Privacy Policy

BUDOVA ("Building Ukrainian Domain-Specific, Open Voice & Text Archives") is a research project of the KNUCA AI Lab at Kyiv National University of Construction and Architecture (KNUCA). This policy explains what personal data the BUDOVA website and contributor platform (budov.org) process, why, for how long, who receives them, and what your rights are.

We apply the Law of Ukraine "On Personal Data Protection" (No. 2297-VI) and, where it applies to our processing, the EU General Data Protection Regulation (GDPR).

This policy is published in Ukrainian and in English with the same content. If the two versions differ, the Ukrainian version prevails.

The controller of your personal data is:

Kyiv National University of Construction and Architecture (KNUCA), AI Laboratory — project BUDOVA
31 Povitryanykh Syl Ave., Kyiv, 03037, Ukraine
Data protection contact: dolhopolov_sy@knuba.edu.ua

Website visitors

• Technical data that every request carries — IP address, browser, the page requested — in the server’s logs and error telemetry.
• Usage data — pages viewed and actions such as opening the app — through PostHog product analytics: without your permission anonymously and without storing anything on your device; with it, under a random identifier kept in your browser (Section 13).

People who apply to contribute — the join form: name, email address, organisation (optional), role, message (optional), your agreement to this policy, and the IP address and time of the application.

Contributors

• Account — email address, name, role, password (stored only as a one-way hash) and, if you add them, a public display name and links to your GitHub, LinkedIn or website.
• Consent records — which document you agreed to and its version, when, the full name you typed as your e-signature, the IP address and browser of that moment, and whether you gave it at the consent gate or in the recorder.
• Contributions — your annotations (entity labels on construction texts) with the time spent, texts and terms you submit, and texts you add for reading aloud.
• Voice recordings — only if you record: the audio; what you read (the text, and any wording or comment of your own); your speaker region (required for reading aloud) and, if you give it, your town or village; technical measures of the audio (duration, sample rate, channels, signal level, noise, signal-to-noise ratio); and a speaker code (SPK-NNN) that keeps your recordings together.
• Speaker profile — optional: age band, gender, years of experience in construction, home language, profession, region, town, and how many texts you plan to read. The research team may keep the same coarse attributes, under the speaker code only, for speakers taking part in recording sessions.
• Activity and security data — sign-in times, failed sign-in attempts (for lockout), in-app notifications, and audit-log entries for actions such as consenting, exporting your data or withdrawing a consent.

Your voice is personal data: a recording can reveal who is speaking even without a name. We collect no financial data and no identity documents, and we ask for nothing beyond what is listed here.

• Your consent (Art. 11(1)(1) of Law No. 2297-VI; Art. 6(1)(a) GDPR) — for your contributions and their open publication, which you give by e-signing the Contributor Consent, and for analytics that keep an identifier in your browser, which you give in the cookie notice.
• Your separate, explicit consent to voice recording — given only if you tick the voice box at the consent gate or agree in the recorder before your first take. It covers recording your voice and publishing it as the Contributor Consent describes. If voice data are treated as special-category (biometric) data, this explicit consent is the condition we rely on (Art. 7(2)(1) of Law No. 2297-VI; Art. 9(2)(a) GDPR).
• Steps you asked for (Art. 11(1)(3) of Law No. 2297-VI; Art. 6(1)(b) GDPR) — handling your application and running your account.
• Legitimate interests (Art. 11(1)(6) of Law No. 2297-VI; Art. 6(1)(f) GDPR) — keeping the platform secure (logs, rate limits, the audit log), counting visits anonymously, analysing how contributors use the platform under their account number, and keeping proof of consents. You may object to this processing (Section 10).

Withdrawing a consent does not affect the lawfulness of processing carried out before the withdrawal.

• To run the platform: applications and invitations, sign-in, password resets, notifications and support.
• To build an open Ukrainian construction-domain corpus: texts annotated with named entities, and recordings of construction speech with their transcripts.
• For research on automatic speech recognition (ASR) and named-entity recognition (NER), and for scientific publications about the corpus.
• To publish the corpus as an open dataset under the CC BY 4.0 licence, from its first public release — none has taken place yet.
• To play recordings chosen by the team on the website’s /voices page — only approved recordings whose speaker’s voice consent stands, with their text, region and recording day.
• To keep the platform secure and to understand how it is used, so we can improve it.

We do not use voice recordings to recognise who is speaking. Speaker codes exist only to keep each speaker’s recordings together — for speaker-disjoint dataset splits and per-speaker statistics. We make no automated decisions about you, and we do not sell personal data.

What is in place today:

• Pseudonymous speaker codes — each contributor who records gets one stable code (SPK-NNN); no name or email appears with a recording.
• Minimal metadata in anything published — speech exports and dataset releases carry your region but never your town, no free-text notes and only the day of recording, under opaque file names. Speaker profile answers are never published.
• No embedded file metadata — when a recording is stored, the information its file format can carry about the recording software, device or browser, its tags and its creation time are removed.
• Region is dialect origin, not location — the region field says where your way of speaking comes from, never where you recorded.
• A separate voice consent — nothing is recorded before you give it, and you can withdraw it at any time.

Roadmap — planned, not yet implemented:

• Voice conversion (x-vector) and pitch shifting so the voice itself is non-identifiable
• Automated PII detection in transcriptions (names, addresses, phone numbers, licence plates)
• Manual reviewer pass to verify anonymization on a sample of releases

This is pseudonymisation, not anonymisation: a recording keeps the voice, and a voice can be recognised. Until the roadmap items ship, please take that into account before you record.

These service providers process data on our behalf:

• Microsoft Azure — hosting of the website and API, the database, storage of recordings and backups, server telemetry (Application Insights) and transactional email (Azure Communication Services: invitations, password resets). Region: North Europe (Ireland); email data stay in Europe.
• GitHub (a Microsoft company) — runs the nightly job that copies the database into our Azure storage.
• PostHog (EU cloud) — product analytics (Section 13).
• Hugging Face — dataset hosting. Before a release only private repositories are used, visible to the project team alone.

The public — from the first public release, the open dataset can be downloaded by anyone, worldwide, from Hugging Face, with archival copies on Zenodo; recordings chosen by the team can be heard on the /voices page (Section 5). What a published recording carries is set out in the Contributor Consent.

Your public display name — the nickname you set, otherwise the name on your account — your role, the profile links you add and your number of annotations may appear in the public contributor ranking.

We do not sell personal data, and we do not share it with other organisations.

We store personal data in the European Union (Microsoft Azure, North Europe; PostHog EU cloud). EU member states are parties to Council of Europe Convention 108 and are recognised as ensuring adequate protection under Art. 29 of Law No. 2297-VI.

GitHub may process the nightly backup copy outside the EU, including in the United States, under its data protection terms; the copy itself is stored only in our Azure storage in the EU.

Once a dataset is released openly, it can be downloaded anywhere in the world. That is what an open release means, and it happens only with your consent.

• Account, contributions and speaker profile — as long as your account exists; erasing the account deletes them (Section 10).
• Recordings — until you delete them, withdraw your voice consent (your unpublished recordings are then deleted) or erase your account.
• Applications — an approved application is deleted with the account. Rejected or unanswered applications are not yet deleted automatically; you can ask us to delete yours at any time.
• Consent records — while your account exists. After erasure we keep only proof of each consent — its type, the document version, how and when it was given or withdrawn, and a one-way (salted) hash of your email address, never the address itself — for 7 years after the end of the research project, so that we can show that data already published were contributed with consent.
• Audit log — kept for the security of the platform while the project runs. When an account is erased, the email address in its entries is replaced by a pseudonym and the IP addresses are removed; the entry recording the erasure itself keeps the IP address of the request.
• Backups — nightly database copies are kept for 30 days and the database’s own point-in-time backups for 14 days; a deleted recording can be restored from storage for 7 days. Erased data therefore disappear from every backup within 30 days.
• Server logs and error telemetry — 30 days.
• Analytics — PostHog deletes events one year after they are recorded (the period of our PostHog plan) and does not store IP addresses. When your account is erased, we delete the analytics profile linked to your account number — automatically where this is configured, otherwise on request.
• Open datasets — permanent once released; they cannot be recalled.

Under Ukrainian data-protection law and, where it applies, the GDPR, you have the right to:

• Access — receive a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — have your data deleted ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting earlier processing

In the app, the GDPR panel (the gear icon, Settings → Your Data & Privacy) lets you export your data, withdraw your data-processing or voice consent and delete your account. For anything else, or if you have no account, write to dolhopolov_sy@knuba.edu.ua. We reply within 30 days. Data already released in an open dataset cannot be recalled.

BUDOVA is for adults only: you must be 18 or older to take part — to contribute or to record your voice — and there is no way to take part with a parent’s or guardian’s consent. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.

• Encryption in transit (HTTPS/TLS) for every connection to the website and the API
• Encryption at rest provided by Microsoft Azure for the database and file storage
• Passwords stored only as one-way hashes; account lockout after repeated failed sign-ins; rate limits on sign-in and data endpoints
• Role-based access: only administrators can moderate, see the consent register or export speech data
• Recordings not yet moderated are accessible only to their speaker and the administrators
• An audit log of consents, withdrawals, exports, erasures and administrative actions
• Nightly backups, kept as Section 9 describes

Essential storage. The site keeps in your browser only what it needs to work: your sign-in session, language and theme, your answer to the cookie notice, and drafts and state of the annotation app. When you use the language switch, the language you chose (uk or en) is also kept for one year in a cookie named budova_lang (SameSite=Lax), so that our server can open the site in that language; it carries nothing else. Our hosting provider can also set a technical load-balancing cookie (ARRAffinity), which carries no personal information. None of this needs your consent.

Analytics (PostHog, EU cloud). The cookie notice asks once:

• Essential only — analytics run without storing anything on your device: page views and similar events are counted anonymously, under a random identifier that lives only until you leave the page. Nothing links them to you or to your account.
• Allow analytics — PostHog keeps a random identifier in your browser’s local storage, so that visits can be followed over time and through in-app navigation, and, once you sign in, links them to your account number (never your name or email).

From our server, PostHog also receives events about contributions — for example a sign-in, a submitted annotation and the time spent on it, or a recording made — under your account number, without your name, email or the content itself. We use no advertising, no cross-site tracking and no session recording.

You can change your answer at any time: open the cookie settings (also in the site footer).

We update this policy when our processing changes, and publish every material change on this page with a new effective date. When a change affects what contributors agreed to, the Contributor Consent gets a new version and the app asks you to read and sign it again before you continue.

For questions or requests about this policy:

KNUCA AI Lab
31 Povitryanykh Syl Ave., Kyiv, 03037, Ukraine
Email: dolhopolov_sy@knuba.edu.ua

Supervisory authority:
Ukrainian Parliament Commissioner for Human Rights
21/8 Instytutska St., Kyiv, 01008, Ukraine
www.ombudsman.gov.ua

If you live in the European Union or the European Economic Area, you may also complain to the data protection authority of your country.