hCaptcha

hCaptcha is a CAPTCHA service known for paying the site owners that use hCaptcha.

3/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes

0/10

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Does the service allow third-party access to private personal data? Yes

0/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

We share or disclose information in the following cases:

Upon direct request from a Visitor or User, or otherwise where specific consent was given.
With our customers and others interested in acquiring Labeled Data.
With vendors we engage to provide essential aspects of the Site and the Service, such as data storage and hosting, and only for those purposes.
With vendors to help us collect and use Analytics Information.
As necessary to comply with applicable law, including governmental requests, law enforcement requests, and otherwise to protect the rights, privacy, safety, or property of you, us, or others.
With others for any legitimate business purpose, provided the information is anonymized.

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

We share or disclose information in the following cases: [...] As necessary to comply with applicable law, including governmental requests, law enforcement requests, and otherwise to protect the rights, privacy, safety, or property of you, us, or others.

Transparency

Does the policy outline the service's general security practices? Somewhat

1/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We implement appropriate technical and organizational measures to protect the information we collect and store. Unfortunately, no security measures are 100% foolproof, and as such no network or system (including ours) can be guaranteed to be 100% secure against destruction, loss, alteration, unauthorized disclosure of, or access to information we collect and store. If you believe your information may not be secure for any reason, please contact us immediately at support@hcaptcha.com.

Is the policy's history made available? Only the date it was last modified

3/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Collection

Does the service collect personal data from third parties? Yes

0/10

This includes the use of data brokers and independent verification authorities (such as background check providers).

Score

Yes

Yes, but for critical data only

For example, a blog providing user avatars or a bank conducting identity verification would count.

70%

100%

Citation

As discussed above, we (and our third party vendors) collect Analytics Information in part through the use of cookies, web beacons, and other tracking technologies. In some instance, we work with third party vendors to employ cookies for the purposes of collecting Analytics Information.

We use Sentry to collect debugging data when a user experiences an error. For information on how Sentry collects and processes data, please click here. We have executed a Data Processing Agreement ("DPA") with Sentry.

We use Cloudflare to optimize our web traffic. For information on how Cloudflare collects and processes data, please click here. We have executed a DPA with Cloudflare.

We use Customer.io for programmatic notifications to users. For information on how Customer.io collects and processes data, please click here. We have executed a DPA with Customer.io.

We previously used Google Analytics to collect Analytics Information. For information on how Google Analytics collects and processes data, please click here. We have executed a DPA with Google.

We use Honeycomb.io for analysis of our systems. For information on how Honeycomb.io collects and processes data, please click here. Honeycomb.io has certified under the EU-US Privacy Shield framework and complies with GDPR data protection requirements.

If you would prefer not to block the use of cookies or other tracking technologies, please see "Managing Your Information," below. Please note that doing so may negatively impact your experience using the Site or Service, as some features may not work properly.

Is it clear why the service collects the personal data that it does? Yes

10/10

Score

Somewhat

30%

Mostly

70%

Yes

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We use the information we collect for the following purposes:

To provide a market for Labeled Data. Our Service enables high volume data labeling and human review for machine learning systems as a service to website owners and companies who need help getting their data labeled. To that end, we disclose Labeled Data to our customers interested in acquiring Labeled Data.
To administer User accounts and provide the Service. We use Personal Information in order to associate specific accounts with Users and to provide them the Service, to respond to requests or inquiries, to provide support or technical assistance, and to facilitate payments.
To improve to Site and the Service. We use Analytics Information to improve our existing and develop new services and offerings and to customize existing and future product offerings to the wants and needs of our Users.
To derive market insights. We use Analytics Information to analyze the market and conduct business analyses related to the Site and our Services, and for other research purposes.
To secure our services and systems. We use Analytics Information to secure our systems by identifying potential threats and vulnerabilities, and to otherwise protect the information we collect.
For any legitimate business purpose, provided that the information is anonymized.

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? No

0/10

Does the policy list the personal data it collects? Only summarily

3/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

We collect information from individuals who interact with our Site and Services, including those who incorporate the Service into their website ("Users") and the end users who interact with the Service through the websites of our Users.

We collect the following categories of information:

Information that can be used to identify or contact an individual ("Personal Information"), such as name and email address. We collect Personal Information from our Users when they give it directly to us (for example, by filling in a form when signing up for an account).
Information collected automatically as a result of a Visitors or Users use of the Site or the Services ("Analytics Information"), such as IP addresses, browser type, Internet service provider, platform type, device type, operating system, date and time stamp of access, and other similar information. Some Analytics Information is collected on our behalf by third parties we engage for that purpose, and some Analytics Information is collected through a variety of tracking technologies, including cookies (see "See Third Party Analytics and Tracking Technologies", below).
Information collected as a result of individuals answering prompts through the Service ("Labeled Data"), such as image labeling data, text converted from audio files played to those individuals, answers to questions, and other prompts ge

Last Updated

May 26, 2021

Sources

Source #1 ↗

Contributors

doamatto