Capture Study Privacy Notice
Effective date: 4 November 2026
Key information: This is a paid commercial data-collection study. SpAItial intends to use your designated study captures to develop its own AI models and to sell or license captured images or video, scene data and resulting 3D datasets to other companies, including AI developers, for their own model training, evaluation and product development. This applies only to captures submitted for this study, not other content in your account.
1. Who is responsible?
SpAItial Ltd, company number 15994344, is the controller responsible for our study processing. Our address is 1–2 Paris Garden, London SE1 8ND, United Kingdom. Contact privacy@spaitial.ai about this notice, your rights or a privacy complaint.
Prolific operates the recruitment and payment platform and separately explains its processing in its own privacy notice.
2. Which captures does this cover?
This notice covers captures you deliberately submit through this study, together with associated study records. It supplements our general privacy notice. Its specific descriptions of study purposes, recipients and retention apply to those study submissions; our general notice continues to explain ordinary account and app processing.
The separate contributor agreement sets out permissions to use and commercially license your study materials. Receiving or acknowledging this privacy notice does not waive your data-protection rights.
3. What information do we collect, and where does it come from?
We receive information from you, your use of our capture tools and Prolific:
- Study administration: Prolific participant and submission identifiers, completion status, payment/review records, relevant study eligibility information supplied by Prolific, communications and a record of the notice and contributor agreement shown to you.
- Capture content: camera image frames showing the environment you choose to scan, and resulting 3D representations.
- Capture and technical information: scan/world/session identifiers, camera position and orientation, calibration, relative frame timing, capture diagnostics, device/app information and operational logs such as IP addresses.
- Account information: where an app account is required, account identifier and email address; Google sign-in also supplies your name and profile picture if available. This is used for account services and is not included in customer datasets.
- Incidental personal information: despite capture restrictions, a submission may accidentally reveal a person, readable text, an address or another identifying feature.
Captures are made with the SpAItial iPhone app. The app does not record audio and does not collect GPS or other precise location. Image files include standard camera settings from your phone (EXIF data), which we remove before any customer delivery. Depth and raw motion sensor data are off by default. We do not collect advertising identifiers. If you allow notifications, the app sends us a notification token. Our study website uses analytics, which may include recording how you use the page, only if you accept analytics cookies.
A scene may remain personal information when associated with your account or other identifying information, even if it contains no obvious name or face.
4. What must you avoid capturing?
Choose a space you are authorised to scan and prepare it before recording. Do not capture people, including yourself, children or people visible in reflections; identifiable personal photographs; readable personal documents, labels or screens; addresses, identity documents, financial details, passwords, health information or other sensitive personal information.
Do not provide information about housemates, visitors, colleagues or other people. Do not record private conversations. If you cannot avoid prohibited content, choose another space or stop the capture.
If personal information is uploaded accidentally, tell us through Prolific or at privacy@spaitial.ai, quoting the study and scan identifiers where available. We will restrict the affected material while assessing it and remove, redact or exclude it as appropriate. Giving these instructions does not remove our responsibility for information we receive.
5. Why do we use the information?
We use study information to:
- recruit and administer participation, link submissions to the study, assess completion, arrange payment through Prolific and provide support;
- detect fraud, secure the service and investigate capture or processing failures;
- review privacy and quality, remove identifying material and prepare suitable datasets;
- reconstruct, annotate and process environments, and train, fine-tune, evaluate and improve SpAItial AI models and products;
- sell or license privacy-cleared capture and 3D datasets to commercial customers, including AI developers, for their own training, evaluation and product development; and
- handle rights requests, disputes and applicable legal obligations.
We do not use account email addresses or Prolific identifiers as model-training material or include them in customer datasets. We do not seek to identify people from scenes, build identity profiles or perform facial recognition.
We will not knowingly include prohibited identifying or sensitive information in training or customer datasets. Captures that cannot meet our privacy requirements will be excluded. Removing an account identifier or blurring a face does not by itself establish that a scene is anonymous.
6. What are our lawful bases?
Where study information is personal data, we rely on:
| Purpose | Lawful basis |
|---|---|
| Administering your agreed participation, assessing delivery, arranging payment and providing necessary study support | Performance of our contract with you, where that processing is necessary for the agreement |
| Securing the service, fraud prevention, privacy/quality review, preparing datasets, and developing and commercially licensing environmental datasets, to the extent these operations involve personal data | Our legitimate interests in operating a reliable collection programme and developing and supplying useful 3D AI datasets, subject to necessity and balancing your rights and interests |
| Meeting applicable tax/accounting obligations, responding to legally binding requests or other mandatory requirements | Compliance with the relevant legal obligation |
| Optional processing expressly presented as consent-based, if offered | Your separate consent, which you can withdraw |
We do not treat acceptance of the contributor agreement as blanket consent to process personal data. Legitimate interests alone do not permit special-category processing; we do not request such information for this study.
7. Who receives information?
Service providers: authorised hosting, storage, authentication, computing and support providers process information to operate the study and capture pipeline. These include Google Cloud and Supabase where used. Our provider information is available online.
Prolific: we exchange necessary participant identifiers, submission status, payment/review and support information to administer participation. We do not send your captures or images to Prolific.
Commercial customers: we intend to supply privacy-cleared captured images/video, scene metadata and derived 3D datasets to AI developers and other organisations developing AI or 3D products. They use licensed datasets for their own purposes, rather than solely on our instructions. We exclude account email addresses, authentication details, Prolific identifiers and identifying scene content from customer deliveries. We assess identification risk in the intended recipient context and do not supply a capture if it fails that assessment.
Other recipients: professional advisers, regulators, courts or authorities where necessary and lawfully permitted. Any proposed business transfer involving study personal data remains subject to applicable data-protection requirements.
8. Where is information processed?
Your account and study records are stored in Sweden, with backups in Sweden and the United Kingdom. Your scans and the 3D worlds made from them are stored and processed in the United States. Some automated checks use Google's Gemini service, which may process data in other regions. Providers that run our background jobs, email and content delivery may process limited study information in the United States. Our analytics provider is hosted in the EU. Our staff work in the United Kingdom and Germany and may access study information remotely.
Where personal data is transferred outside the UK or EEA, we use an applicable adequacy arrangement or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum and EU standard contractual clauses, with additional measures where needed. You can request details or a copy of the applicable safeguards at privacy@spaitial.ai.
9. How long do we keep information?
| Information | Retention |
|---|---|
| Uploads awaiting privacy/quality review and excluded material | Reviewed within 30 days of upload. Excluded material is deleted within 30 days of exclusion. |
| Accepted captures and derived datasets while they remain personal data | Kept while we use them for the purposes in this notice and reviewed at least every 2 years. Source files and derived copies are deleted together when no longer needed, or when you successfully object or ask for deletion. |
| Participant-to-scan links, study communications and payment/review records | 12 months after the study closes, to handle payment queries and disputes. Prolific identifiers are then deleted. |
| Agreement/notice acceptance and legally required records | 6 years after the study closes, to meet accounting obligations and handle legal claims. |
| Deleted data in backups and processor copies | Database backups expire within 7 days. Deleted files are removed from storage within 30 days. Providers delete copies under their contracts, normally within 30 days. |
Information that has been genuinely anonymised may be retained and licensed for longer for the purposes described here. We do not treat a dataset or model as anonymous merely because it has been processed or trained.
Capture files stored on your phone remain there until you delete them or remove the app; we cannot remotely erase files held only on your device.
10. How do we protect information?
We restrict access to authorised personnel and providers who need it for their work. Our published controls include encryption in transit and at rest, staff single sign-on with multi-factor authentication and restricted administrative access to training infrastructure. Further information is on our security page.
Uncleared captures are restricted and excluded from training and customer distribution. Participant identifiers are kept out of customer deliveries, and privacy findings are addressed in affected source files and derived copies.
11. Your rights and your right to object
Depending on the circumstances, you can request access, correction, erasure or restriction of your personal data, and portability where processing is automated and based on consent or contract. These rights have legal conditions and exceptions.
Right to object: You can object, on grounds relating to your particular situation, to processing based on legitimate interests, including relevant dataset preparation, training and commercial use. Contact privacy@spaitial.ai. We will stop that processing unless we demonstrate compelling legitimate grounds that override your rights and interests, or it is needed for legal claims.
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
You may stop participating at any time. Payment and submission handling follow Prolific's applicable rules. Exercising privacy rights does not require you to waive payment entitlements.
If you ask for deletion, we will assess the personal data in source files, derived datasets and models where relevant, and notify recipients where the law requires. Licensing or training does not automatically remove your rights. Genuinely anonymous information may no longer be attributable to you and is outside personal-data rights. We will explain any limitation rather than assume that all distributed or trained material is exempt.
Contact us even if you have already deleted your app account; account deletion and handling a study-related rights request may involve different records.
12. Participation, automated checks and complaints
Participation is voluntary and there is no statutory requirement to contribute. If you do not provide the captures and minimum administration information needed for the study, we cannot complete the study arrangement with you.
Automated tools check each scan for completeness, technical quality and possible fraud. If your scan passes, it is approved and paid automatically. If it does not pass, you are told why and can scan again. We never reject a submission without a person reviewing it. If you think a check got it wrong, message us through Prolific and a member of our team will review it.
You can raise a privacy complaint with SpAItial at privacy@spaitial.ai. You also have the right to complain to the UK Information Commissioner's Office and, where applicable, your local data-protection authority.
We will bring material changes affecting your study personal data to your attention before applying any new use, and establish the necessary legal basis and permissions. An updated notice alone does not authorise retrospective commercial use.