Privacy policy

Last updated: 31 July 2026.

What we collect

Google Analytics 4 (GA4) — aggregated visit metrics: pageviews, sessions, referrer, approximate geographic region (country / city, derived from IP and discarded), browser + device type, screen size, and the path of pages you view. GA4 sets first-party cookies (_ga and _ga_J5HT9GKYTN) that persist for up to 13 months. IP addresses are anonymised by Google before storage. The GA4 property ID is G-J5HT9GKYTN; the underlying data lives in our Google Workspace account. See /legal/cookies for the full list of cookies this site sets.
Server logs — IP address, user-agent string, requested URL, HTTP status, response time. Retained 30 days for operational debugging. Not joined to GA4 data. Not used for tracking.
Form submissions — when you submit a term proposal, contact form, newsletter signup, or grants/scholarship program registration, we collect the data you provide. Retention varies by form (each form discloses its retention period).
Working-group membership — name, email, affiliation, ORCID iD (optional). Retained for the duration of your WG participation plus 2 years for governance audit purposes.
Cloudflare — the CASRAI site is fronted by Cloudflare for DNS, caching, and basic DDoS protection. Cloudflare logs request metadata per its privacy policy; we do not access individual Cloudflare logs.
Ask CASRAI questions — when you use the assistant at /ask or the “Ask about this page” box on a dictionary, guide, CRediT-role or comparison page, we keep the question you typed, the answer we gave, which CASRAI pages were retrieved to answer it, and technical measurements (how confident the retrieval was, which model answered, how long it took). We do this because the questions research administrators actually ask are the best evidence we have of what our documentation is missing — that is what the assistant is for. Questions are automatically scrubbed of things that look like personal data (email addresses, phone numbers, ORCID iDs, NHS/NI numbers, credential-bearing URLs, long tokens) before they are stored, and the input is capped at 400 characters. Please don’t type personal, confidential or unpublished information into it — you don’t need to in order to get a good answer, and we say so under every input box. Retention is per field; see the table below. Your questions are never sold and never used to train a third-party model — see “AI processing” below for how that is enforced rather than merely promised.
Anti-abuse measurement — the assistant is a public endpoint backed by a paid API, so we count requests to keep it available and affordable. We store a first-party session cookie (casrai_ask_sid, 30 days, strictly necessary), a keyed hash of your IP address, and your country and coarse region from Cloudflare. We never store the IP address itself. The hash used in our logs is re-keyed every day, so the same visitor cannot be linked from one day to the next, and it is deleted after 30 days; the separate hash used for rate-limit counters lives in memory for at most 48 hours. If Cloudflare Turnstile is enabled, it performs a bot check without profiling you or tracking you across sites.
Affiliate/referral links — our AI Writing & Research Tools pages contain disclosed referral links to third-party products. Clicking one may let that third party know you came from casrai.org via a tracking parameter in the URL; CASRAI does not otherwise track or store your activity on those external sites. See our affiliate disclosure policy for details.

What we don't collect

Social-media share-pixel tracking
Cross-site behavioural profiles or advertising cookies of any kind
Sensitive personal data — we never ask for it and don't accept it via forms
Children's data — the site is not directed at users under 13

AI processing (Ask CASRAI)

Ask CASRAI is a retrieval assistant: it searches CASRAI’s own published pages and gives a language model only the passages it found, so that every claim can be cited back to a page you can read yourself. It has no other source. If we haven’t published something on your question, it says so rather than guessing.

Two processors are involved, and both are engaged under Article 28 data-processing agreements:

Qdrant Solutions GmbH (Qdrant Cloud, hosted in AWS us-east-1, USA) — receives your question in order to search our content index, and stores the logged question so we can group similar questions together and spot recurring gaps.
OpenRouter, Inc. (USA) — receives your question together with the CASRAI passages we retrieved, as a single prompt, and returns the drafted answer.

Transfers to the USA. Both are US-established, and neither is covered by the EU-US Data Privacy Framework certification we rely on for Google and Cloudflare. Transfers to them are made under the Standard Contractual Clauses (UK GDPR Article 46 / EU GDPR Article 46(2)(c)), with the UK International Data Transfer Addendum where the UK GDPR applies, supported by a transfer risk assessment. Copies are available from [email protected].

“Never used to train a third-party model” is a technical control, not a promise. Every single generation request we send carries an explicit no-data-collection instruction (data_collection: "deny"), which is mandatory in our configuration and checked when the service starts. Any model that will not serve a request under that instruction is removed from our list rather than worked around — we have already dropped several capable models for exactly this reason. We do not fine-tune or train any model, our own included, on your questions; doing so would be a material change requiring a fresh assessment before it shipped.

Google Analytics receives categorical events only (that a question was asked, answered, refused, rated, or a citation clicked). Your question text is never sent to Google Analytics.

The assistant answers questions and cites sources. It does not make any decision about you, and there is no automated decision-making with legal or similarly significant effect (UK GDPR Article 22 is not engaged). Answers are drafted by a language model and may be wrong — always check the primary source we link. Published answer pages additionally carry a named human reviewer with a resolvable ORCID iD.

Our full Legitimate Interests Assessment for question logging is published in the repository as docs/rag/lia.md and is available on request.

How long we keep things

Ask CASRAI data is deleted field by field, not row by row, by an automated nightly job. The numbers below are the ones the code actually enforces:

Data	Kept for	Why
Your question, as typed (after PII scrubbing)	400 days	One full annual funding cycle plus a comparison period — the shortest window in which seasonal gaps are visible
The answer text	90 days	Quality review and correction
Free-text feedback comments	90 days	Acting on a complaint about an answer
Keyed IP hash	30 days	Abuse investigation. Re-keyed daily, so it is not linkable across days
Rate-limit counters	≤ 48 hours	Enforcing the daily quota
Normalised phrasing, topic labels, and which pages were retrieved	Indefinitely	This is the longitudinal record of what the community needed to know, and is what tells us what to write next. Once the raw question is purged it is no longer attached to any utterance, and after 30 days it carries no network identifier at all

Server logs are kept 30 days. Other retention periods are disclosed on the form that collects the data.

Deleting your Ask CASRAI history

A question can exist in five places, so we built one control that clears all of them — the database row, the search index entry, any cached answer computed from it, the write-ahead log file, and the answer cache. Nothing is left behind in a corner.

Signed in with ORCID? Use Delete my Ask history at /account/preferences.
Not signed in? Email [email protected]. Include the session identifier shown at the foot of the assistant, or tell us roughly when and what you asked.
You can also object to this processing at any time (UK GDPR Article 21). Because we rely on legitimate interests rather than consent, you do not have to give a reason: we will erase your questions and stop logging further ones from that session.

Opting out of Google Analytics

You can opt out of GA4 measurement in three ways:

Install the Google Analytics Opt-out Browser Add-on (works in Chrome, Firefox, Safari, Edge).
Enable your browser's Do Not Track setting. We honour DNT for analytics in addition to required exclusions.
Use any browser extension that blocks googletagmanager.com or analytics cookies (e.g. uBlock Origin, Brave Shields, Privacy Badger).

Your rights (GDPR / UK GDPR / EEA)

You have the right to:

Access — request a copy of any personal data we hold about you
Rectify — correct inaccurate data
Erase — request deletion of your data (subject to legal-retention exceptions)
Port — receive your data in a portable format
Restrict / object — restrict processing or object to specific uses
Lodge a complaint with your national data-protection authority (in the UK: the ICO)

Email [email protected] to exercise any of these rights. We respond within 30 days (typically sooner).

Lawful basis (UK GDPR Article 6)

Legitimate interests for analytics (understanding which content helps the research-administration community) — assessed against your privacy rights; opt-out available as above.
Legitimate interests for Ask CASRAI question logging — identifying what our documentation is missing, correcting answers that mislead, calibrating the assistant so it refuses honestly rather than guessing, and keeping a public endpoint backed by a paid API available and affordable. Assessed and documented in a written Legitimate Interests Assessment (docs/rag/lia.md), which records the minimisation applied before storage and the per-field retention above. You can object at any time, without giving a reason.
Consent for newsletter subscription and form submissions you initiate — including the optional “tell me when you cover this” email capture shown when the assistant cannot answer.
Contract / Legitimate interests for working-group membership records.

Data transfers

GA4 and Cloudflare are US-based services. Both rely on the EU-US Data Privacy Framework adequacy decision (effective 2023) for transfers from the EU/UK to the US. Server infrastructure runs in AWS us-east-1 (Virginia, USA).

Qdrant and OpenRouter, the two processors behind Ask CASRAI, are also US-established but are not covered by that adequacy decision. Transfers to them rely on the Standard Contractual Clauses under Article 46, with the UK International Data Transfer Addendum where the UK GDPR applies. See “AI processing” above.