01
Collection
We consider the source, purpose, permissions, and context in which information is obtained.
Privacy and data protection
We protect personal information by accounting for how it is collected, assessed, used, stored, and shared throughout our research and development activities.
Our approach
Privacy is part of responsible speech and language technology. It informs how we handle data, evaluate risk, and determine whether a resource is appropriate for a particular use.
How we approach privacy
Sauti Labs works with speech, language resources, datasets, models, and related research materials. These activities can involve personal information and data subject to different permissions and restrictions. Our approach considers those differences rather than treating all data as interchangeable.
The commitments below describe the principles we apply when assessing and handling information. They do not mean that every possible technical control, certification, or formal compliance process is in place in every environment.
Purpose and lawful use
We account for why information is collected and how it is used.
Purpose and lawful use
We account for why information is collected and how it is used.
- We assess the purpose of collecting or processing information before using it in research, development, evaluation, or operations.
- We consider the legal basis for processing, the expectations of the people concerned, and the context in which information was obtained.
- We do not treat the technical availability of data as automatic permission to use it for every purpose.
Data minimisation
We limit information collection and use to what the task requires.
Data minimisation
We limit information collection and use to what the task requires.
- We seek to collect and process only information relevant to a defined research, development, evaluation, or operational purpose.
- Where appropriate, we consider whether a task can be completed using less identifying information, aggregated information, or a suitable alternative.
- We account for the possibility that apparently ordinary data may become identifying or sensitive when combined with other information.
Consent, permissions and data sources
We assess the permissions and conditions attached to the data we use.
Consent, permissions and data sources
We assess the permissions and conditions attached to the data we use.
- We consider consent, applicable legal bases, source permissions, licensing terms, and other relevant conditions before using data.
- For contributed or collected speech and language resources, we account for the circumstances in which the data was obtained and the purposes for which it may be used.
- We distinguish permission to access a resource from permission to redistribute it, publish it, use it for model training, or use it for other purposes.
- Where the available permissions or provenance are unclear, we treat that uncertainty as a matter to resolve rather than assuming unrestricted use.
Speech and language data
We recognise the privacy implications of voice recordings and language resources.
Speech and language data
We recognise the privacy implications of voice recordings and language resources.
- Speech recordings may contain personal information and may reveal a speaker's identity, characteristics, circumstances, or other sensitive details.
- We consider privacy, consent, provenance, licensing, intended use, and potential risks when handling speech recordings, transcripts, annotations, and derived resources.
- We recognise that removing a person's name does not necessarily make a voice recording anonymous.
- We distinguish datasets, model inputs, annotations, evaluation materials, and generated outputs because each may create different privacy and disclosure risks.
- We assess the context and permissions associated with a resource rather than assuming that all African-language data can be used under the same conditions.
Security and confidentiality
We treat the protection of information as part of responsible data handling.
Security and confidentiality
We treat the protection of information as part of responsible data handling.
- We consider the sensitivity of information and the risks associated with unauthorised access, disclosure, alteration, loss, or misuse.
- We limit access to information according to the needs of the relevant work and the responsibilities of the people involved.
- We consider appropriate safeguards when information is stored, transferred, accessed, processed, or shared.
- We treat security as an ongoing responsibility throughout the data lifecycle, not solely as a matter of storage.
Retention, sharing and deletion
We consider how long information is needed and the conditions for sharing it.
Retention, sharing and deletion
We consider how long information is needed and the conditions for sharing it.
- We assess retention in relation to the purpose of processing, applicable obligations, research requirements, and relevant permissions.
- We do not assume that information should be retained indefinitely merely because storage is available.
- Before sharing data or making resources publicly available, we consider privacy risks, licensing, consent, contractual conditions, and the possibility of re-identification.
- Where deletion or withdrawal is applicable, we consider the information concerned, the relevant obligations, and the technical and operational circumstances.
- We recognise that removing a dataset from active use may not automatically remove copies, backups, derived materials, or previously distributed resources.
Individual rights and privacy requests
We recognise that people may have rights concerning their personal information.
Individual rights and privacy requests
We recognise that people may have rights concerning their personal information.
- We take privacy questions and requests concerning personal information seriously.
- We assess requests in light of applicable law, the information involved, our role in processing it, and any relevant legal exceptions.
- Where a request concerns information held by another organisation or service, we may need to direct the requester to the organisation responsible for that information.
- We do not promise that every request can be fulfilled in every circumstance, but we aim to handle requests responsibly and transparently.
Website data and cookies
We consider privacy in the operation and improvement of our website.
Website data and cookies
We consider privacy in the operation and improvement of our website.
- Information submitted through our website or communications channels may be used to respond to enquiries and support the relevant interaction.
- Technical information may be processed to operate, secure, maintain, and improve the website, subject to the technologies and services in use.
- Where cookies or comparable technologies are used, their purposes and applicable choices should be communicated in accordance with relevant requirements.
- We do not describe a technology as being in use unless it is actually implemented in the relevant environment.
Speech and language data
Privacy across the data lifecycle
Data handling is not a single decision. We consider privacy and permissions across the stages through which a resource passes, from its source to its use, sharing, and eventual retention or deletion.
02
Assessment
We assess relevance, sensitivity, provenance, applicable conditions, and potential privacy risks.
03
Preparation
We consider minimisation, access, documentation, and appropriate handling before use.
04
Use
We account for the purpose and conditions governing research, development, and evaluation.
05
Sharing
We consider authorisation, privacy risks, licensing, and disclosure before sharing resources.
06
Retention
We consider continuing need, applicable obligations, and appropriate retention or deletion.
Responsible handling
Sharing, retention, and deletion
We consider the conditions attached to information before disclosing it, distributing a dataset, publishing a research resource, or making material available to others. Public accessibility does not by itself establish permission for every subsequent use.
Retention and deletion depend on the purpose of processing, applicable requirements, the permissions governing the resource, and the technical circumstances. We avoid making blanket promises about removing every copy or derived artefact where that outcome cannot be guaranteed.
When working with third-party services or collaborators, we consider the information involved, the purpose of the transfer, and the conditions governing its handling.
Legal framework
Privacy obligations and accountability
Our privacy approach takes account of applicable data protection requirements, including Kenya's Data Protection Act, 2019, where relevant to our activities.
The legal obligations that apply to a particular activity depend on factors such as the nature of the information, the purpose of processing, the parties involved, and the relevant jurisdiction.
This page provides general information about our approach. It is not legal advice, does not replace applicable agreements or notices, and should not be read as a claim of certification or independent legal verification.
Get in touch
Privacy questions and requests
Contact Sauti Labs if you have a question about this page, the handling of personal information, or a privacy-related request. Please avoid including sensitive personal information in your initial enquiry unless it is necessary.
For general enquiries, reach out through our website contact channel. We will assess the nature of the request and determine the appropriate next steps.
Contact Sauti LabsRelated commitments