> ## Documentation Index
> Fetch the complete documentation index at: https://levers9.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Sharing and NDA

> Give annotators a link, choose their role, and gate it behind an agreement

Annotators are often outside the company and have no dashboard account. **Share** on a dataset works like a
document share dialog.

## People with access

Add a named link per annotator, with a role:

| role | can |
| - | - |
| **Annotator** | read rows, listen, save labels, flag |
| **Viewer** | read only; the page shows a clear read-only badge |

Each link is unlisted and revocable on its own. The name you give it is stamped as `user` on every label that
comes through it, so you can see who labelled what.

## General access

One link for everyone: **Restricted** (off) or **Anyone with the link**, with a role. Use it for a class or a
crowd; use named links when you need per-person accountability.

## What the annotator sees

The link opens a page with no sidebar: a name prompt (remembered in the browser), then the same annotation
workspace as inside the dashboard, including export and import. Nothing else in the workspace is reachable
from it. A revoked or expired link shows a plain message.

## What a link can read

A link reads the rows of its dataset with their labels, plays each row's clip, and exports them as TSV (plus
the gold set and the schema for a decision dataset). An annotator link can also save labels and import an
edited TSV.

Which text a link reads is the dataset's [policy](https://levers9.mintlify.site/lab/personal-data.md#who-reads-the-text-off-flag-and-mask), and
the Share dialog says which one the links are under:

| policy | what a link reads |
| - | - |
| **Off** | the text as it is |
| **Flag** | the text as it is, with a mark on the rows where the scan found personal data |
| **Mask** | the masked text: names and numbers show as `[NAME]` and `[PHONE]`. That goes for the rows, the labels shown back after a save, the TSV export and the gold set, and a search runs over the masked text too |

A link follows the policy as it is when the link is opened, not as it was when the link was made, so switching
to Mask covers the links you've already handed out. Under Mask a link never gets the original as a fallback: a
row whose text changed since the last scan shows `held back until the personal data scan has run` until you
scan again. A label an annotator saves is read for personal data on the spot, so they see it back masked.
Where someone has [reviewed](https://levers9.mintlify.site/lab/personal-data.md#check-the-scan) a row, a link reads it masked with what the
reviewer settled: a name the scan missed and they marked is `[NAME]` for every link.

Mask covers text. Audio still plays as recorded, so a link that plays a clip plays the recording, names and
numbers included. And it's about what a link reads: you still read the original on the dataset page.

That is all of it. The only files a link can open are the clips the rows play, under `chunks/` for
speech-to-text and `audio/` for text-to-speech. It can't download anything else from the dataset's folder: not
the original recordings in `raw/`, not `rows.tsv`, `labels.tsv` or `meta.json` as files, and nothing under
`pii/`, which holds the phone number and name each call is known by and what the personal-data scan wrote.
Asking for one of those through a link gets a 403, whichever role the link has.

A clip is always sent as sound. A link plays files ending in `.wav`, `.mp3`, `.ogg`, `.oga`, `.opus`, `.flac`,
`.m4a`, `.mp4`, `.aac`, `.weba`, `.webm`, `.amr`, `.3gp` or `.caf`, with the type that extension names, whatever
the file holds. Any other file in those folders gets a 403, so a page saved there can't open as a web page for
whoever holds the link.

Before an agreement is accepted, the link's page learns the dataset's name, kind, language and status, and how
far the work is (rows, calls, hours, and how many are validated, flagged, pending and drafted). The config the
dataset was built with (its source, bucket, query and secret names) isn't sent to a link.

## Review links: a link for checking the personal data scan

The links above are for the dataset's rows and labels. There is one other kind, made on the Anonymization card
with **Review link** and not in the Share dialog: a link for [reviewing a sample](https://levers9.mintlify.site/lab/personal-data.md#check-the-scan)
of the personal data scan. It's a different thing, and it's kept apart on purpose:

| | a link from the Share dialog | a review link |
| - | - | - |
| opens | the annotation workspace | the review of the sample, one row at a time |
| reads | every row, as the policy allows: masked under Mask | the sampled rows only, **as they are**, names and numbers included, under every policy |
| agreement | when you require one | always: the dataset's own when one is written, a default confidentiality text when not |
| audio, export, import | yes | no |

The reviewer has to read the original, because the job is to mark what the scan missed. So a review link is
narrow instead: a few hundred rows drawn at random and nothing else of the dataset. It can be taken back on
the card, and it can't be turned into a link of the other kind. Asking any other route of a link for data with
a review link gets a 403, and so does asking the review routes with a link from the Share dialog.

Over the API a link's kind is its `task`: `labels` (the default) or `pii`. `POST /api/datasets/{id}/shares`
with `{"label": "Fatima", "task": "pii"}` makes a review link. Add `"mode": "view"` for one whose holder
reads the review and can't change it; the card makes links that can review.

## NDA

Open **Agreement** in the Share dialog to require one. Write the title and text (a template is provided) and
save. From then on:

1. an annotator opening any link sees the agreement first, and enters a name, organisation and email to
   accept;
2. the acceptance is recorded on the dataset with the agreement version;
3. changing the wording bumps the version, and everyone accepts again before they can continue.

Data endpoints behind a link refuse to serve rows until the current version is accepted, so the gate holds even
for someone using the API directly.

A [review link](#review-links-a-link-for-checking-the-personal-data-scan) shows the agreement whether or not
you require it here, since its holder reads rows as they are. Write one and it's yours they accept; leave it
empty and they accept a short default text that says what they're about to read and what they mustn't do
with it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.