01Who we are
Billion Hours AI Pvt Ltd ("Billion Hours", "we") records first-person video of real work, annotates it and delivers it to teams building physical AI.
For the personal data described in this policy, we decide why and how it is processed. That makes us the Data Fiduciary under DPDP and the controller under the GDPR. Where we process data only on a client's instructions, for example annotating footage the client owns, we act as their Data Processor (DPDP) or processor (GDPR), and the client's own privacy notice applies.
Our Grievance Officer handles all privacy questions, requests and grievances, and can be reached at business@billionhours.ai.
02Who this policy covers
- Website visitors and people who request samples through billionhours.in.
- Clients and prospective clients: the people at companies and labs we work with.
- Capture participants: people who wear our headsets and record their work under a direct agreement with us. They also receive a separate, standalone notice at enrolment, in English or the language of the Eighth Schedule to the Constitution they choose.
- People who appear in footage without being a participant (bystanders).
The GDPR applies to us where we process personal data of people in the EU or EEA in connection with offering our services to them, or where we process data for a client established in the EU. DPDP applies to digital personal data we process in India, and to processing outside India connected with offering services to people in India.
03What we collect
Website visitors and sample requests
- What you enter in our forms: name, work email, company or lab, what you need (raw video, annotated video or both), tasks of interest and your message.
- Technical data our hosting provider records when you load a page: IP address, browser and device type, pages requested and time of the request.
- Preferences stored in your own browser (see Cookies and storage).
Clients
- Business contact details, role, correspondence, contract and invoicing information, and delivery records.
Capture participants
- Identity and contact: name, phone number, address, age confirmation, and the identity details we must keep to contract with and pay you.
- Payment: bank or UPI details used to pay you for recordings.
- Recordings: first-person video of your hands, tools and workspace while you work, and any sensor streams a project needs, such as depth and motion (IMU).
- Annotations derived from recordings: hand keypoints and pose, object boxes and outlines, action segments, captions and question-and-answer labels.
- Records: a pseudonymous contributor ID linking each clip to you, the consent record for every clip, headset serial numbers and the history of any requests you make.
Bystanders
- Incidental images of people near a participant. Faces are blurred automatically on the headset while recording, before footage leaves the device. We do not try to identify bystanders.
What we do not do. We do not build face templates, identify people by their face or voice, infer sensitive traits such as health, religion or caste, or use personal data for advertising.
04Why we use it, and our legal basis
We use personal data only for the purposes below. If we need it for something new, we will tell you first and, where the law requires it, ask for your consent.
| Purpose | Data used | DPDP basis | GDPR basis |
|---|---|---|---|
| Reply to enquiries and sample requests | Form details, correspondence | Consent (Section 6), or data you give voluntarily for this purpose (Section 7(a)) | Steps you ask for before a contract (Art. 6(1)(b)); legitimate interests in answering business enquiries (Art. 6(1)(f)) |
| Deliver, invoice and support client work | Client contact, contract and billing data | Data given voluntarily for this purpose (Section 7(a)); compliance with law | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Record, annotate and license egocentric datasets | Recordings, sensor data, annotations, contributor ID, consent records | Consent, recorded for every clip (Section 6) | Consent (Art. 6(1)(a)), where the GDPR applies |
| Enrol and pay capture participants | Identity, contact, age confirmation, payment details | Consent (Section 6); compliance with tax and labour law | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Prove consent, answer rights requests and grievances | Consent records, request history | Compliance with DPDP | Legal obligation (Art. 6(1)(c)) |
| Keep systems secure and prevent misuse | Access logs, device identifiers | Compliance with the security duties in Section 8(5) and Rule 6 | Legal obligation (Art. 6(1)(c)); legitimate interests in security (Art. 6(1)(f)) |
We do not make decisions about anyone based solely on automated processing that produce legal or similarly significant effects.
05Consent, and how to withdraw it
When we rely on consent, it is free, specific, informed, unconditional and unambiguous, and given by a clear action. Participants consent through a standalone notice that lists, item by item, the data we collect, why, and how to withdraw, exercise rights and complain to the Data Protection Board of India. Each recorded clip carries its own consent record, which both the participant and our clients can verify.
You can withdraw consent at any time, as easily as you gave it: email business@billionhours.ai, or tell your Billion Hours coordinator, quoting your contributor ID or registered phone number. When you withdraw:
- we stop processing the affected data and remove the clips from all future deliveries;
- we erase the data without undue delay, unless a law requires us to keep it;
- we instruct clients who already received the clips to delete them, as our licences require;
- we keep a record of the consent and its withdrawal, so we can show we acted on it.
Withdrawal does not affect processing that was lawful before it, and declining or withdrawing consent never affects your pay for work already recorded.
06People who appear in footage
We record only where participants have the right to record, and we brief participants to keep the camera on their task. Bystander faces are blurred automatically on the headset while recording, so an unblurred face never leaves the device. We do not try to identify anyone in the background, and our licences forbid clients from doing so.
If you believe you appear in our footage and want it removed, contact us with where and when it was recorded. We will locate and remove the clip from future deliveries.
08International transfers
Our capture, annotation and engineering teams are in India. Clients may be located outside India.
- From India: DPDP allows transfers outside India except to countries the Government of India restricts by notification. We check for such restrictions before each delivery and will not transfer data to a restricted country.
- From the EU or EEA: India does not have an EU adequacy decision. Where we receive personal data from the EU or EEA, we rely on the European Commission's Standard Contractual Clauses and assess the transfer's risks. A copy of the relevant safeguards is available on request.
09How long we keep it
We keep personal data only as long as the purpose requires, then erase it, unless a law requires us to keep it longer.
| Data | How long |
|---|---|
| Enquiries and sample requests | As long as needed to respond and follow up, unless you become a client |
| Client contract and billing records | For the contract and as long as tax and accounting laws require |
| Recordings and annotations | While consent is in place and the licence term runs; erased without undue delay after withdrawal or once the purpose ends |
| Participant identity and payment details | For the engagement and as long as tax and labour laws require |
| Consent records and request history | As long as needed to show we obtained and honoured consent |
| Security and access logs | At least one year, as the DPDP Rules require |
10How we protect it
- Encryption on the headset, in transit and in storage.
- Faces blurred on the device before footage is uploaded.
- Pseudonymous contributor IDs: annotators and clients never see participants' names or contact details.
- Role-based access, so people see only the data their job needs.
- Logging and monitoring of access, with logs kept for at least one year.
- Backups, a device inventory linked to serial numbers, and a process for lost or stolen headsets.
- Written contracts with every service provider that handles personal data, requiring equivalent safeguards.
11If something goes wrong
If a personal data breach occurs, we will contain it, investigate and:
- inform each affected person without delay, explaining what happened, the likely consequences, what we are doing and what they can do;
- inform the Data Protection Board of India without delay, with a detailed report within 72 hours of becoming aware of it, as DPDP Rule 7 requires;
- where the GDPR applies, notify the competent supervisory authority within 72 hours unless the breach is unlikely to put anyone at risk, and tell affected people without undue delay where the risk is high.
12Your rights
Under DPDP
- Access: a summary of your personal data and how we process it, and the identities of the other Data Fiduciaries and Data Processors we have shared it with.
- Correction and erasure: to correct, complete or update your data, and to have it erased when it is no longer needed for the purpose you consented to.
- Grievance redressal: a response from our Grievance Officer within 90 days.
- Nomination: to nominate someone to exercise your rights if you die or become unable to.
- Withdraw consent at any time, as described above.
- Complain to the Data Protection Board of India after using our grievance process.
Under the GDPR
- Access, rectification, erasure, restriction of processing and data portability.
- To object to processing based on legitimate interests, and to any direct marketing.
- To withdraw consent at any time.
- To lodge a complaint with a data protection supervisory authority, in particular where you live or work.
You also have duties under DPDP: to give accurate information, not to impersonate anyone and not to file false or frivolous complaints.
13How to make a request
Email business@billionhours.ai with the subject "Privacy request", or ask your Billion Hours coordinator. Tell us what you want us to do and include:
- Website visitors and clients: your name and the email address you used with us.
- Participants: your contributor ID or registered phone number.
- Bystanders: where and when the recording took place.
We may ask for information to confirm your identity before acting. We reply to requests and grievances within 90 days as DPDP requires, and to GDPR requests within one month, extendable by two further months for complex requests, in which case we will tell you why. Requests are free unless they are clearly unfounded or excessive.
14Children
We do not enrol anyone under 18 as a participant, and we confirm age at enrolment. We do not knowingly process children's personal data, we do not record in spaces where children are present, and we never track, monitor the behaviour of or target advertising at children. If a child is captured by accident, their face is blurred on the headset and we remove the clip from our datasets.
16Changes to this policy
We will update this policy when our practices or the law change, and change the effective date above. If a change affects how we use data you have already given us, we will tell you before it takes effect and, where required, ask for your consent again.
17Contact and grievances
Billion Hours AI Pvt Ltd, Grievance Officer
Email: business@billionhours.ai (subject "Privacy request" or "Grievance")
If you are not satisfied with how we handle a grievance, you can complain to the Data Protection Board of India. If the GDPR applies to you, you can also complain to your local supervisory authority. See our compliance page for how we meet both laws.