Privacy Policy

Archival AI (https://archivalai.org) is a heritage image annotation platform operated by an academic research collaboration between the National University of Singapore (NUS), Nanyang Technological University (NTU) and AI Singapore, supported by a grant from the National Heritage Board (“we”, “us”, “our”).

This policy explains how we collect, use, disclose and protect personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA). By creating an account or using the platform, you consent to the practices described in this policy.

Account information: your name, email address and password. Passwords are stored only as bcrypt hashes; we never store or see your password in plain text.

Content you contribute: heritage images you upload, the metadata you provide with them (such as titles, descriptions, dates and locations), and the annotation reviews and corrections you submit.

Usage data: technical logs generated when you use the platform, such as IP address, browser type, pages visited and timestamps. We use these for security, troubleshooting and service operation.

To operate the platform: creating and managing your account, authenticating you, storing and displaying your contributions, generating AI-assisted annotations and translations, and providing the platform in multiple languages.

For research: studying and improving AI-assisted heritage annotation, including the preparation and publication of anonymised benchmark datasets and aggregated results in academic publications.

For moderation: reviewing uploads, annotations and corrections to keep content lawful, accurate and appropriate.

Important: uploaded images and approved annotations or corrections may be published on the platform and included in openly released research datasets under open licences. You are reminded of this each time you submit a contribution.

Published contributions are not linked to your name, email address or other account details unless you expressly ask to be credited. If you do not want material to be published, please do not submit it.

You may ask us to remove a contribution at any time. However, once a dataset has been openly released, we cannot recall copies that third parties have already downloaded.

Research partners: we may share contributions and evaluation data with collaborating institutions such as AI Singapore for evaluation research, in anonymised or aggregated form.

Service providers (data intermediaries): Cloudflare, Inc. hosts the platform and stores our data (Cloudflare Workers, D1 database and R2 object storage). Uploaded images and metadata are processed by Google (Gemini API) to generate draft annotations, and translations are generated with AI Singapore's SEA-LION model running on Cloudflare Workers AI.

We may also disclose personal data where required by law. We do not sell personal data and we do not share it with advertisers.

Your data is stored on Cloudflare infrastructure and may be stored or processed outside Singapore. Where personal data is transferred overseas, we take the steps required by the PDPA to ensure a standard of protection comparable to that under the PDPA.

We keep account information for as long as your account is active, and technical logs for a limited period. Contributed content is kept for as long as needed for the platform and the research project, subject to Section 4 and your rights under Section 8.

We protect personal data with measures such as bcrypt password hashing, encryption in transit (HTTPS), and access controls limiting who on the research team can see the data. No online service can guarantee absolute security, but we work to protect your data against unauthorised access, use and disclosure.

You may request access to the personal data we hold about you, and request the correction of any error or omission, by writing to contact@archivalai.org.

You may withdraw your consent to our collection, use or disclosure of your personal data, and you may ask us to delete your account and personal data. We will respond within a reasonable time as required by the PDPA. Withdrawing consent may mean that we can no longer provide you with some or all of the platform's features.

The platform uses only strictly necessary cookies, such as sign-in session cookies, security (CSRF) cookies and your language preference. We do not use advertising or third-party analytics cookies. See our Cookie Policy for details.

Questions, requests or complaints about personal data can be sent to our data protection contact at contact@archivalai.org. We will do our best to resolve any concern promptly.

We may update this policy from time to time, for example when the platform or the law changes. The revised policy will be posted on this page with a new “last updated” date, and significant changes will be highlighted on the platform.