Skip to main content

Privacy Policy

Your privacy matters. Here's how we collect, use, and protect your personal data.

Last updated: July 2026

1 Data Controller

This website is operated by the Safer Agentic AI Community of Practice. The data controller is EthicsNet, 11 Kingfisher Business Park, Arthur Street, Lakeside, Redditch, United Kingdom, B98 8LG. For data protection queries, please contact us through the contact form on our home page or by post at the address above.

2 What Data We Collect

When you contact us through our website form, we collect:

  • Your name
  • Your email address
  • The content of your message
  • Timestamp of submission

When you subscribe to our newsletter, we collect:

  • Your name
  • Your email address

Newsletter subscriptions are handled through the Mailchimp sign-up form on our website. You provide this information voluntarily when you choose to subscribe, and you may unsubscribe at any time.

3 How We Use Your Data

We process your personal data for the following purposes:

  • Responding to inquiries: We use your contact information to respond to your questions or feedback about our research.
  • Research collaboration: If relevant, we may contact you about research opportunities or collaborations.
  • Newsletter and updates: If you subscribe, we use your name and email address to send you our newsletter, including framework updates and book news. We do this on the basis of your consent, and you can unsubscribe from any email we send.

4 Legal Basis for Processing

We identify a single lawful basis for each purpose:

  • Responding to inquiries and research collaboration — consent: You consent when you submit the contact form, and you may withdraw that consent at any time.
  • Newsletter and updates — consent: You consent when you tick the newsletter consent box and submit the sign-up form. Withdrawing consent (by unsubscribing) ends this processing.
  • Site security and abuse prevention — legitimate interests: We rely on our legitimate interest in keeping the site and its forms secure, for example spam and abuse filtering by our form processor. We do not use legitimate interests as a fallback for processing you have consented to; if you withdraw consent, that processing stops.

5 Data Sharing

Your data may be shared with:

  • Formspree: Our form processor (see their privacy policy (opens in new tab))
  • Mailchimp (Intuit Mailchimp): Our email-marketing processor for newsletter delivery. We share your name and email address, on the legal basis of your consent given when you subscribe (see their privacy statement (opens in new tab))
  • Research team members: Only as necessary to respond to your inquiry

We never sell or share your data for marketing purposes.

If you use our assessment tools, additional processing applies to the documents and evidence you submit. For details on how the Auto-Assessor and Safety Advisor handle your data (including evidence sent to Anthropic or OpenAI for analysis, and summaries stored locally in your browser via IndexedDB), please see our Data Handling Notice.

6 International Data Transfers

Providers we engage. Several of the service providers we engage are based in the United States, including Formspree (contact form), Mailchimp / Intuit Mailchimp (newsletter) and GitHub (website hosting). When you contact us, subscribe to our newsletter, or access this website, your personal data may be transferred to and processed in the United States. Where personal data is transferred outside the United Kingdom or the European Economic Area by these providers, we rely on the safeguards in their data processing terms, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses (SCCs).

AI providers used by our assessment tools. The Auto-Assessor and Safety Advisor run entirely in your browser and use an API key that you supply from your own account. Your browser sends the text you choose to analyse directly to Anthropic or OpenAI under your agreement with that provider; it does not pass through any SaferAgenticAI server, and we are not a party to that transfer and hold no contract with those providers covering it. The transfer terms that apply are the ones in your own account with Anthropic or OpenAI.

Content delivery for the local (in-browser) model option. If you choose the local model option in the Safety Advisor, your browser downloads model files from Hugging Face and the MLC project's public distribution, which receive your IP address and browser details as part of that download. The full list of third parties involved in the assessment tools is set out in our Data Handling Notice.

7 Data Retention

Contact form. We retain your name, email address and message for no longer than 24 months after our correspondence with you closes, and sooner if you ask us to delete it. We keep data for longer only where a legal obligation requires it. Formspree also retains its own copy of form submissions under its retention policy.

Newsletter. We keep your name and email address on the newsletter list until you unsubscribe or ask us to remove you, after which the record is deleted from the audience (Mailchimp may retain a suppression record so that you are not re-added). You can unsubscribe from the link in any newsletter we send.

Deletion requests. You can ask us to delete your data at any time, and we will do so unless we are legally required to keep it.

8 Your Rights

Under GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate personal data
  • Erasure: Request deletion of your personal data
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a portable format
  • Object: Object to certain types of processing
  • Withdraw consent: Withdraw consent at any time

9 California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you certain rights regarding your personal information. In the past twelve months, we have collected the following categories of personal information:

  • Identifiers: Such as your name and email address
  • Customer records: The content of any message you send us through our contact form
  • Internet activity: Limited technical information, such as the timestamp of a form submission
  • Commercial / marketing preferences: If you subscribe to the newsletter, your name, email address and subscription status

We collect this information for the business purposes described in section 3: responding to your inquiries, research collaboration, and — where you have subscribed — sending our newsletter and framework and book updates.

We do not sell or share your personal information, as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve months.

As a California resident, you have the right to:

  • Know: Request the categories and specific pieces of personal information we have collected about you
  • Delete: Request deletion of the personal information we have collected from you
  • Correct: Request correction of inaccurate personal information
  • Opt out: Opt out of the sale or sharing of your personal information (we do not sell or share it)
  • Non-discrimination: Not receive discriminatory treatment for exercising any of these rights

To exercise any of these rights, please contact us through the contact form on our home page.

10 Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • HTTPS encryption for data in transit
  • Secure form processing through Formspree
  • Limited access to personal data

11 Cookies and Client-Side Storage

This website sets no cookies. We use no analytics, advertising or tracking cookies, and no cookies are set for functionality either.

We do store a small amount of information in your browser's own storage so that the site and the assessment tools work. None of it is sent to us, and it stays on your device:

  • localStorage — framework-sections-state (Recommended Practices page): remembers which sections you expanded or collapsed. No personal data; persists until you clear your browser storage.
  • sessionStorage — saferAI_wizardState (Readiness assessment): keeps your answers and progress so you can resume the wizard, and is cleared when you finish or restart it, or when you close the tab.
  • sessionStorage — saai-api-key, saai-openai-key, saai-advisor-recommendation, saai-advisor-conversation, saai-full-assess-meta, plus per-suite progress keys beginning saai-assess- and saai-full-assess- (assessment tools): holds the API key you supply, your advisor conversation, and in-progress assessment results for the current tab only. It is discarded when you close the tab.
  • IndexedDB — saai-assessments (assessment tools): stores completed assessment scores and metadata so you can review history and compare runs. Raw evidence text is not stored. You can delete individual assessments from the history page or clear your browser's site data.

Full details of the assessment tools' local storage are in our Data Handling Notice.

12 Contact Us

For any privacy-related questions or to exercise your rights, please contact us through the form on our main page, clearly stating your data protection request.

Use our contact form for all privacy inquiries.

13 Complaints

If you have a concern about how we handle your data, please raise it with us first through the contact form — we would like the chance to put it right.

You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ICO), which you can reach at ico.org.uk/make-a-complaint/ (opens in new tab), where the ICO also publishes its helpline details. If you are in the European Economic Area, you may instead complain to the data protection authority of the country where you live or work.