Legal Center and Policies | Privacy Notice

Privacy Notice – Research and Development

Versi: 1.12Efektif mulai 5 Mei 2026

DISCLAIMER

This Privacy Notice is for Research and Development purposes only, it is not applicable to World App users and does not reflect data processing in the context of verifying your World ID with an Orb.

To ensure that World ID is as reliable and inclusive as possible, the neural networks powering it require to be trained with data from a diverse population. To collect that training data the World contributor Tools for Humanity collects this data transparently in dedicated data collection campaigns for which the following privacy notice applies. You can delete your full data at any time as described in the section on data subject rights.

Name and contact data of the data controller	Tools for Humanity Corp. (“TFH”, “us”, “we”) 650 7th Street San Francisco, CA 94103, USA
Categories of Data Collected	Depending on the data collection campaign we may collect the following categories data with your consent: If you take part in Orb & phone testing or data collection we collect the following information Image Data: Images of your irises and eyes captured in visible and near-infrared spectrum, as well as images of your face, including 3D depth and thermal images. Derivatives: We create abstractions of the Image Data using advanced algorithms and neural networks to enable machine comparisons and interactions. If you take part in a data collection via a third party platform (mini-job campaign) we may collect the following information: We collect your passport photo (face image). We also collect the selfie (i.e. the photo you took of your face) to match the passport photo, your gender and ethnicity. Depending on the campaign, we may ask adult individuals to share historical photos that are up to 20 years old, provided they were taken when the individual was at least 12 years old, to help benchmark and improve our underage prevention systems. These models are intended to support our efforts to ensure that only adults access our services and to verify user uniqueness. Video recordings: depending on the research or testing initiative, we might collect, store and analyze a video of your Orb verification and video data of peoples faces captured with a phone. To ensure that our products are secure, reliable, and inclusive, the models powering them require training data from a diverse population. To help prevent algorithmic bias and ensure that our models are trained on data representative of the global population, we may collect certain demographic attributes, such as gender and ethnicity, where provided. If testing is conducted using the Contributor ID App (data collection app), the following data may be collected: Required information: Email address (used as an identifier and to enable users to exercise their data rights) First name and last name Initials of both parents’ first names (used for unique ID generation) Month and year of birth Timestamps related to consent and participation Optional information (depending on the campaign): Gender Ethnicity Additional attributes such as height or eye color This information is only collected if actively provided within the application. The use of an email address as an identifier ensures that individuals retain control over the data associated with their account.
Purposes and legal grounds of data processing	In the context of this processing we collect the personal information described above for the following purposes: To perform product testing, to enhance user experience, ensure product usability, and maintain product security. To develop and improve our data collection tools. To train neural networks and AI models which includes to label data to promote algorithmic fairness by considering perceived gender, age range, and skin color. The legal basis for processing your data is your explicit consent, which allows us to utilize this information responsibly and ethically in our research and development initiatives. Participants under the age of legal majority must have prior, verifiable consent from a parent or legal guardian to participate. Where consent is provided by a guardian, the participant's consent must be confirmed or renewed by the participant once they reach the legal age of majority.
Data Security	Access control: Your data is stored in a secure server environment with limited access, meaning that only authorized personnel can view or handle it. Encryption: Your data is encrypted at rest and in transit. Data Management: You can easily manage your personal data through our web based Data Management Application (‘Contributor ID App’).
Categories of recipients	We do not share the images or derivatives of the images with anyone not working on the World Project. Only the following categories of recipients may receive your data to enable the above listed purpose of processing. Subsidiaries Internal teams We only share your data with team members who need to have access to the data to perform their tasks (access on a need to know basis) Third party service providers. In this context we use the following categories of processors to enable the data processing: Cloud service providers Communication tools IT service provider to provide the interface for testing and data collection
Retention period	We retain the NFC data, video recordings, as well as, all image data and derivatives for a maximum of five (5) years after collection. We store your Administrative Information for as long as we store the corresponding data. In any case, we will delete the NFC Data, Image Data or any other type of data collected for the purpose of this Notice upon your request.
Subjects’ rights	Under the applicable data protection laws you have the following rights: to information about the personal data we process to access to and a copy of the personal data to correction of personal data to deletion of personal data to demand that we restrict processing to object to personal data processing based on legitimate interests to contact the competent supervisory authority The responsible supervisory authority under the EU’s General Data Protection Regulation (“GDPR”) is: The Bavarian Data Protection Authority (“BayLDA”). Right to revoke your consent to the use of your personal data If the data was collected in our Contributor ID App you can also delete your data by clicking the button "request full data deletion” in the settings of the Contributor ID App without contacting support via email. For collections conducted via partner or crowdsourcing platforms, the standard way to exercise privacy rights (e.g. request data deletion) would be through the channels directed by the respective partner.
Necessity	You do not need to provide your personal data or agree to video recording in order to participate in product tests. You can also share your feedback directly with us.
Third country transfers (GDPR), under the CCPA already who you share the personal data with	Data is stored and processed in the USA and EU. TFH complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Further information can be found in TFH’s general privacy notice available under www.toolsforhumanity.com
Sharing and Selling of Personal Information	We are not selling personal data.

PRANDD20260505