Privacy and data handling
Collect less. State the purpose. Preserve the boundary. Delete on time.
FASO’s privacy position follows the same discipline as its evidence work: identity, purpose, authority, custody, access, retention and deletion must remain explicit and reviewable.
Data controller
Project FASO is responsible for the personal information described here.
Project FASO is the independent founder-led initiative developing the proposed Frontier Alignment and Safety Observatory. The proposed future organisation does not yet exist and is not the current data controller. A later change of controller requires a separate, prominent notice and cannot silently alter the purposes described here.
To contact the controller, use the privacy enquiry form and select the topic that best describes your request. Do not send identity documents unless FASO asks for proportionate verification.
Scope
This notice covers the public website, enquiry forms and resulting correspondence.
It applies to website visitors, enquirers, prospective reviewers, developers, supporters, funders, media contacts and people whose information is included in related correspondence.
The public website and contact forms are separate from protected FASO system evidence and governed technical records. Do not submit confidential model evidence, credentials, security material or special-category information through a public form.
Information register
What FASO processes, why it processes it and how retention is managed.
FASO collects information for the purposes below. The stated periods apply to records under FASO’s control; hosting and security providers also retain service records under their own documented policies.
Website delivery and security
- Information
- Internet Protocol address, request time, requested path, browser or user-agent information, response status and a security event where one occurs.
- Purpose and lawful basis
- Delivering and protecting the site; Project FASO’s legitimate interests in providing a secure public-information service.
- Retention
- Squarespace and its service providers manage platform logs under their service and privacy policies. Any separate security record retained by FASO is kept while needed to investigate an incident and meet related legal duties.
General enquiries and correspondence
- Information
- Name, contact details, role, organisation where relevant, message, requested material, correspondence history and stated confidentiality, attribution or timing conditions.
- Purpose and lawful basis
- Responding, routing the enquiry and preserving an accurate authority record; legitimate interests, or steps requested before a possible agreement where applicable.
- Retention
- 24 months after the last substantive exchange, unless the matter becomes an active relationship, contract, complaint, legal obligation or protected evidence record.
Reviewer and participation records
- Information
- Expertise, interests, availability, affiliation, relevant experience, declared conflicts, independence conditions, review scope, decisions and authorised attribution.
- Purpose and lawful basis
- Assessing suitability, independence, conflicts and safe participation; Project FASO’s legitimate interests in rigorous and accountable engagement.
- Retention
- If not progressed: 24 months after the final decision. If progressed: for the relationship and six years after it ends. Published attribution follows the separately authorised publication record.
Funding, diligence and formal relationships
- Information
- Identity, affiliation, proposal, diligence material, conflicts, correspondence, decisions, agreements, payment records and authority conditions.
- Purpose and lawful basis
- Assessing and administering a possible or actual relationship; legitimate interests, requested pre-contract steps, contract and legal obligations as applicable.
- Retention
- Unprogressed discussions: 24 months after the final decision. Agreements, financial records and material relationship records: six years after the relationship ends, or longer only where a specific legal duty requires it.
Rights, complaints and incidents
- Information
- The request or complaint, proportionate identity-verification evidence, correspondence, investigation material, decision, response and delivery proof.
- Purpose and lawful basis
- Meeting data-protection duties, protecting rights and demonstrating accountable handling; legal obligation and legitimate interests.
- Retention
- Six years after the request, complaint or incident is closed. Verification documents are deleted as soon as verification is complete unless required as evidence of a dispute.
Deletion rule. When a retention period ends, the record is deleted or irreversibly anonymised. Copies held by service providers and in backups are subject to their deletion and backup cycles. FASO requests deletion of provider-held enquiry records when they are no longer required. A documented legal hold may pause deletion only for the identified record and only until the relevant claim, investigation or legal duty ends.
Protected boundaries
Personal information does not acquire a new purpose merely because FASO holds it.
- FASO does not sell or rent personal information.
- FASO does not use personal information for behavioural advertising or profiling.
- FASO does not place enquiries into public or general-purpose generative-artificial-intelligence services or use them to train artificial-intelligence models.
- FASO does not publish a person’s name, organisation, correspondence or contribution without separate authority or another documented lawful basis.
- FASO does not turn an enquiry into a mailing-list subscription. There is currently no public newsletter or marketing list.
- FASO does not make solely automated decisions about people that produce legal or similarly significant effects.
Sources, sharing and processors
Access follows purpose, not convenience.
Most information comes directly from the person concerned. Where FASO receives information from an organisation, referrer or public source, it records the source and provides privacy information where required.
Who may receive information
Only bounded recipients with a defined need.
Squarespace receives form submissions, retains submission and contact records, and sends notifications to FASO’s email account. Google provides reCAPTCHA spam protection. Information may also be handled by FASO’s email and secure-record providers, people authorised to administer the enquiry, and professional legal, accounting, security or data-protection advisers. An independent reviewer receives identifiable information only where it is necessary and authorised; de-identification is preferred.
FASO may disclose information where law requires it, to protect a person from serious harm, or to establish, exercise or defend legal rights. It does not give funders, developers, supporters or prospective institutional partners an automatic right to another person’s information.
International processing
Location does not reduce the protection.
Where a technical provider processes personal information outside the United Kingdom, FASO requires a lawful transfer mechanism: United Kingdom adequacy regulations or United Kingdom-approved contractual safeguards supported by the required transfer-risk assessment.
The current processor categories and transfer basis are available through the data-protection contact route. No international transfer is authorised for advertising, data brokerage, profiling or artificial-intelligence training.
Your rights
A privacy request does not require technical language.
State what you want FASO to do and provide enough information to locate the relevant record. FASO responds without undue delay and normally within one month.
Access
Ask whether FASO holds your personal information and request a copy.
Correction
Ask FASO to correct inaccurate information or complete an incomplete record.
Erasure
Ask FASO to delete information where the right applies.
Restriction
Ask FASO to limit use of information while an issue is resolved.
Objection
Object to processing based on legitimate interests. FASO must stop unless it demonstrates an overriding lawful reason.
Portability and consent
Request portable information where the right applies, or withdraw consent without affecting earlier lawful processing.
Security and minimisation
Public contact is separated from protected system evidence.
Access is limited to people who need the information for the stated purpose. Contact records are not stored in the public website source or published page output. FASO uses proportionate access control, secure transmission and record separation, and investigates suspected loss, unauthorised access or disclosure.
FASO does not ask for children’s information and the participation routes are intended for people aged 18 or over. If information about a child is received unintentionally, it is restricted and deleted unless a clear safeguarding or legal duty requires a different action.
Complaints and questions
Use the privacy route first—or go directly to the regulator.
Use the privacy enquiry form for a data protection request, question or complaint. FASO may ask for limited information to verify identity but will not require excessive identification.
You may complain to the United Kingdom Information Commissioner’s Office at any time. Visit Make a data-protection complaint to the Information Commissioner’s Office.
Version control
Material changes are visible and do not operate retrospectively.
- Version
- 1.1
- Updated
- 11 September 2026
- Effective
- 11 September 2026
- Review
- Before any new form, cookie, analytics service, processor, data purpose or organisational controller is introduced
A revised notice states what changed and when. A revision cannot retrospectively widen an earlier purpose, convert silence into consent or erase an existing confidentiality, independence, attribution or authority condition.