Privacy notice

Who is responsible

AISafetyWatch is the controller for the personal data described here. For anything in this notice, or to exercise the rights below, contact [email protected].

What we collect

When you submit a report, we collect:

• what you tell us about how you felt, in your own words - this is the substance of the report;
• the tool, app, or platform involved, and roughly when it happened;
• any optional context you choose to add, such as your age band or whether you are reporting for yourself or someone you support;
• contact details, only if you choose to give them so we can ask follow-up questions.

We do not ask for your name, and reporting does not require an account. Free-text answers are the point of this platform, so they may contain information about your health or state of mind. Under the GDPR that is special-category data (Art. 9), and it is treated as such throughout.

Why we collect it

To monitor for patterns of harm associated with conversational AI tools and social media, and to study them. Reports are analysed in aggregate. An individual report is not assessed as a clinical case and does not produce advice, a diagnosis, or a response to you.

Our lawful basis

We propose to process this data as a task carried out in the public interest (Art. 6(1)(e)), relying on the scientific-research condition in Art. 9(2)(j) for special-category data, subject to the safeguards in Art. 89(1) - including data minimisation and, wherever it does not defeat the research purpose, pseudonymisation.

Anonymity

Reporting is anonymous by default. Because we do not know who you are, we generally cannot connect a later request to a specific report - see your rights for what that means in practice. If you include details that identify you inside a free-text answer, they are stored as part of the report.

Who else handles your data

The report form is provided by Qualtrics, which stores responses on our behalf as a data processor under a written agreement. We do not sell your data, and we do not share it for advertising.

Where your data is stored

We intend for report data to be stored within the European Economic Area. Where any processor or sub-processor transfers data outside the EEA, we will rely on an adequacy decision or Standard Contractual Clauses, and will name those transfers here.

How long we keep reports

We propose to retain reports for five years from submission, after which they are deleted or fully anonymised. Aggregated results that cannot identify anyone may be kept indefinitely, including after publication.

Your rights

Under the GDPR you can ask us to:

• confirm what personal data we hold about you, and give you a copy;
• correct it if it is wrong;
• erase it;
• restrict or object to how we use it;
• provide it in a portable form, where that right applies.

Because reports are anonymous by default, we usually cannot identify which report is yours, and Art. 11 means we are not required to acquire more information purely to find it. If you want to be able to withdraw a report later, include contact details when you submit — otherwise we will likely be unable to act on a request about it.

To make a request, contact [email protected].

Automated decisions

We do not make automated decisions about you that produce legal or similarly significant effects, and we do not profile you for advertising.

Children

This platform is expected to be used by people under 18. Our policy on a minimum age, on how age is established, and on parental consent where it is required is being finalised with our data protection officer, and this section will be replaced when it is.

Complaints

If you are unhappy with how we handle your data, please tell us first at [email protected]. You also have the right to complain to your national supervisory authority - in the Netherlands, the Autoriteit Persoonsgegevens.

Changes

If this notice changes materially, we will update it here and revise the review date. See also our terms.