A dataset is only as usable as the paperwork behind it. Every item Perit delivers carries the consent it was collected under, the guide it was labelled to, the people who reviewed it and the terms it is licensed on — so a model trained on it can answer the questions a regulator will ask.
Contributors consent on the file, before they speak or film, to training and evaluating AI systems for Perit and its customers. No blanket consent, no buried clause.
Perpetual, non-exclusive, internal model development and evaluation. No re-identification, no voice enrolment or verification, no resale of the raw corpus. Exclusive terms are priced on the order form, not implied.
The manifest carries locale, device, condition, consent reference, guide version and reviewer chain. Provenance is a column, not a promise.
Every batch reports what it contains — locales, devices, conditions, speaker demographics where consented — so bias can be measured rather than assumed.
Every label is produced by a person who passed a calibration gate, and every batch is QA-sampled by a reviewer. The quality report ships with the delivery.
A collection lives in one region. If a transfer is ever instructed, it runs on Standard Contractual Clauses with the route written down.
None of these is a certification. Each is a set of obligations, and this is what we do about them.
| Regime | What it covers | How we handle it |
|---|---|---|
| GDPR / UK GDPR | Personal data of EU and UK contributors and speakers. | Consent as the lawful basis for recordings; contract and legitimate interest for the platform. Data subject requests answered within 30 days. EU collections stay in Frankfurt; transfers only on SCCs. |
| India DPDP Act 2023 | Personal data of contributors in India — the largest share of the bench. | Consent notice in plain language before capture, withdrawal honoured before payout, data principal requests handled from the Mumbai region. |
| CCPA / CPRA | California residents in any collection. | We do not sell personal data. Contributors can access, delete and opt out; datasets carry IDs, not names. |
| HIPAA | Recordings from healthcare settings that may carry protected health information. | Treated as PHI: minimum-necessary access, encryption in transit and at rest, workforce trained on PHI handling, and a Business Associate Agreement on request. Contributors are asked not to include real patient details in prompted sessions. |
| EU AI Act — data governance | Article 10 obligations on training, validation and test data for high-risk systems. | We supply what a provider needs to document: collection design, provenance, coverage statistics, labelling procedure and the human review behind it. |
| Biometric regimes | A voice recording is biometric data in several jurisdictions (EU, Illinois BIPA among them). | Explicit, specific consent at the start of every session. No speaker-recognition profiles are built; no recording is licensed as an identity artefact. |
The contributor reads, in plain language, what will be recorded, what it trains and who will receive it.
Agreement is captured as part of the recording itself, so it travels with the audio or video rather than living in a separate database.
Any session can be withdrawn before payout. It is deleted, not archived.
Every delivered item carries its consent reference, so a customer can trace any file back to the agreement it was collected under.
Collection specs, guide versions, quality reports and coverage statistics are part of every delivery. The data processing agreement and control summary are one email away.