Consumer Privacy Policy

Last Updated: October 12, 2026

This Consumer Privacy Policy explains how Aquilae AI, Inc. (Aquilae AI, Sphere, we, us, or our) collects, uses, stores, and shares information when you use the Sphere mobile application and related consumer services (collectively, the Services).

This Policy applies specifically to individuals who use the Sphere mobile application to upload photos, videos, and other content in exchange for compensation (Contributors or Consumers). For information about how we handle data on the broader Sphere marketplace, please see our Marketplace Privacy Policy.

By creating an account or using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Account Information

When you create or manage an account, we collect:

  • Name
  • Email address
  • Phone number
  • Authentication credentials
  • Profile photo (if provided)

When you accept our Terms we record the version you accepted, the time, your device type, and the country associated with your IP address, together with your confirmation that you are at least 18.

1.2 Content You Upload

When you upload photos, videos, or other media, we collect and store:

  • The photo or video files themselves
  • EXIF metadata embedded in your files, which may include camera model, lens information, date and time the photo or video was taken, GPS coordinates and geolocation data, device identifiers, and image settings (exposure, ISO, aperture)
  • File format, dimensions, file size, and duration (for video)
  • Your ownership and rights attestations
  • The Task identifier (if uploaded for a specific Task)

Important: Photos and videos may contain embedded geolocation data that reveals where the content was captured. By uploading content, you consent to Sphere processing this location data for content classification, quality review, and marketplace purposes. If you do not wish to share location data, you may disable location embedding in your device's camera settings before capturing content.

1.3 Financial and Tax Information

To process payouts, we collect:

  • Payout method selection (Stripe Connect, PayPal, or bank transfer)
  • Stripe Connect account information (processed by Stripe)
  • PayPal email address (if selected)
  • Bank account details (if selected)
  • Tax documentation (Form W-9 for U.S. persons or Form W-8BEN for others): your name, address, country, tax identification number, and electronic signature

Payment processing is handled by third-party processors. We do not store full bank account numbers or payment card details on our servers.

Identity verification

Before your first payout (when your approved earnings reach $25) we ask you to verify your identity through Didit, our verification processor. Didit collects a photo of your government-issued ID, a selfie, and a liveness check, and compares your face to your ID. This is biometric data and is processed by Didit under its own terms and privacy notice, not stored by us. Sphere receives and stores only the outcome: verification status, a reference number, the country and type of your ID, whether you are over 18, and the date of verification. We do not store your ID images, selfie, or face templates.

Tax forms are stored encrypted and kept for the period tax law requires (see Section 8).

1.4 Device and Technical Data

We automatically collect:

  • Device type, model, and operating system version
  • Unique device identifiers
  • App version
  • IP address
  • Network information
  • Approximate location inferred from IP address

1.5 Usage Data

We collect information about how you use the Services, including:

  • Tasks viewed and participated in
  • Upload history and frequency
  • Content review outcomes (accepted, rejected, pending)
  • Earnings and payout activity
  • App navigation and feature usage
  • Crash reports and performance data

1.6 Communications

If you contact us for support, we collect:

  • Your name and email
  • Message content
  • Any attachments you send

1.7 Analytics and Third-Party SDKs

The Sphere mobile application may include third-party software development kits (SDKs) for analytics, crash reporting, and performance monitoring. These SDKs may collect device identifiers, usage data, and crash logs. We use this data to improve app stability and the user experience.

2. Legal Basis for Processing (EEA, UK, and Similar Jurisdictions)

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following bases:

  • Contract performance: processing necessary to provide the Services, manage your account, process uploads, calculate earnings, and execute payouts (Sections 3.1, 3.2)
  • Legitimate interests: fraud prevention, content quality and authenticity analysis, platform security, and service improvement, where these interests are not overridden by your rights (Sections 3.2, 3.3, 3.5)
  • Legal obligation: tax reporting, financial record-keeping, and responding to lawful requests (Sections 3.1, 4.3)
  • Consent: promotional communications and optional data processing, which you may withdraw at any time (Section 3.4)

3. How We Use Information

3.1 Operating the Services

We use your information to:

  • Create and manage your account
  • Receive, store, and process your Content uploads
  • Evaluate Content against Task requirements
  • Organize Content into collections for the marketplace
  • Calculate and track your earnings
  • Process payout requests

3.2 Content Analysis and Quality

We use automated systems to:

  • Analyze Content for quality, authenticity, and compliance
  • Detect AI-generated or synthetic content
  • Identify duplicate or substantially similar uploads
  • Generate content labels, classifications, and metadata using computer vision
  • Evaluate whether Content matches Task requirements
  • Generate perceptual hashes for deduplication
  • Extract and process keyframes from video content

We also use automated tools to clear Content for sale: reverse image search to check whether a photo already exists online, safety classification (for example Google Cloud Vision SafeSearch) to detect prohibited or sensitive material, and face detection to find photos that show people so we can ask whether they have consented. Where a photo shows a consenting person we store the model release you sign (your declaration and signature). We use face detection, which only finds where faces appear in a photo, to ask that question. We do not use facial recognition to identify the people in your uploads. Our reverse image search compares whole photos with pages on the public web and may match a widely published image; we do not use it to identify individuals. (Identity verification before your first payout is separate: see Section 1.3.)

These automated processes help maintain marketplace quality and ensure Contributors are compensated fairly. Content that fails automated checks may be rejected or flagged for manual review.

3.3 Fraud Prevention

We use information to detect and prevent:

  • Fraudulent uploads or false attestations
  • Duplicate account creation
  • Manipulation of contribution counts or earnings
  • Abuse of payout systems

3.4 Communications

We may use your contact information to send:

  • Transaction confirmations and payout notifications
  • Task announcements and opportunities
  • Account and security alerts
  • Service updates and policy changes

3.5 Improvement

We use aggregated and anonymized usage data to improve the Services, develop new features, and enhance the Contributor experience.

4. How We Share Information

4.1 With Buyers (Through the Marketplace)

When your Content is sold as part of a collection, the buyer receives:

  • The Content files (photos, videos)
  • Associated metadata, labels, and classifications
  • Provenance information (for example, that the content is human-created and rights-attested)

We do not share your name, email, contact information, or account details with buyers. Content is sold as part of curated collections, not attributed to individual Contributors.

4.2 With Service Providers

We share information with trusted vendors who help operate the Services:

  • Cloud infrastructure: hosting, storage, and computing (Google Cloud Platform)
  • Payment processing: payout execution (Stripe, PayPal)
  • Identity verification: Didit (ID, selfie, and liveness checks before your first payout)
  • Content analysis: Google (Cloud Vision for image labeling and safety classification; Google Lens for reverse image search, which receives a link to your photo)
  • AI image and file analysis: OpenAI, which may receive a copy of an image, or text derived from it, to write captions, tags, and descriptions when a file in a collection is analyzed (this does not run automatically when you upload)
  • Analytics: app performance and crash reporting

All service providers are contractually required to protect your data and use it only for the purposes we specify.

4.3 For Legal Reasons

We may disclose information if required to:

  • Comply with law enforcement requests, subpoenas, or court orders
  • Protect the rights, property, or safety of Sphere, our users, or the public
  • Prevent fraud or enforce these Terms
  • Meet tax reporting obligations

4.4 Business Transfers

If Sphere is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Content Ownership and Licensing

You retain ownership of all Content you upload.

When Content is sold to a buyer as part of a marketplace transaction, the buyer receives a license to use it — not ownership. Sphere does not claim ownership of your Content and does not sell ownership rights.

Sphere does not:

  • Claim ownership of your Content
  • Train its own AI models on your Content
  • Use your Content for purposes other than operating the marketplace

6. Photo and Video Metadata

Photos and videos you upload may contain metadata embedded by your device. This metadata is an important part of the Content's value in the marketplace because it establishes provenance and authenticity. Specifically:

  • Geolocation data (GPS coordinates) may be included in your photos and videos. This data may be processed by Sphere and shared with buyers as part of Content metadata.
  • Device information (camera model, settings) helps verify Content authenticity.
  • Timestamps confirm when Content was captured.
  • Editing and provenance signals (such as the software that last saved the file and embedded content credentials) help us check that Content is original and that you hold the rights to it.

We use this metadata and other device signals for rights clearance: detecting duplicates, edited or AI-generated files, and copies found elsewhere online.

If you do not want location data included with your uploads, disable location services for your camera app in your device settings before capturing content. Sphere is not responsible for metadata embedded in files by your device before upload.

7. Device Permissions

The Sphere mobile application may request the following device permissions:

  • Camera: to capture photos and videos directly within the app for upload
  • Photo Library: to select existing photos and videos from your device for upload
  • Notifications: to send you alerts about earnings, Task opportunities, and account activity

You can manage these permissions at any time through your device's settings. Denying permissions may limit certain features of the app.

8. Data Retention

We retain information as follows:

  • Account data: retained while your account is active and for a reasonable period after closure for legal and compliance purposes
  • Uploaded Content: retained while on the platform. Content included in sold collections is retained as long as the buyer's license is active.
  • Transaction and payout records: retained for tax, audit, and compliance purposes as required by law (typically 7 years)
  • Technical and usage data: retained for up to 24 months, then aggregated or deleted
  • Content analysis results: retained as long as the associated Content exists on the platform
  • Identity verification outcome: retained while your account is active and as required for compliance (we do not hold your ID images or biometric data; Didit retains them under its own policy)
  • Tax forms (W-9, W-8BEN): retained for the period required by tax law, typically up to 7 years
  • Model releases and Terms acceptance records: retained for as long as the related Content is licensed, plus the period needed to defend legal claims

9. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate personal data
  • Delete your personal data (subject to legal retention requirements and existing license obligations)
  • Export your data in a portable format
  • Opt out of promotional communications
  • Withdraw consent for optional data processing

To exercise these rights, contact us at contact@getsphere.xyz.

Note: Deleting your account does not retroactively remove Content from collections that have already been sold and licensed to buyers. See our Consumer Terms of Service for details.

10. Additional Rights for EEA and UK Users (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR:

  • Right to object: you may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
  • Right to restrict processing: you may request that we restrict the processing of your personal data in certain circumstances.
  • Right to data portability: you may request a copy of your personal data in a structured, commonly used, machine-readable format.
  • Right to lodge a complaint: you have the right to lodge a complaint with your local data protection authority (for example, the ICO in the UK, or your national DPA in the EU).
  • Automated decision-making: where we use automated systems to evaluate Content (for example, task fit scoring or AI-detection), you have the right to request human review of any decision that significantly affects you.

To exercise any of these rights, contact us at contact@getsphere.xyz. We will respond within 30 days (or the timeframe required by applicable law).

11. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

  • Right to know: you may request the categories and specific pieces of personal information we have collected about you, the sources, the business purposes for collecting it, and the categories of third parties with whom we share it.
  • Right to delete: you may request deletion of your personal information, subject to certain exceptions (for example, legal retention obligations, completed transactions).
  • Right to correct: you may request that we correct inaccurate personal information.
  • Right to opt out of sale or sharing: Sphere does not "sell" personal information as defined under the CCPA. When your Content is included in a sold collection, the transaction is a licensing arrangement for the Content itself, not a sale of your personal information. Personal identifiers (name, email, contact details) are never shared with buyers.
  • Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at contact@getsphere.xyz. We will verify your identity before processing your request.

12. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 (or the minimum age of digital consent where you live, if higher). If we learn that we have collected information from a child under that age, we will delete it.

People under 18 may upload Content with a parent's or guardian's permission, but they are never eligible for payouts. We do not ask them to complete identity verification for payout purposes, and we do not collect tax forms or payout details from them.

13. International Data Transfers

Sphere is based in the United States. If you access the Services from outside the U.S., your information — including Content you upload — will be transferred to and processed in the United States, where data protection laws may differ from your jurisdiction.

For users in the EEA, UK, or Switzerland, we rely on the following transfer mechanisms as applicable:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • The UK International Data Transfer Agreement or Addendum, where applicable
  • Any applicable adequacy decisions
  • Your explicit consent to the transfer, provided at account creation

Our service providers who process data on our behalf are contractually bound to provide equivalent data protection safeguards.

14. Security

We implement reasonable administrative, technical, and physical security measures to protect your information, including encryption of data in transit and at rest, access controls, and regular security assessments.

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

15. Do Not Track

The Services do not respond to Do Not Track browser signals, as no uniform standard for responding to such signals currently exists.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email, push notification, or in-app notice and update the "Last Updated" date above. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

17. Contact Us

For questions about this Privacy Policy or your data, contact:

Aquilae AI, Inc.
Email: contact@getsphere.xyz