your data and erase your profile); only the weight of your answers in the dataset changes. We do not announce or show a pause on the site because an honest mistake can also trigger it, so the site does not want to mark anyone that way; it can be seen in the file you download on the "My data" page. A pause lasts at most 14 days, unless the controller decides after review to keep it, which is then a decision by a person. Blocking is never automatic: a person decides, with a reason that is shown to you. No language model or other AI tool takes part in these decisions; they are computed by the application's own code. Anyone may write to the address in section 1 to object or to ask for a person to review a decision about their profile.

9. Reliability assessment (profiling)

To keep the dataset accurate, the application assesses how reliable each participant's answers are. This is profiling within the meaning of Article 4(4) GDPR. We assess only people who have accepted this notice at version 1.3 (or later), the terms of participation and the participation statement. Answers given before that are stored but are not assessed or counted until you do; the next calculation then includes them.

What we compute

For each kind of task (today word pairs, lemmas and stems): an estimate of how accurate your answers are, and a level (for example new or established).
The weight your answers carry when the answers to an item are combined.
Signs of possible abuse: for example answering very fast, a long run of identical answers, poor agreement with known-answer items, or answers that only repeat the corpus suggestion.

From what

From your answers and their revisions, how the items were shown to you (for example without the suggestion), the time taken per answer, your answers on items whose correct answer is known in advance (known-answer items, mixed in unannounced), how your answers agree with other participants' answers, any role the controller has given you, and the status of your profile. The controller may give some people the role of trusted expert, recorded on a list with their email address and a short note; their answers start from a higher estimate.

Effects

Weight: answers with a higher estimate count for more when answers are combined.
More known-answer items for participants at lower levels and for those in a review pause.
Automatic review pause (status "set aside"): when two different signs of possible abuse appear in one calculation, your answers are temporarily disregarded and you get more known-answer items. You can go on labeling. The pause is not announced or shown on the site; it can be seen, with the reasons, in the file you download on the "My data" page. It lasts at most 14 days, unless the controller decides after review to keep it.
Blocking: only by a decision of a person, with a stated reason, which is shown to you on the "My data" page.

Legal basis and balancing of interests

The legal basis is legitimate interest (Article 6(1)(f) GDPR) in keeping a public research dataset accurate and protected from fake or automated entries. Without the assessment we could not tell careful answers from random or automated ones. In weighing this interest we took into account that the assessment rests only on how you answer items, not on who you are; that the assessments are not public and have no effect outside this site; that we share them only under the conditions of section 4; that we keep them briefly (section 6); and that you can always see them. The assessment is not switched on before a data protection impact assessment (Article 35 GDPR) has been written.

How it works

The logic of the assessment, the levels and the formulas are explained on the page How reliability works. A simplified view of your assessment is on the "My data" page under "Reliability", and the complete data are in the file you can download there. The file does not say which of your answers were checks on items still in use, because it would otherwise reveal those items; on request by email we retire those items and send you the details within one month.

Objection

You may object to the assessment at any time (Article 21 GDPR) by email to the address in section 1. Without the assessment we cannot use your answers in the dataset, so the consequence of an objection is that we no longer use your answers: we block your profile with the reason "objection" and show it to you as such, as the consequence of the objection and not as a penalty. We will also offer you erasure of your profile; if you then erase it, your answers are deleted (section 7).

10. Minimum age

The service is for people aged 18 and over and is not directed at children or minors. When you start we ask you to confirm that you are at least 18; we do not collect your date of birth. Profiles of younger people are erased as soon as we learn of them.

11. Changes to this notice

The notice carries a version number and a date at the top. When we publish a new version, we will show it to you and ask you to confirm the acceptance step again before your next answer. Records of earlier versions are kept.