Privacy notice

Version 1.3 (18 October 2026). This notice applies to the site {{app_host}}, where volunteers label Croatian words (lemmas, word pairs and stems) for an open language dataset.

This notice explains which personal data we process when you take part, why, on which legal basis, how long we keep it and what your rights are under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1. Controller and contact

The controller is {{controller_name}}.

Address: {{controller_address}}

For any privacy question, to exercise your rights or to object, write to {{controller_email}}.

No data protection officer has been designated because none is required for this processing (Article 37 GDPR). Please use the address above.

2. What we process and where it comes from

Signing in with a Google account

You sign in with your Google account through a sign-in server (Keycloak) at {{identity_host}}. When you sign in, Google gives us: your Google account identifier, your email address, whether that address is verified, and your first and last name. The sign-in server stores these in your user account there. Of these, the labeling application stores only the technical identifier of your sign-in account and your email address (and the address only if it is verified).

The application creates this profile the first time you sign in, before you accept the terms and the participation statement, because it needs it to show you the acceptance step and to let you erase the account from there ("Erase account"). Until you accept, it records nothing else about you and you cannot label. If you never accept, the application erases the profile 30 days after your first sign-in (section 6).

Data you enter or that arises while you take part

Your answers (labels): the answer to the question, a lemma you type, the irregular-form flag, the revision number of the answer and when it was saved.
The time you took to answer each item (in milliseconds), which items were shown to you, when and how many times, and whether an item was shown without the corpus suggestion.
Your acceptance of the terms of participation and the participation statement, and the version of this notice you were shown: document version, time of acceptance, interface language, application version and your confirmation that you are at least 18 years old.
A random participant identifier (pseudonym) assigned to your profile. All your answers are linked to that identifier, not to your name or email address.
The status of your profile (active, set aside, blocked or erased) and, if we change it, the reason.
Reliability assessments the application computes from the data above (section 9).

Data that arises automatically at the network edge

The reverse proxy in front of the application records, for every request, the IP address, the time, the page address requested and browser details (user agent). An attack-protection system on the same infrastructure uses those records to detect and block malicious traffic. The labeling application itself keeps no access logs and does not see your IP address.

We use no cookies for tracking, analytics or advertising. What is stored in your browser is described in the cookie and storage notice.

3. Purposes and legal bases

Creating your profile when you first sign in, before you accept: steps taken at your request before you take part under the terms of participation (Article 6(1)(b) GDPR).
Running your profile and recording your answers to build the language dataset: your consent (Article 6(1)(a) GDPR), which you give separately when you start, by accepting the participation statement. You can withdraw it at any time by erasing your profile (section 7).
Keeping answers in the dataset after you erase your profile: legitimate interest (Article 6(1)(f)) in a scientific dataset, with the research exemption of Article 17(3)(d) and the safeguards of Article 89(1) (section 7).
Assessing how reliable answers are (profiling), detecting abuse, rate limiting and blocking accounts: legitimate interest (Article 6(1)(f)) in keeping a public research dataset accurate and protected from fake or automated entries. Section 9 explains what we assess, how we weighed this interest and how you can object.
Security logs at the network edge: legitimate interest (Article 6(1)(f)) in protecting the service from attacks.
Keeping records of consent: the legal obligation to be able to demonstrate consent (Article 7(1) together with Article 6(1)(c)).

4. Recipients and processors

Google (Google Ireland Limited and Google LLC) as the sign-in provider. Google is an independent controller for your Google account; its privacy policy is at policies.google.com/privacy.
The hosting provider that runs the application, its database, the sign-in server and the reverse proxy: {{hosting_summary}}.
The public, when we publish the dataset: we publish it only as files attached to releases of the croatian-stemmer repository on GitHub. Published files contain the item texts and only aggregated labels (for each item, the result combined from all answers to it), never a participant identifier, name or email address, nor answer counts, answer times or reliability assessments.
Researchers, only if we sign a written data-sharing agreement with them: a restricted data package for checking and repeating the reliability calculation. It contains answers, answer times and records of profile status under random participant identifiers, without names or email addresses. The agreement forbids attempts at re-identification and allows the package to be kept for at most one year. When you erase your profile, we ask the recipient to delete the rows with your previous identifier.

We use no analytics or advertising services and have no other processors.

5. Transfers outside the EU and EEA

The sign-in request goes to Google, which may process it in the United States as well. Google LLC is certified under the EU-U.S. Data Privacy Framework, so such a transfer relies on the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR). The application's own data stays with the hosting provider named in section 4.

6. How long we keep data

Your profile in the application (sign-in account identifier, email address): until you erase your profile. If you sign in but never accept the terms and the participation statement, the application erases the profile automatically 30 days after your first sign-in; you can erase it earlier from the acceptance screen.
Your user account on the sign-in server (first and last name, email address): until you erase your profile; after an erasure request, including the automatic erasure above, we delete it within 30 days. Until then the application keeps the identifier of that account with the erasure request, only so that we can find and delete it.
Answers: indefinitely, as part of the dataset. When you erase your profile, they are moved to a new random identifier that is linked neither to you nor to your previous identifier, and only the day of each answer is kept, not the time (section 7). If your profile is blocked or set aside when you erase it, your answers are deleted instead.
Time taken per answer: 90 days from each answer, after which we delete it; at once when you erase your profile.
The list of items shown: records of items you did not answer are deleted 30 days after they were last shown; records of items you answered are kept until you erase your profile.
Reliability assessments (your assessments and the results computed for individual items): 30 days after the calculation that produced them. The results of the latest calculation are kept until a new calculation replaces them.
Records of changes to your profile status and reliability level: for as long as we keep the answers, for accountability and so that calculations can be repeated. When you erase your profile, we remove the reasons, abuse signals and their values from them, so only the kind of change remains.
Consent records: for as long as we keep the answers given under that consent; on erasure they move with the answers to the new identifier, with only the day kept (or are deleted with them).
If you are on the list of trusted experts (section 9): your email address and the note with your name on that list, until we remove you from it or you erase your profile.
Files the controller downloads from the application to curate the dataset: deleted at the latest 30 days after the download, and at once when the erasure of a profile whose identifier they contain is completed. Packages shared with researchers: as the agreement says, at most one year.
Database backups: {{backup_retention}}. Data erased from the application disappears from backups after that period.
Reverse proxy records at the network edge: {{edge_log_retention}}.
Published releases of the dataset (aggregated labels only): permanently; published releases are not changed.

7. Your rights

Access and portability: on the "My data" page you can download everything linked to your profile yourself, in a machine-readable format (JSON), including reliability assessments and every change to your profile status (section 9).
Rectification: you can change your answers in the application; for anything else, write to us.
Erasure: on the "My data" page you can erase your profile yourself. The application immediately deletes your email address, answer times, the list of items shown to you and your reliability assessments, removes the reasons and values from the records about your profile, and removes the link between your profile and your sign-in account. We delete your user account on the sign-in server (with your first and last name) within 30 days of the request; until then the application keeps that account's identifier with the erasure request, and signing in again shows a notice instead of creating a new profile. Your answers and consent records stay in the dataset under a new random identifier, with only the day of each answer, that can be linked neither to you nor to your previous identifier; if your profile is blocked or set aside at that moment, they are deleted instead. We keep the answers under the research exemption (Article 17(3)(d) GDPR) with the safeguards of Article 89(1) (pseudonymisation, deletion of the identity, only the day of each answer, no answer times, publication of aggregated labels only), and further processing rests on our legitimate interest in a scientific dataset (Article 6(1)(f)). Remaining risk: someone holding a copy of your answers from before the erasure together with your identity (the controller's local file until it is deleted, a backup until it expires, or a researcher's package whose holder ignores the deletion request) could match them to the new identifier by items, answers and days.
Restriction and objection: write to the address in section 1. Objecting to the reliability assessment and what follows from it are described in section 9.
Withdrawing consent: at any time, by erasing your profile (see the participation statement). Withdrawal does not affect the lawfulness of processing before it.
Complaint to a supervisory authority: the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr. You may also complain to the supervisory authority of the member state where you live or work.

We answer requests without undue delay and at the latest within one month.

8. Automated decision-making

The application computes reliability assessments automatically (section 9) and uses them to set the weight of your answers, how many known-answer items you get and, when two different signs of possible abuse appear in one calculation, a review pause during which your answers are temporarily disregarded. We consider that none of these decisions has legal or similarly significant effects on you within the meaning of Article 22 GDPR: participation is voluntary and unpaid, the assessments are not public and have no effect outside this site, and during a pause you can do everything as before (sign in, label, download your data and erase your profile); only the weight of your answers in the dataset changes. We do not announce or show a pause on the site because an honest mistake can also trigger it, so the site does not want to mark anyone that way; it can be seen in the file you download on the "My data" page. A pause lasts at most 14 days, unless the controller decides after review to keep it, which is then a decision by a person. Blocking is never automatic: a person decides, with a reason that is shown to you. Anyone may write to the address in section 1 to object or to ask for a person to review a decision about their profile.

9. Reliability assessment (profiling)

To keep the dataset accurate, the application assesses how reliable each participant's answers are. This is profiling within the meaning of Article 4(4) GDPR. We assess only people who have accepted this notice at version 1.3 (or later), the terms of participation and the participation statement. Answers given before that are stored but are not assessed or counted until you do; the next calculation then includes them.

What we compute

For each kind of task (word pairs, lemmas, stems): an estimate of how accurate your answers are, and a level (new, qualified, established, expert).
The weight your answers carry when the answers to an item are combined.
Signs of possible abuse: for example answering very fast, a long run of identical answers, poor agreement with known-answer items, or answers that only repeat the corpus suggestion.

From what

From your answers and their revisions, the time taken per answer, your answers on items whose correct answer is known in advance (known-answer items, mixed in unannounced), whether an item was shown without the suggestion, how your answers agree with other participants' answers, and the status of your profile. The controller also keeps a list of trusted experts (email address and a note with the name); answers from people on that list start from a higher estimate.

Effects

Weight: answers with a higher estimate count for more when answers are combined.
More known-answer items for participants at lower levels and for those in a review pause.
Automatic review pause (status "set aside"): when two different signs of possible abuse appear in one calculation, your answers are temporarily disregarded and you get more known-answer items. You can go on labeling. The pause is not announced or shown on the site; it can be seen, with the reasons, in the file you download on the "My data" page. It lasts at most 14 days, unless the controller decides after review to keep it.
Blocking: only by a decision of a person, with a stated reason, which is shown to you on the "My data" page.

Legal basis and balancing of interests

The legal basis is legitimate interest (Article 6(1)(f) GDPR) in keeping a public research dataset accurate and protected from fake or automated entries. Without the assessment we could not tell careful answers from random or automated ones. In weighing this interest we took into account that the assessment rests only on how you answer items, not on who you are; that the assessments are not public and have no effect outside this site; that we share them only under the conditions of section 4; that we keep them briefly (section 6); and that you can always see them. The assessment is not switched on before a data protection impact assessment (Article 35 GDPR) has been written.

How it works

The logic of the assessment, the levels and the formulas are explained on the page How reliability works. A simplified view of your assessment is on the "My data" page under "Reliability", and the complete data are in the file you can download there. The file does not say which of your answers were checks on items still in use, because it would otherwise reveal those items; on request by email we retire those items and send you the details within one month.

Objection

You may object to the assessment at any time (Article 21 GDPR) by email to the address in section 1. Without the assessment we cannot use your answers in the dataset, so the consequence of an objection is that we no longer use your answers: we block your profile with the reason "objection" and show it to you as such, as the consequence of the objection and not as a penalty. We will also offer you erasure of your profile; if you then erase it, your answers are deleted (section 7).

10. Minimum age

The service is for people aged 18 and over and is not directed at children or minors. When you start we ask you to confirm that you are at least 18; we do not collect your date of birth. Profiles of younger people are erased as soon as we learn of them.

11. Changes to this notice

The notice carries a version number and a date at the top. When we publish a new version, we will show it to you and ask you to confirm the acceptance step again before your next answer. Records of earlier versions are kept.