01Who we are
AI Safety India ("we", "us") runs AI safety courses, reading groups, local groups, events and career advice in India. This policy explains what personal data we collect, why, where it is kept and what you can do about it.
Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for the data described here. That means we decide why and how it is used, and we are responsible for it.
This policy covers our website, your account, your applications, our forms and our events. It does not cover other websites we link to.
02What we collect
When you create an account
- Your name and email address.
- A password, if you sign up with email. Google stores it in scrambled (hashed) form. We never see it.
- Your Google account details, if you sign in with Google. Google shares your name and email address, and may share your profile picture. We use the name and email.
- Sign-in records, such as when your account was created and when you last signed in.
When you set up your profile
- Your interests, for example technical AI safety or governance.
- Your city, or that you are online only.
When you apply to a programme
- Your answers, for example your role, background, links you share and why you are applying.
- When you applied and the status of your application.
- Review notes and decisions written by our reviewers about your application.
When you use our forms or come to events
- What you type into our forms (contact, joining a hub, advising, organisations and the others). We store it in our own database, Cloud Firestore in Mumbai.
- Your event registration, if you register on Luma. Luma shares your name, email and any answers with us as the host.
- Emails you send us.
What we do not collect
- We do not use analytics or advertising tools, and we do not track you across websites.
- We do not ask for phone numbers, government ID numbers or payment details.
- We do not use cookies for tracking. Our sign-in keeps you signed in using storage in your browser. Embedded Luma pages may set their own cookies.
03Why we use it
We use your data only for these purposes:
- To create and secure your account, and let you sign in.
- To show you programmes, groups and events that fit your interests and city.
- To review applications and choose balanced cohorts.
- To tell you about your application: that we received it, our decision and, if you join, how to start.
- To match people who join with facilitators, reading groups and mentors.
- To answer your messages and run our events.
- To report our impact using anonymous totals only.
We rely on your consent, which you give when you create an account, apply or fill in a form. Where the DPDP Act allows it, we also use data you chose to give us for the purpose you gave it for.
We will only share your profile with a partner organisation, for example for a fellowship or research role, if you ask us to or agree to it first.
04Emails we send
- Account emails: to verify your email address and reset your password. Google sends these for us.
- Application emails: to confirm we received your application, share our decision and help you get started.
- Updates about programmes and events: only if you sign up for them. Every update has a link to stop them.
You cannot turn off account and application emails while you have an open account or application. They are part of the service.
06Where your data is stored
Profiles, applications, review notes and decisions are stored in Google Cloud Firestore in Mumbai, India (region asia-south1).
Accounts and sign-in are handled by Firebase Authentication. This is a global Google service, so your name, email address and sign-in records may be processed outside India.
Luma stores data mainly in the United States.
The DPDP Act allows personal data to be transferred outside India, except to countries the Government of India restricts. If a country we use is restricted, we will move that data or stop using the service.
07How long we keep it
We keep data only as long as we need it for the purposes above. Then we delete it or make it anonymous.
| Data | How long |
|---|---|
| Account and profile | Until you delete your account. If an account is unused for 3 years, we email you, then delete it. |
| Applications, review notes and decisions | 2 years after the decision on that application. Then deleted or made anonymous. |
| Messages and contact form entries | 2 years after our last reply. |
| Event registrations we receive from Luma | 2 years after the event. |
| Records of data requests | 1 year after we close the request. We keep what was asked and done, not your data. |
| Anonymous totals | Kept. For example, how many people applied from each city. They cannot identify you. |
If you withdraw consent or ask us to delete your data, we delete it within 30 days, unless the law requires us to keep it.
08How we protect it
- Data is encrypted when it travels between your browser and our services, and when it is stored.
- Database rules let you see only your own profile and applications.
- Only a few named reviewers can read applications. Their accounts are given access one by one.
- We collect as little as we can. Less data means less to lose.
If there is a personal data breach, we will tell the people affected and the Data Protection Board of India, as the DPDP Act requires.
09Your rights
Under the DPDP Act, you can:
- Access: get a summary of the personal data we hold about you and how we use it.
- Correct: fix, complete or update your data.
- Erase: ask us to delete your account and data.
- Withdraw consent: at any time, as easily as you gave it. We then stop using your data and delete it. We may not be able to continue reviewing an open application.
- Nominate: name someone to use these rights for you if you die or cannot act yourself.
- Complain: raise a grievance with us, and then with the Data Protection Board of India.
How to ask
Email contact@aisafetyindia.org from the address on your account, with the subject "Data request". Say what you want us to do.
We may ask you to confirm it is you. We reply within 30 days and keep a short record of each request.
You can also update your interests and city yourself, from your account.
10Children
Our programmes and accounts are for people aged 18 and over.
Under the DPDP Act, we need verifiable consent from a parent or guardian before we process data about anyone under 18. We do not knowingly create accounts for, or accept applications from, people under 18.
If you are under 18 and want to take part, ask a parent or guardian to write to contact@aisafetyindia.org first. If we learn that we hold data about someone under 18 without that consent, we delete it.
11Changes to this policy
We will update this page when our practices change, and change the date at the top.
If a change affects how we use data you have already given us, we will email account holders before it takes effect.
12Questions and grievances
For questions, requests or complaints about your personal data, contact our grievance contact. We reply within 30 days.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India.