What we collect.
What we don't.

What we collect

The Site collects information only when you choose to provide it:

Contact form submissions: name, email, organization, and the content of your message. Submitted through the form on /contact.

Newsletter subscription: email address only. Submitted through /subscribe, and confirmed by a double opt-in email before any briefing is sent.

Ask SCL questions: only if you turn on question retention on Ask SCL. Off by default, and covered in section 02 below.

Readiness assessment: answers to the questions on /assess are stored only in your browser. Nothing from the readiness assessment is transmitted to SCL unless you choose to download your report and share it with us.

Ask SCL and question retention

Ask SCL is built with Llama. Answers are generated by an open-weight Llama 3.1 model that SCL fine-tuned and runs on hardware SCL controls; no cloud AI provider generates answers. Answers are grounded in SCL’s published material: the framework text, the question library, SCL’s plain-language explainers on how AI is regulated and assured, and, as they are added, reference summaries written by the agencies that publish the documents, each labeled by who wrote it; a reference summary is never SCL’s text. Before answering, a small ranking model hosted by Cloudflare scores your question against SCL’s own framework text to choose which passages to use. That ranking service has a daily allowance and is not always available. When it is not, SCL’s own keyword matching chooses the passages instead, and the answer is generated the same way. Cloudflare also runs the request handling for the assistant and stores retained questions. The Cloudflare services involved are listed in section 05.

By default nothing you type is kept. Server logs record the time, duration, and outcome of a request, never its content.

If you tick the retention box on the Ask page, the text of your questions is stored so that SCL can find gaps in its published material and improve the assistant. That choice is off unless you turn it on, it is remembered in your browser only, and you can turn it off at any time.

What is stored: the question text, the date it was asked, and which published entries were used to answer it, by identifier only: framework text and, from the October 2026 release, SCL explainers and reference summaries. Before storage, questions are automatically scrubbed of email addresses, telephone numbers, and long key-like strings.

What is never stored: your IP address, any session or device identifier, your conversation history, which stays on your own device as described in the next paragraph, and anything from a document you attach. Attached documents are excluded from retention entirely, whatever your setting, because those excerpts are not SCL’s to keep.

Kept on your device only. The conversation shown on the Ask page is saved in the browser tab you are using, so that reloading the page does not lose it. It is never transmitted to SCL, no other site can read it, and it is erased when you choose “New conversation” or close the tab. The text of an attached document is never saved this way; it is held in memory only, for as long as the tab is open.

Stored questions carry no identifier and are not linked to each other or to you. That is a deliberate design choice, and it has a consequence worth stating plainly. SCL holds nothing recording who asked a question, so in the ordinary case it is not in a position to identify you and therefore cannot locate, export, correct, or delete your past questions on request. If you can identify a question yourself, by telling SCL its wording and roughly when you asked it, contact SCL and it will act on your request. Rights that do not depend on identifying you, including the right to object to this processing, are unaffected: turning the retention box off stops any further questions being kept.

SCL does not claim that stored questions are anonymous, because a question written in your own words could in principle single someone out. It treats them as data it is not able to attribute to a person, holds no key that would let it try, and applies the scrubbing described above to reduce what a question can reveal. Please do not type confidential or personal information into the assistant.

Retained questions are deleted after 12 months.

What we do not collect

We do not run third-party analytics on the Site. We do not track page-by-page browsing, build advertising profiles, or sell visitor data. We do not set marketing or advertising cookies.

How information is used

Information you submit is used for one purpose only: to respond to you. Contact form messages are used to reply to your inquiry. Subscribed emails are used to send the briefings described on the subscribe page. We do not use submitted information for any other purpose, and we do not share it with third parties except the processors named below.

Third-party processors

A small number of vendors process limited information on our behalf. Each is named here so you can review their own privacy practices:

Cookies

The Site does not set marketing or analytics cookies. The third-party processors named above may set functional cookies necessary to deliver their service (for example, Formspree may set a session cookie when you submit the form). No data is sold or shared with advertisers.

Your rights

If you have submitted information through the Site, you may:

Request a copy of what we hold about you. Request correction of inaccurate information. Request deletion of your information, subject to limited legal retention obligations.

To exercise any of these rights, contact SCL. We will respond within a reasonable timeframe.

One exception, set out in full in section 02. Retained Ask SCL questions carry no identifier, so in the ordinary case we cannot connect one to you and cannot locate, export, correct or delete it on request. Rights that do not depend on identifying you are unaffected, retention is off unless you turn it on, and retained questions are deleted after 12 months in any event.

Data retention

Contact form submissions and email correspondence are retained for the period necessary to respond to your inquiry and maintain a record of the engagement. Newsletter subscriptions are retained until you unsubscribe. Records related to certification engagements are retained for the period specified in the SCL Assessment Methodology (minimum ten years or the life of the certified system).

Changes

This Privacy Policy may be revised. The current version is identified by the Effective date at the top of this page.