Who
Named organization, approved affiliates and contractors, and authorized roles.
Permission is not a quality score
Every use should be narrow, attributable, and reviewable.
A polished dataset does not prove ownership, consent, or legal compatibility. Sally is designed to evaluate the exact use against every included contribution, preserve the evidence and policy version, and fail closed when a required fact is unknown.
A buyer grant answers six questions
What
Exact immutable product revision and representations—not a person’s future library.
Why
Specific research, evaluation, model, or product purpose.
How
Evaluation, analysis, training, fine-tuning, generation, display, or another explicit operation.
Where and when
Geographic access, duration, retention, renewal, and deletion requirements.
Limits
Identification, redistribution, sublicensing, public display, combining, and other prohibited uses.
What provenance should show
- How the asset entered Sally and which representation is deliverable.
- Which context came from a person, a machine suggestion, an imported source, or a reviewer.
- Evidence anchors, timestamps, transformations, and confidence without exposing more personal data than necessary.
- Rights basis, attestation text and version, independent evidence status, and every review decision.
- Canonical revision and manifest hashes, plus later withdrawal or revocation events.
What a contributor controls
- Selecting the exact proposed records and context.
- Reviewing the named purpose, permitted operations, limits, retention, and compensation terms.
- Declining without losing the personal catalog service.
- Withdrawing an unlicensed private submission through the same preference surface.
- Seeing when an existing license limits what can be unwound, and what future access will stop.
Withdrawal must say what changes
| Action | Effect | What may remain |
|---|---|---|
| Withdraw a private contribution | Stops qualification and removes it from future candidate revisions. | Minimal audit or suppression evidence where justified and disclosed. |
| Stop future collection | Stops new catalog or connector processing for the selected purpose. | Data already processed under another disclosed lawful basis. |
| Revoke sample access | Ends the buyer’s future access to the reviewed sample. | Prior lawful evaluation and required audit evidence. |
| End a license at its permitted boundary | Stops future licensed access or use as the agreement provides. | Uses, models, or records the agreement and law do not permit Sally to unwind. |
| Delete account data | Deletes or de-identifies personal records under the published policy. | Narrow legal, accounting, security, or rights-proof records with a defined basis and retention period. |
The consent design follows the principle that consent be specific, recorded, separate from general terms, and as easy to withdraw as to give. The correct lawful basis still depends on the real processing and jurisdiction; the UI cannot decide that question.
ICO consent-management guidance