PRIVACY POLICY (RFCx, Arbimon)

INTRODUCTION

Rainforest Connection ("RFCx," "we," "us," or "our") is a nonprofit organization dedicated to using technology to protect the world's ecosystems. This Privacy Policy describes how we collect, use, store, share, and protect information when you use our websites (rfcx.org, arbimon.org, and all sub-domains), the Arbimon biodiversity monitoring platform, our APIs, desktop programs, and mobile applications (collectively, the "Platform").

This policy applies to all users of the Platform, including researchers, conservation practitioners, institutional users, API integrators, and visitors to our websites. It covers both personal data and research data (such as audio recordings and associated metadata) submitted to the Platform and Arbimon.

Rainforest Connection is the data controller for the purposes of the European Union General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.

For questions about this policy, contact us at: privacy@rfcx.org

INFORMATION WE COLLECT

We collect the following categories of information:

(a) Account Information

When you create an account on the Platform or Arbimon, we collect your name, email address, and password. If you register on behalf of an organization, we also collect the organization name, your role, the nature of your intended use, and any prior relationship with RFCx, as described in our Terms of Service.

(b) Audio Data and Research Content

When you upload audio recordings to Arbimon or other parts of the Platform, we collect the audio files themselves along with associated metadata, including but not limited to: recording timestamps, geographic coordinates, recorder device information, site names, project names, and any habitat or deployment information you provide. This data forms the core of your use of Arbimon and is processed to provide the services you have requested.

(c) Annotations, Labels, and Identifications

When you annotate, label, or validate species identifications within Arbimon, we collect those annotations and labels, including the identity of the user who created them. These contributions are used to improve detection accuracy and train AI models, as described in our Terms of Service.

(d) Derived Analytics and Outputs

The Platform and Arbimon generate derived data from your submissions, including species detection results, soundscape indices, occupancy models, activity patterns, and other analytical outputs. We retain these outputs as part of the service we provide.

(e) Usage and Activity Data

We automatically collect information about how you interact with the Platform and Arbimon, including pages visited, features used, search queries, export activity, API calls, upload and download volumes, IP addresses, browser type, operating system, and timestamps of access.

(f) Communications

When you contact us by email or through the Platform, we retain the content of those communications along with your contact information.

(g) Donation and Payment Information

If you make a donation through rfcx.org, we collect your name, email address, mailing address, and donation amount. Payment card details are processed by our third-party payment processor and are not stored on our servers.

(h) Cookies and Similar Technologies

We use cookies and similar tracking technologies to maintain session state, remember preferences, and collect aggregate usage statistics. You may manage cookie preferences through your browser settings. Essential cookies required for Platform functionality cannot be disabled.

HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes and on the following legal bases:

(a) To Provide and Operate the Platform and Arbimon

We process your account information, audio data, annotations, and related content to provide the services you have requested, including audio storage, species detection, data visualization, and analytical tools within Arbimon. Legal basis: Performance of a contract (the Terms of Service).

(b) To Improve Our Services and Train AI Models

We use audio data, annotations, labels, and derived data to develop, train, and improve machine learning models for species detection and biodiversity monitoring. These models power Arbimon's detection capabilities and advance conservation science more broadly. Legal basis: Legitimate interest in improving our conservation technology and advancing scientific research. See Section 9 for information about AI training and your opt-out rights.

(c) To Monitor Compliance and Ensure Platform Integrity

We use usage and activity data to detect abuse, enforce our Terms of Service, prevent unauthorized commercial use, and maintain the security and performance of the Platform and Arbimon. Legal basis: Legitimate interest in protecting the Platform, our users, and our mission.

(d) To Communicate with You

We use your contact information to send service-related notices, respond to inquiries, and provide updates about the Platform. With your consent, we may also send you newsletters or information about RFCx's conservation work. Legal basis: Legitimate interest (service communications); consent (marketing communications).

(e) To Process Donations

We use payment and contact information to process donations, issue receipts, and comply with financial reporting obligations. Legal basis: Performance of a contract; legal obligation.

(f) To Comply with Legal Obligations

We may process your information as necessary to comply with applicable laws, regulations, legal processes, or governmental requests. Legal basis: Legal obligation.

HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We share information only in the following circumstances:

(a) Service Providers and Sub-Processors

We engage third-party service providers to help us operate the Platform and Arbimon. These providers process data on our behalf and are contractually obligated to protect your information and use it only for the purposes we specify. Our current categories of sub-processors include: - Cloud infrastructure providers (hosting, storage, computation) - Email and communications services - Payment processing services - Analytics and monitoring services - Content delivery networks A list of specific sub-processors is available upon request by contacting privacy@rfcx.org.

(b) AI Model Development Partners

As described in our Terms of Service, we may share audio data, annotations, and derived data with third parties engaged by RFCx for the purpose of developing and improving machine learning models for conservation. These partners are bound by contractual obligations regarding data use and confidentiality.

(c) Research Collaborations

With your knowledge and in accordance with the content license granted in our Terms of Service, we may share research data (audio, metadata, annotations) in the course of academic and scientific collaborations aimed at advancing conservation knowledge.

(d) Legal Requirements

We may disclose your information if required to do so by law or if we believe in good faith that such disclosure is necessary to comply with legal process, protect our rights, protect the safety of our users or the public, or investigate fraud.

(e) Organizational Transfers

In the event of a merger, acquisition, reorganization, or transfer of assets, your information may be transferred to the successor entity, subject to the commitments made in this Privacy Policy.

INTERNATIONAL DATA TRANSFERS

Rainforest Connection is based in the United States. If you access the Platform or Arbimon from outside the United States, your information will be transferred to and processed in the United States and potentially other countries where our service providers operate.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not received an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional safeguards where appropriate.

To request a copy of the Standard Contractual Clauses we use, contact us at privacy@rfcx.org.

DATA RETENTION

We retain your information for as long as necessary to fulfill the purposes described in this policy, subject to the following:

(a) Account Information: Retained for the duration of your account and for up to two (2) years after account deletion, to the extent necessary for compliance, audit, and dispute resolution purposes.

(b) Audio Data and Research Content: Audio files and associated metadata uploaded to Arbimon are retained for the duration of your account. Upon account deletion or upon your request, we will delete your audio files within ninety (90) days, subject to the content license granted in the Terms of Service and any legal retention obligations. Derived data and AI model improvements created from your content prior to deletion are not subject to deletion, as described in the Terms of Service.

(c) Annotations and Labels: Retained indefinitely as part of the scientific record and for AI model training purposes, in accordance with the content license in the Terms of Service. Annotations are dissociated from your personal identity upon account deletion.

(d) Usage and Activity Data: Retained in identifiable form for up to two (2) years, after which it is aggregated or anonymized.

(e) Donation Records: Retained as required by applicable tax and financial reporting laws, typically seven (7) years.

(f) Communications: Retained for up to three (3) years after the last communication, unless a longer period is required for legal purposes.

YOUR RIGHTS

Depending on your jurisdiction, you may have the following rights regarding your personal data:

(a) Right of Access: You may request a copy of the personal data we hold about you.

(b) Right to Rectification: You may request that we correct inaccurate or incomplete personal data.

(c) Right to Erasure (Right to Be Forgotten): You may request that we delete your personal data. We will comply with such requests subject to the exceptions described in GDPR Article 17(3), including where retention is necessary for exercising the right of freedom of expression, compliance with legal obligations, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research purposes, or the establishment, exercise, or defense of legal claims. Please note that the perpetual content license granted in the Terms of Service means that derivative works and AI models trained on your content prior to deletion are not subject to erasure.

(d) Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances.

(e) Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format. For Arbimon users, this includes the ability to export your audio files, metadata, and annotations through the Platform's export functionality.

(f) Right to Object: You may object to processing based on legitimate interest, including processing for AI model training (see Section 9).

(g) Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

(h) Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at privacy@rfcx.org. We will respond within thirty (30) days, or within the timeframe required by applicable law.

DATA PROCESSING AGREEMENTS

Institutional users of Arbimon (such as universities, government agencies, research institutes, and organizations) that require a Data Processing Agreement (DPA) to comply with their data protection obligations may request one by contacting us at privacy@rfcx.org. Our standard DPA addresses data processing roles, security measures, sub-processor management, breach notification, and cross-border transfer mechanisms.

AI TRAINING AND MODEL DEVELOPMENT

RFCx uses data submitted to the Platform and Arbimon, including audio recordings, species annotations, and labels, to train and improve machine learning models for conservation purposes. This is a core part of our mission to advance biodiversity monitoring technology.

We want to be transparent about this practice:

(a) What Data Is Used: Audio files, annotations, labels, species identifications, and associated metadata submitted to Arbimon may be used to train, validate, and improve AI detection models.

(b) How Models Are Used: Trained models are deployed on the Platform and Arbimon to provide automated species detection and other analytical services. Models may also be made available to the broader conservation community in accordance with our open-source mission.

(c) Opt-Out Mechanism: If you do not wish your data to be used for AI model training beyond the services provided directly to you, you may opt out by contacting us at privacy@rfcx.org with the subject line "AI Training Opt-Out." Upon receiving your request, we will exclude your newly submitted data from future model training within a reasonable period (typically thirty days). Please note that data already incorporated into trained models prior to your opt-out request cannot be extracted or removed from those models.

(d) Safeguards: We implement technical and organizational measures to ensure that AI training data is used responsibly, that models do not inadvertently expose personal information, and that model outputs are validated for scientific accuracy.

SECURITY

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL

• Encryption of sensitive data at rest

• Access controls limiting data access to authorized personnel

• Regular security assessments and monitoring

• Incident response procedures

While we strive to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

CHILDREN'S PRIVACY

The Platform and Arbimon are not directed to children under the age of sixteen
(16). We do not knowingly collect personal data from children under sixteen. If we become aware that we have collected personal data from a child under sixteen, we will take steps to delete that information promptly.

THIRD-PARTY LINKS

The Platform may contain links to third-party websites or services that are not operated by RFCx. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform with a revised "Last Updated" date, and where appropriate, by email or other notice through the Platform. Your continued use of the Platform and Arbimon after any changes constitutes acceptance of the updated policy.

Last Updated: 5 March, 2026