Privacy Policy

1. Who we are

Cambridge AI Safety Hub ("CAISH", "we", "us", "our") is fiscally sponsored by Meridian Impact CIC, a Community Interest Company registered in England and Wales (company number 13653958, registered office 53-54 Sidney Street, Cambridge CB2 3HX). Meridian Impact CIC is the data controller for the personal data described in this notice. CAISH is funded by Coefficient Giving. Our website is caish.org.

Questions, requests and complaints about your data go to hello@caish.org. Meridian Impact CIC is registered with the Information Commissioner's Office, registration reference ZB536693.

2. What data we collect and why

2.1 Mailing list

If you sign up for our mailing list (hosted by HubSpot), we collect your email address. We use it only to send you updates about CAISH events and programmes. You can unsubscribe at any time using the link in any email.

2.2 Programme applications

Applications for our programmes (for example the Alignment Fellowship, MARS and the Hardware Assurance Programme) are collected through Airtable and Tally forms. We use your name, contact details and application responses to assess your application and, if you are accepted, to run the programme. Some applications are scored with the help of software, including AI tools, but a person makes every decision.

If you are not accepted, we keep your application for 12 months after the round closes, so that we can consider you for a later round and answer questions about the decision. We then delete or anonymise it, unless you have joined the alumni network (section 2.4). Please refer to the privacy policies of Airtable and Tally for how they handle data on their platforms.

2.3 Taking part in a programme

If you take part in a programme as a participant, mentor, resident, facilitator or contractor, we hold what we need to run it: contact details, programme and cohort, attendance, feedback, travel and accommodation arrangements, visa documents where we sponsor a visit, emergency contact details, and payment details for stipends, expenses or invoices. Dietary and accessibility needs are special category data; we collect them with your consent and only use them to arrange the programme.

Your name, biography and photograph appear on a programme page or in programme materials only if you have said yes to that on the onboarding form.

2.4 Alumni network and referrals

After a programme ends we would like to stay in touch and, where you agree, connect you with opportunities. Other AI safety organisations regularly ask us to suggest people for roles and programmes. To do this we keep an alumni record: your name, email address, programme and role with CAISH, and the profile information you choose to give us through our alumni form (where you are based, what you are doing now, the kinds of roles you are interested in, links to your work, and optionally a CV). This profile is self-reported. You can see and change it at any time through your personal form link.

We ask for three separate permissions, each optional:

• Opportunity updates. We may email you about roles, programmes, funding and events that might suit you.
• Named referrals. When an organisation asks CAISH to recommend people for a specific role or programme, we may share your name, contact details and profile with that organisation. We do this only with your consent, only for a specific role or programme, and a member of the CAISH team reviews every referral before anything is shared. Some of these organisations are outside the UK (section 4).
• Impact stories. We may describe your journey after CAISH in reports to funders and in public materials. Without this permission we describe outcomes only in aggregate or anonymised form.

We ask everyone in our records once whether they wish to be in the network. If you say no, or do not respond after a reminder, we delete your details and keep only a minimal note of the removal so that we do not add you again.

2.5 Job applications

If you apply for a role at CAISH we collect your CV, application answers and contact details to run the recruitment process, which may include a recorded interview and a work trial. The application form asks whether we may share your application with other organisations that are hiring; we follow the choice you make there. We keep unsuccessful applications for 12 months after the round closes, unless you join the alumni network.

2.6 Automatically collected information

When you visit our website, our hosting provider (Netlify) may automatically collect standard server log data such as your IP address, browser type, and pages visited. This data is used for security and performance monitoring. We do not use analytics tracking tools such as Google Analytics.

3. Legal basis for processing (UK GDPR)

We process personal data on the following bases:

• Consent: the mailing list; opportunity updates, named referrals and impact stories in the alumni network; publishing your name, biography or photograph; and dietary or accessibility information.
• Contract: running a programme you have accepted a place on or agreed to mentor, and paying stipends, expenses or invoices.
• Legitimate interests: assessing applications; keeping a record of who has taken part in our programmes; contacting past participants and applicants about how we hold their data; assessing and reporting the impact of our work in aggregate; keeping our systems secure; and establishing or defending legal claims. Where we rely on legitimate interests we have weighed them against your interests and rights, and you can object at any time.
• Legal obligation: keeping financial records and responding to lawful requests from authorities.

4. Third-party services and sharing

We use the following third-party services. Each processes data only as needed for the stated purpose:

• Google Fonts: to load typefaces used on the site
• Netlify: website hosting and serverless functions
• HubSpot: mailing list management
• Airtable: application forms, programme records and the alumni record
• Tally: application forms
• Fillout: the alumni network form
• Google Workspace: email and documents
• Luma: event listings and registrations

Beyond these service providers, we share personal data with another organisation only when you have consented to a named referral (section 2.4), when you chose to have your job application shared (section 2.5), when the law requires it, or where it is necessary to protect someone's safety.

Transfers outside the UK. Some organisations we refer people to are outside the UK, including in the United States, where data protection law may offer less protection than UK law. We rely on your explicit consent for these transfers, tell you which organisation we are referring you to where practical, and share no more than the profile information you have provided for that purpose. Our service providers may store data outside the UK; where they do, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

5. Data retention

• Mailing list: until you unsubscribe
• Programme and job applications: 12 months after the round closes, unless you join the alumni network
• Programme logistics (travel, visa, dietary, accessibility and emergency contact details): deleted once the programme has ended and any reimbursements are complete
• Alumni network records: while you are in the network. We ask you to confirm or update your record every six months and review every record once a year. If two consecutive requests go unanswered we delete the record.
• Removal requests: actioned within 30 days, keeping only a minimal note of the request
• Financial records (stipends, expenses, invoices): six years, as required by UK company and tax law
• Server logs: retained by Netlify in accordance with their privacy policy

6. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to our processing, including any processing based on legitimate interests
• Receive the data you gave us in a portable format
• Withdraw consent at any time (for example, change any of the alumni network permissions, revoke Google Calendar access, or unsubscribe from the mailing list)

We may use software, including AI tools, to help search our alumni records when an organisation asks for referrals. A person at CAISH reviews and decides on every referral. We do not make decisions about you by automated means alone.

To exercise any of these rights, contact us at hello@caish.org. We will respond within one month.

6.1 Complaints

If you are unhappy with how we have handled your personal data, please tell us first at hello@caish.org, or by post to Meridian Impact CIC, 53-54 Sidney Street, Cambridge CB2 3HX. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, telephone 0303 123 1113.

7. Cookies and local storage

Our website does not set tracking cookies. We use browser localStorage to cache meeting availability data for performance. This data does not contain personal information and is stored only on your device.

8. Children's privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this privacy policy from time to time. If we start using your data for a new purpose, we will tell you directly before we do, as we did when we set up the alumni network. If we make material changes to how we use Google user data, we will notify affected users and obtain fresh consent before using their data in any new way. The effective date at the top of this page indicates when the policy was last revised.

10. Contact

Cambridge AI Safety Hub, fiscally sponsored by Meridian Impact CIC (data controller)
53-54 Sidney Street, Cambridge CB2 3HX
Email: hello@caish.org