Privacy Policy

1. Who we are

Cambridge AI Safety Hub ("CAISH", "we", "us", "our") is fiscally sponsored by Meridian Impact CIC, a Community Interest Company registered in England and Wales (company number 13653958, registered office 53-54 Sidney Street, Cambridge CB2 3HX). Meridian Impact CIC is the data controller for the personal data described in this policy. CAISH is not a separate legal entity, so Meridian Impact CIC is legally responsible for how your information is used and for protecting your rights. CAISH is funded by Coefficient Giving. Our website is caish.org.

Questions, requests and complaints about your data go to hello@caish.org. Meridian Impact CIC is registered with the Information Commissioner's Office, registration reference ZB536693.

2. What data we collect and why

2.1 Mailing list

If you sign up for our mailing list (hosted by HubSpot), we collect your email address. We use it only to send you updates about CAISH events and programmes. You can unsubscribe at any time using the link in any email. The mailing list is separate from the alumni opportunity updates described in section 2.4, and unsubscribing from one does not unsubscribe you from the other.

2.2 Programme applications

Applications for our programmes (for example the Alignment Fellowship, MARS and the Hardware Assurance Programme) are collected through form providers including Airtable and Tally, which process your data on our behalf (section 4). We use your name, contact details and application responses to assess your application and, if you are accepted, to run the programme. Some applications are scored with the help of software, including AI tools, but a person makes every decision (section 6.2).

If you are not accepted, we keep your application for 12 months after the round closes, so that we can consider you for a later round and answer questions about the decision. We then delete or anonymise it. If you join the alumni network (section 2.4) we keep your alumni record, but not your application. Please refer to the privacy policies of Airtable and Tally for how they handle data on their platforms.

2.3 Taking part in a programme

If you take part in a programme as a participant, mentor, resident, facilitator or contractor, we hold what we need to run it, including contact details, programme and cohort, attendance, feedback, travel and accommodation arrangements, visa documents where we sponsor a visit, emergency contact details, and payment details for stipends, expenses or invoices.

Dietary and accessibility needs can be special category data, so giving them is optional. We collect them with your explicit consent, use them only to arrange catering and access for your programme, share them only with those who need them (for example the caterer), and delete them once the programme ends.

Your name, biography and photograph appear on a programme page or in programme materials only if you have said yes to that on the onboarding form. You can ask us to take them down at any time.

2.4 Alumni network and referrals

After a programme, application round or contract ends we would like to stay in touch and, where you agree, connect you with opportunities. Other AI safety organisations regularly ask us to suggest people for roles and programmes. To do this we keep an alumni record, made up of your name, email address, programme and role with CAISH, and the profile information you choose to give us through our alumni form (where you are based, what you are doing now, the kinds of roles you are interested in, links to your work, and optionally a CV). This profile is self-reported. You can see and change it at any time through your personal form link.

We ask for three separate permissions, each optional. Saying no to one does not affect the others, or your place on any programme.

• Opportunity updates. We may email you about roles, programmes, funding and events that might suit you.
• Named referrals. When an organisation asks CAISH to recommend people for a specific role or programme, we may share your name, contact details and profile with that organisation. We do this only with your consent, only for a specific role or programme that we think may suit you, and a member of the CAISH team reviews every referral before anything is shared (section 6.2). Some of these organisations are outside the UK (section 4).
• Impact stories. We may describe your journey after CAISH in reports to funders and in public materials. Without this permission we describe outcomes only in aggregate or anonymised form.

We ask everyone in our records once whether they wish to be in the network. If you say no, or do not respond after a reminder, we delete your details and keep only a minimal note of the removal so that we do not add you again.

2.5 Job applications

If you apply for a role at CAISH we collect your CV, application answers and contact details to run the recruitment process, which may include a recorded interview and a work trial. The application form asks whether we may share your application with other organisations that are hiring, and we follow the choice you make there. Some of those organisations may be outside the UK (section 4). We keep unsuccessful applications for 12 months after the round closes, so that we can consider you for future roles and answer questions about the decision, and then delete them. Interview recordings are deleted when the round closes.

2.6 Automatically collected information

When you visit our website, our hosting provider (Netlify) may automatically collect standard server log data such as your IP address, browser type, and pages visited. This data is used for security and performance monitoring. We do not use analytics tracking tools such as Google Analytics.

3. Legal basis for processing (UK GDPR)

We process personal data on the following bases:

• Consent: the mailing list, joining and staying in the alumni network and each of its three permissions, sharing your job application with other organisations that are hiring, publishing your name, biography or photograph, and dietary or accessibility information.
• Contract: running a programme you have accepted a place on or agreed to mentor, and paying stipends, expenses or invoices.
• Legitimate interests: assessing applications, keeping a record of who has taken part in our programmes, contacting past participants and applicants about how we hold their data, assessing and reporting the impact of our work in aggregate, keeping our systems secure, and establishing or defending legal claims. Where we rely on legitimate interests we have weighed them against your interests and rights, and you can object at any time (section 6).
• Legal obligation: keeping financial records and responding to lawful requests from authorities.

4. Third-party services and sharing

We use the following third-party services. Each processes data on our behalf only as needed for the stated purpose:

• Google Fonts: to load typefaces used on the site
• Netlify: website hosting and serverless functions
• HubSpot: mailing list management
• Airtable: application forms, programme records and the alumni record
• Tally: application forms
• Fillout: the alumni network form
• Google Workspace: email and documents
• Luma: event listings and registrations
• Slack: programme communication, including cohort channels and messages
• WhatsApp: group chats for some programmes
• Supabase: logins and progress for the AI Workload Verification Course
• AI model providers, currently mainly Anthropic (Claude): help with scoring applications and searching alumni records for referrals. We use these providers only on settings or terms under which our data is not used to train their models.
• Mailmeteor: sending personalised emails from our Google Workspace account, such as our messages to past participants and applicants about the alumni network
• Wise: stipends, expenses and invoices

Beyond these service providers, we share personal data with another organisation only when you have consented to a named referral or impact story (section 2.4), when you chose to have your job application shared (section 2.5), when the law requires it, or where it is necessary to protect someone's safety. If you take part in a programme, other people on it may see your name and contact details, for example in the programme's Slack workspace or WhatsApp group and in calendar invites for your cohort. We never sell personal data.

Transfers outside the UK. Some organisations that we share alumni profiles or job applications with are outside the UK, including in the United States, where data protection law may offer less protection than UK law. We rely on your explicit consent for these transfers, tell you which organisation we are referring you to where practical, and share no more than the profile or application information you have provided for that purpose. Our service providers may store data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

5. Data retention

• Mailing list: until you unsubscribe
• Programme applications: 12 months after the round closes, then deleted or anonymised
• Job applications: 12 months after the round closes, then deleted
• Interview recordings: deleted when the recruitment or application round closes
• Record of participation (name, programme, role and dates): kept for as long as CAISH runs programmes, so we can confirm your participation (for example for references) and keep an accurate record of our programmes
• Programme logistics (travel, visa, dietary, accessibility and emergency contact details): deleted once the programme has ended and any reimbursements are complete
• Alumni network records: while you are in the network. We ask you to confirm or update your record every six months and review every record once a year, removing any where we can no longer reach you. If two consecutive requests go unanswered we delete the record.
• Removal requests: actioned within one month, keeping only a minimal note of the request
• Financial records (stipends, expenses, invoices): six years, as required by UK company and tax law
• Server logs: retained by Netlify in accordance with their privacy policy

Our form providers and Google Drive keep their own copies of submissions, so we delete records there as well as in Airtable.

6. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to our processing, including any processing based on legitimate interests
• Receive the data you gave us in a portable format
• Withdraw consent at any time (for example, change any of the alumni network permissions, or unsubscribe from the mailing list)

To exercise any of these rights, contact us at hello@caish.org. We will respond within one month.

6.1 Complaints

If you are unhappy with how we have handled your personal data, please tell us first at hello@caish.org, or by post to Meridian Impact CIC, 53-54 Sidney Street, Cambridge CB2 3HX. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, telephone 0303 123 1113.

6.2 How we use AI tools

We use software, including AI tools, in two places. They help score programme applications (section 2.2), and they help search our alumni records when an organisation asks for referrals (section 2.4). In both, a person at CAISH reviews and makes every decision, so no decision about you is made by automated means alone.

AI tools may flag applications that look incomplete or ineligible, and a person looks at every flagged application before deciding whether to reject it. Only spam, blank submissions and exact duplicates (keeping the latest version) are removed automatically. We check AI scores against scores given by people on a sample of applications, and keep spot-checking them while the system is in use.

7. Cookies and local storage

Our website does not set tracking cookies. Some pages use your browser's localStorage, which stays on your device. The programme feedback form saves a draft of your answers, including your name, until you submit it. The AI Workload Verification Course stores your progress and, if you log in, your session.

8. Children's privacy

Our programmes are open only to people aged 18 or over, and our services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this privacy policy from time to time. If we start using your data for a new purpose, we will tell you directly before we do, as we did when we set up the alumni network. The effective date at the top of this page indicates when the policy was last revised.

10. Contact

Cambridge AI Safety Hub, fiscally sponsored by Meridian Impact CIC (data controller)
53-54 Sidney Street, Cambridge CB2 3HX
Email: hello@caish.org