Privacy Policy
Last updated 12 October 2026.
1. Who we are and what this covers
AI-OK Limited, a company registered in Ireland (“AI:OK”, “we”, “us”), is the controller of personal data collected through ai-ok.org, the online forms, the waiting list, the registry, the member portal and the AI:OK Literacy Programme. Contact: privacy@ai-ok.org. We have not appointed a data protection officer. Questions about data protection go to the same address.
This policy applies to everyone, wherever they are based, including the EU, the UK and the US. We apply one standard worldwide. It does not cover recruitment of staff or assessors, which has its own notice.
2. Personal data you give us
Contact details. Name, email, job title, organisation, phone and how you heard of us. We use them to reply to you and to carry out your request.
Application data. Quick Check, Core and Extended answers, the Dataset and Source Register, supporting documents, and the declaration made on submission. These may name individuals, such as a responsible officer or a licensor’s representative. We use them to assess and administer your application, certification and annual review.
Waiting list data. Contact details, Quick Check outcome, scope and your place in the queue. We use them to manage entry to Core.
Payment data. Billing contact and payment status. Card details go straight to Stripe and we do not store full card numbers. We use this data to take payment and keep financial records.
Evidence filing data. Filer name, organisation, email, identity mode (named, confidential or anonymous), description of the concern, evidence and declarations. We use them to assess filings under the Revocation Protocol.
Member portal and Literacy Programme data. Account details, progress, quiz results and certificates of completion. We use them to provide the portal and the programme.
Support and meeting data. Chat messages, emails, call bookings and notes. We use them to answer questions and keep a record.
Please include in your submissions only the personal data the assessment needs. We do not ask for special category data and you should not send it.
3. Data collected automatically
When you visit the website we collect, through our website platform and cookies:
Device and network data: device type, operating system, browser, IP address and unique identifiers;
Usage data: the page you came from, the pages you view, how long you stay, and the links you click; and
Approximate location and organisation, derived from your IP address.
We use this to run, secure and improve the website and to count visitors. We use cookies that are strictly necessary without asking. We use analytics and other non-essential cookies only with your consent, which you can change at any time. Section 19 gives the detail. We do not use advertising networks or cross-site tracking, we do not record your keystrokes or mouse movements, and we do not use this data for profiling.
4. Data we receive from others
From your organisation, about named individuals such as a responsible officer, where your Evidence includes them.
From licensors, suppliers and rights holders, when we confirm Evidence with them after telling you.
From public sources, about certified entities and applicants, for the integrity of the scheme.
From our service providers, such as payment confirmation from Stripe.
From people who file evidence, about individuals connected to a certified entity.
5. How we use it and our legal bases
To assess, decide and administer applications, certifications, the waiting list and the registry. Our legal basis is contract, or steps before a contract at your request.
To keep the scheme reliable, including annual review, verification with licensors and the Revocation Protocol. Our legal basis is legitimate interests: keeping certification trustworthy for everyone who relies on it.
To receive and test evidence filings, and to protect filers. Our legal basis is legitimate interests, and legal obligation where a regulator asks.
To reply to enquiries and give support. Our legal basis is legitimate interests, or contract.
To provide the member portal and the Literacy Programme. Our legal basis is contract.
To send newsletter. Our legal basis is consent, which you can withdraw at any time.
To secure, operate and improve our systems. Our legal basis is legitimate interests.
To keep records, deal with disputes and meet legal duties. Our legal bases are legal obligation and legitimate interests.
Where we rely on legitimate interests, we have weighed them against your rights. Ask us if you want details.
6. People decide, and we do not train AI on your data
Certification decisions are made by human assessors. We do not make decisions about you by solely automated means that have legal or similarly significant effects. We use online forms and automated emails to receive and acknowledge submissions. We do not use submitted personal data or Evidence to train any AI model, ours or anyone else’s.
7. Who we share it with
We share personal data with:
Service providers that process it for us under written agreements and only on our instructions. Our current providers are Squarespace (website hosting, member areas and the registry, for both AI:OK sites), Airtable (questionnaires, application tracking and review), Google Workspace (email), Tidio (website chat) and Stripe (payments, where Stripe is also an independent controller for its own legal and fraud-prevention duties).
Professional advisers, such as lawyers and auditors, under duties of confidentiality.
Regulators, courts and law enforcement, where the law requires or a legal claim needs it.
The public, through the registry, for the entity details described in the Confidentiality Protocol. These are about organisations, not individuals.
A buyer or successor, if our business is sold or reorganised, with notice to you.
Anyone else, only with your consent or at your direction. With your permission, for example, we may publish your testimonial.
We do not sell personal data. We do not share it with advertising networks or with business partners for their own marketing.
8. International transfers
AI:OK is in the European Economic Area. Several providers above are in, or transfer data to, the United States and other countries. Where personal data leaves the EEA or the UK, we rely on an adequacy decision, such as the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, with the UK Addendum or International Data Transfer Agreement for UK data. Ask privacy@ai-ok.org for the safeguard used for a specific provider.
9. How long we keep it
Certification and Evidence records: for the duration of certification plus six years.
Applications that do not proceed: two years, then deleted or anonymised.
Waiting list data: until you ask us to remove it, you decline a place, or two years of inactivity.
Evidence filings: until the matter closes, then six years. Anonymous filings are kept without identifying information.
Newsletter data: until you unsubscribe.
Literacy Programme accounts and results: while your account is active, plus two years.
Support records: two years after the last contact.
Website analytics: as section 19 states.
10. Your choices and rights
Communications. You can stop news and event emails at any time with the unsubscribe link. We will still send service messages about your application, certification or account.
Consent. Where we rely on consent, you can withdraw it by following the instructions given when you consented, or by writing to us.
Cookies. You can change your cookie choices at any time, and most browsers let you block cookies. Blocking some cookies may stop parts of the website working.
Your data protection rights. Under the GDPR and the UK GDPR you may ask us for a copy of your personal data, to correct it, to erase it where the law allows, to restrict or object to its use, to receive it in a portable format, and to withdraw consent. Write to privacy@ai-ok.org. We reply within one month, and may extend that by up to two months for complex requests, telling you why. Some data, such as records we must keep or filings under active review, may be exempt. We tell you when that applies.
You may complain to the Irish Data Protection Commission, our lead supervisory authority, or to the authority in your own country. UK residents may complain to the Information Commissioner’s Office.
11. People named in Evidence and filings
If you are named in Evidence or in a filing, you may ask what we hold about you. We may be unable to tell you everything, for example where doing so would reveal a confidential disclosure or prejudice a review. We will tell you what we can and why we cannot say more.
12. United Kingdom
UK GDPR and the Data Protection Act 2018 apply to personal data of people in the UK. We handle it to the same standard as all other personal data.
13. United States
We do not sell personal data and do not share it for cross-context behavioural advertising. Residents of California, Virginia, Colorado and other states with privacy laws may ask us what we hold, to correct or delete it, and to confirm we do not sell or share it. AI:OK may not be subject to these laws at present. We offer these rights as a matter of policy and will respond to requests sent to privacy@ai-ok.org.
14. Children
Our services are for businesses and professionals. We do not knowingly collect personal data from anyone under 16. If you think we have, tell us and we will delete it.
15. Other websites
The website may link to other websites and services. This policy does not apply to them. Read their privacy notices.
16. Security
Part 3 of the Protocols page describes how we protect data.
17. Changes
We may update this policy. We post changes here with a new date. We tell people with an active application, certification or account by email about material changes.
18. Contact
19. Cookie Policy
19.1 What cookies are
Cookies are small files that a website stores on your device. Similar technologies, such as pixels and local storage, do the same job. This policy covers all of them.
19.2 How we use them
We use three kinds.
Strictly necessary. These keep the website secure, remember your cookie choices, keep you signed in to the member portal, and make forms and payments work. They do not need your consent.
Analytics. These tell us how many people visit, which pages they view and how they arrive, so we can improve the website. We use them only with your consent.
Embedded services. Some services built into our pages, such as questionnaires, payment and support chat, set their own cookies. Where they are not strictly necessary, we use them only with your consent.
We do not use advertising cookies or cross-site tracking. We do not record keystrokes or mouse movements.
19.3 Your choices
You can accept or refuse non-essential cookies on your first visit and change your choice at any time using the cookie settings link in the website footer. Most browsers also let you block or delete cookies. If you block strictly necessary cookies, parts of the website, including forms and the member portal, may not work.
19.4 Third parties
The providers that set cookies through our pages have their own policies. Our Privacy Policy lists our providers and explains how we share personal data with them.
19.5 Changes
We may update this policy. We post changes here with a new date.
19.6 Contact