Privacy notice

Who runs this site

The data controller is the individual who runs this site, based in the UK. I don’t publish my name, postal address or email on this site. The contact form at /#contact reaches me directly, and I will give my name and a correspondence address to anyone who asks through it for a data-protection purpose.

For the standby list, once it opens, this section will also carry: [full name, correspondence address and contact email, to be confirmed before sign-up opens].

What this site does and does not collect

• No cookies. No analytics. No advertising or tracking scripts.
• The AI contact form on the homepage (/#contact, form name ai-contact) is live. What you type into it is stored by Netlify Forms and read by one human; the section below says exactly what is kept and for how long.
• The optional drafting tool on the homepage creates a draft in your browser tab only. The draft itself stores nothing and sends nothing to us; only the contact form sends.
• Fonts are loaded from Google Fonts, which means your browser requests font files from Google. Google may log your IP address; see Google’s privacy policy. We do not receive anything from that request.
• The site is hosted by Netlify, which keeps standard access logs (such as IP address, requested page, browser type and time) for its own operational and security purposes, for a limited period. We do not use Netlify Analytics or view individual access logs. If that changes, we will say so here and rely on our legitimate interest in keeping the site secure.

The AI contact form

The form on the homepage at /#contact is live. It is a Netlify Forms form named ai-contact, and it also accepts a plain HTTP POST as described on /for-ai/. This section applies to both routes. It is written in the first person because one person runs the form.

What is stored

The six fields you send: who you are (who), what you are trying to do (goal), what you would like me to do (task), how to reply (reply_to), anything else you add (anything_else), and the disclosure box (ai_disclosure), together with the date and time of the submission. Netlify also records technical data with each submission: the IP address, browser type and referring page. I don’t use these and delete them with the rest of the message.

You choose what to put in the message. Please don’t include passwords or credentials, sensitive personal information, or, apart from the reply route, information about anyone else. If you include it, I remove it from the record. If I learn a message came from someone under 18, I delete it and don’t act on it.

Why, and on what basis

So that one human can read the message, decide whether to help, and reply. The lawful basis is my legitimate interest in reading and answering messages sent to me through this site. That interest does not override your rights: you can object at any time, and objecting means I stop and delete the message. I don’t rely on consent, because I would need to read a message to know what it asks.

Who processes it

Submissions are collected by Netlify Forms, which acts as my processor and stores them on my behalf under its own data processing terms. Netlify runs every submission through Akismet (Automattic Inc.) for spam filtering; Akismet receives the submission and deletes the vast majority of spam-related data within two weeks to ninety days; a very small subset may be kept longer. A message flagged as spam is held in a spam list until I release it by hand. Netlify also emails me a copy of each verified submission, so a copy sits in my mailbox at [email provider, to be confirmed], which processes it to deliver mail. That copy is deleted on the same schedule as the Netlify record. Netlify and Akismet are US companies; see “Where your data is stored” below.

Who sees it

One human reads it: me, the person behind this site. The Netlify account that holds the submissions is used only by me; Netlify staff can access it only under Netlify’s own processing terms. Messages are not shared with anyone other than the processors named above (Netlify, Akismet and my email provider), and are never given to any AI system or other third party, except as needed to reply to you at the reply route you gave. No automated decisions or profiling. No AI tool reads, sorts or answers messages for me. If I ever use one to help word a reply, I strip out anything that identifies you first.

How long I keep it

Twelve months from the date of submission. There is no automatic deletion at Netlify, so I delete by hand, checking at least every three months. Messages held in the spam list that I don’t release are deleted at the same check. Deletion means removing the message from Netlify Forms, from the emailed copy, and from any reply correspondence. Sooner on request: send a message through the same form saying so, and it is deleted within 30 days.

How to ask for deletion or anything else

Send a message through the same form at /#contact saying what you want done, with enough detail to find the original message. Because the form is the only route, I confirm a request by replying to the reply route given on the original message before I delete or change anything; if I can’t reach that route, I explain why I can’t act. The request message itself is deleted along with the original. Requests about your data are the one thing on this site with a promised time: an answer within one month. The rights listed under “Your rights” below apply to contact-form messages too.

Where your data is stored

Netlify and Akismet store data in the United States. This applies to contact-form messages now and to the standby list once it opens. Netlify, Inc. is a US company; it states that it is certified under the UK Extension to the EU–US Data Privacy Framework and otherwise relies on standard contractual clauses. Akismet is run by Automattic Inc., also in the US; [confirm Automattic’s UK Extension certification on the DPF list, otherwise cite Netlify’s contract with Akismet].

The standby list

The form at /for-humans/ is not yet open. Nothing below applies until it opens; it describes how the list will be run.

What is stored

When you submit the form, we store: the name you give us, your email address, your country or region, whether you can help remotely, the kinds of help you offer, your skills note, your availability, anything you say you will not do, the fact that you ticked the charter, consent and 18-or-over boxes, which version of the charter and this notice you agreed to, and the date and time of your submission.

We do not ask for, and do not want, sensitive information such as health, religion or political views, or information about anyone else. If you include it, we remove it from your record. We rely on your confirmation that you are 18 or over and do not verify it. If we learn that someone on the list is under 18, we delete their record.

Who processes it

Submissions are collected by Netlify Forms, which acts as our processor and stores the submissions on our behalf under its own data processing terms. Netlify runs every submission through Akismet (Automattic Inc.) to detect spam; Akismet receives the submission and deletes most spam data within 14 to 90 days. Netlify also records the IP address, browser type and referring page with each submission; we do not use these and delete them with the rest of your record. [Operator to confirm against the Netlify Forms export before sign-up opens.]

Any private copy of the list is kept as an encrypted file on the operator’s own device, not in a cloud service. We email you from [email provider, to be confirmed], which processes your address to deliver mail. Where the data is stored is set out under “Where your data is stored” above.

Why, and on what basis

We use your details to confirm your address, to contact you about a pilot and, if one starts, to offer you tasks. The lawful basis is your consent, given when you tick the data consent box on the form. You can withdraw that consent at any time; see below.

Who sees it

Only the operator reads it. Netlify and Akismet handle it as processors in the course of collecting, storing and spam-filtering submissions, under their own data processing terms. Your name, contact details and skills are never given to any AI system or to any requester. If you help with a task, we pass on what you report, not who you are. We publish only totals: how many people are listed and which kinds of help, rounded, never below ten.

No automated decisions or profiling. We do not put the list, or any part of it, into any AI tool, including to draft emails, sort people or match tasks. A person does all of that by hand.

How long we keep it

• Within 7 days of your sign-up we email you to ask you to reply and confirm your address. If you do not reply within 30 days, we delete the sign-up and send nothing more.
• Twelve months from your last confirmation. Once a year we email to ask whether you still want to be listed. No reply after one reminder, and your record is deleted.
• When you ask to be removed, your record is deleted within 30 days and we confirm.

Deletion means removing you from the Netlify submissions, any private copy, and our email correspondence with you. We keep no note that you were listed, so if you sign up again later we treat you as new.

What we email you about

Only a confirmation of your address when you sign up, a pilot starting, a task offer, the yearly check-in, a change to the charter or this notice, or a wind-down. These are messages about the list you joined, not marketing. We will not send newsletters, updates, fundraising or promotional emails, and we will never pass your address to anyone else to email you. Every email we send tells you how to be removed: email [contact email, to be confirmed] or reply “remove me”.

Your rights

Under UK data protection law you can ask us to:

• tell you what we hold about you (access);
• correct anything that is wrong (correction);
• delete your record (erasure);
• restrict what we do with your details while a query is resolved (restriction);
• receive a copy of what you gave us in a common file format (portability);
• stop using your details, which for this list means deleting them (withdrawing consent, or objection).

For the standby list (once it opens), email [contact email, to be confirmed] or reply to any email from us. For a contact-form message, send a message through the same form at /#contact. We reply within one month. Withdrawing consent does not affect anything done before you withdrew. We only act on requests sent from the email address on your record, or after a simple identity check (for a contact-form message, a reply to the reply route on the original message), so that nobody else can change or delete your details. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Nothing here removes any right you have under UK law.

If the project stops

If Human on Standby winds down, we email everyone on the list to say so and delete everything we hold within 30 days: the Netlify Forms submissions, any private copy, and our email correspondence with you. We keep no note of who was listed.

Changes

If this notice changes what we collect, who sees it, or what we use it for, we email everyone on the list and ask them to agree again. Smaller corrections are noted here with a new date.

Privacy notice v0.2. The contact-form section has applied since [go-live date, to fill in at deploy]; the standby-list section is a draft until sign-up opens.