Privacy policy

Last updated: 30 September 2026 (Regulatory Radar billing, the weekday digest, and the measurement tags the site loads).

What we collect

Google Analytics 4 (GA4) — aggregated visit metrics: pageviews, sessions, referrer, approximate geographic region (country / city, derived from IP and discarded), browser + device type, screen size, and the path of pages you view. GA4 sets first-party cookies (_ga and _ga_J5HT9GKYTN) that persist for up to 13 months. IP addresses are anonymised by Google before storage. The GA4 property ID is G-J5HT9GKYTN; the underlying data lives in our Google Workspace account. See /legal/cookies for the full list of cookies this site sets.
LinkedIn Insight Tag — an advertising-measurement tag from LinkedIn that loads on every page (snap.licdn.com and px.ads.linkedin.com). It sets its own cookies and lets LinkedIn report which of our LinkedIn campaigns brought visitors to the site. LinkedIn processes that data under its own privacy policy.
Mautic marketing analytics — our own Mautic instance records which pages a browser visits, keyed to a device identifier held in a cookie set by our Mautic host (marketing.hospital.org.uk, so a third-party cookie from casrai.org) and a copy in your browser’s local storage, so we can see which pages and campaigns bring visitors. When you follow a link from casrai.org to lac.us, that device identifier is passed along so the two visits can be counted together. If you fill in a form on this site, such as the Regulatory Radar checkout or an enquiry form, the address you gave may be recorded against that identifier.
Server logs — IP address, user-agent string, requested URL, HTTP status, response time. Retained 30 days for operational debugging. Not joined to GA4 data. Not used for tracking.
Form submissions — when you submit a term proposal, contact form, newsletter signup, or grants/scholarship program registration, we collect the data you provide. Retention varies by form (each form discloses its retention period).
Working-group membership — name, email, affiliation, ORCID iD (optional). Retained for the duration of your WG participation plus 2 years for governance audit purposes.
Cloudflare — the CASRAI site is fronted by Cloudflare for DNS, caching, and basic DDoS protection. Cloudflare logs request metadata per its privacy policy; we do not access individual Cloudflare logs.
Ask CASRAI questions — when you use the assistant at /ask or the “Ask about this page” box on a dictionary, guide, CRediT-role or comparison page, we keep the question you typed, the answer we gave, which CASRAI pages were retrieved to answer it, and technical measurements (how confident the retrieval was, which model answered, how long it took). We do this because the questions research administrators actually ask are the best evidence we have of what our documentation is missing — that is what the assistant is for. Questions are automatically scrubbed of things that look like personal data (email addresses, phone numbers, ORCID iDs, NHS/NI numbers, credential-bearing URLs, long tokens) before they are stored, and the input is capped at 400 characters. Please don’t type personal, confidential or unpublished information into it — you don’t need to in order to get a good answer, and we say so under every input box. Retention is per field; see the table below. Your questions are never sold and never used to train a third-party model — see “AI processing” below for how that is enforced rather than merely promised.
Anti-abuse measurement — the assistant is a public endpoint backed by a paid API, so we count requests to keep it available and affordable. We store a first-party session cookie (casrai_ask_sid, 30 days, strictly necessary), a keyed hash of your IP address, and your country and coarse region from Cloudflare. We never store the IP address itself. The hash used in our logs is re-keyed every day, so the same visitor cannot be linked from one day to the next, and it is deleted after 30 days; the separate hash used for rate-limit counters lives in memory for at most 48 hours. If Cloudflare Turnstile is enabled, it performs a bot check without profiling you or tracking you across sites.
Affiliate/referral links — our AI Writing & Research Tools pages contain disclosed referral links to third-party products. Clicking one may let that third party know you came from casrai.org via a tracking parameter in the URL; CASRAI does not otherwise track or store your activity on those external sites. See our affiliate disclosure policy for details.
Regulatory Radar subscriptions — see “Billing and the weekday digest” below.

What we don't collect

Social-media share buttons that track you (the LinkedIn Insight Tag above is the one advertising-measurement tag the site loads)
Cross-site behavioural profiles built by CASRAI; we do not sell or rent personal data
Your card number: card details are entered on Stripe’s payment page and never reach our servers
Sensitive personal data — we never ask for it and don't accept it via forms
Children's data — the site is not directed at users under 13

Billing and the weekday digest (Regulatory Radar)

Regulatory Radar is a paid subscription. Payment is taken through Stripe, Inc., acting as our payment processor, on behalf of The Health Initiative, the 501(c)(3) non-profit that is CASRAI’s fiscal sponsor and the organisation that charges you.

Held by Stripe: your email address, the name and billing address you enter at checkout, the optional “Institution” field, your card details, and your invoices and payment history. Stripe processes these under its own privacy policy. We never see or store your card number.
Held in our database: the checkout email address, Stripe’s customer and subscription identifiers, the subscription’s status and plan (individual or team), whether the weekday digest is switched on, the CASRAI account it is linked to, and when it was created and last changed. We also keep a record of every checkout that is started, whether or not it is completed: the plan and number of seats, the page and button it was started from, any campaign (UTM) parameters on the link you arrived by, the Ask CASRAI session it was started in, the CASRAI account if you were signed in, and, when it completes, the amount, currency and date. This record holds no email address. For a team plan we also hold the invited colleagues’ email addresses and seat status.
If you do not finish a checkout: Stripe expires the checkout, and if you typed your email address into Stripe’s payment form we send one email to that address with a Stripe link to finish the same checkout. We record whether a link was available and when that email was sent. It is sent from [email protected] through the same mail relay as the digest, and no further reminders follow. The address is also recorded in our Mautic instance as an unfinished checkout. Lawful basis: legitimate interests (letting someone who started buying finish without starting again). You can object at any time, without giving a reason, by emailing [email protected] or replying to that email.
The weekday digest: subscribers receive an email on weekdays when something new has been published across the sources Radar watches (it has been sending since 28 September 2026). It is sent by our own WordPress server through Google Workspace’s mail relay from [email protected], to the address on the subscription or seat, and it can be switched off on your Regulatory Radar dashboard.
Lawful basis and retention: contract (to provide what you paid for) and legal obligation (financial records). The subscription record is not removed by the Ask-history erasure control, because it is a financial record with its own retention obligation and your own evidence of what you paid for. Ask to have it removed once that obligation has passed by emailing [email protected].

Billing questions, seats and access: [email protected].

AI processing (Ask CASRAI)

Ask CASRAI is a retrieval assistant. Answers draw on CASRAI's guides and dictionary plus the federal and funder documents we index: Federal Register, Grants.gov, Regulations.gov and UKRI. It gives a language model only the passages it found in those sources, so that every claim can be cited back to a page you can read yourself. It has no other source. If those sources don’t cover your question, it says so rather than guessing.

Two processors are involved, and both are engaged under Article 28 data-processing agreements:

Qdrant Solutions GmbH (Qdrant Cloud, hosted in AWS us-east-1, USA) — receives your question in order to search our content index, and stores the logged question so we can group similar questions together and spot recurring gaps.
OpenRouter, Inc. (USA) — receives your question together with the CASRAI passages we retrieved, as a single prompt, and returns the drafted answer.

Transfers to the USA. Both are US-established, and neither is covered by the EU-US Data Privacy Framework certification we rely on for Google and Cloudflare. Transfers to them are made under the Standard Contractual Clauses (UK GDPR Article 46 / EU GDPR Article 46(2)(c)), with the UK International Data Transfer Addendum where the UK GDPR applies, supported by a transfer risk assessment. Copies are available from [email protected].

“Never used to train a third-party model” is a technical control, not a promise. Every single generation request we send carries an explicit no-data-collection instruction (data_collection: "deny"), which is mandatory in our configuration and checked when the service starts. Any model that will not serve a request under that instruction is removed from our list rather than worked around — we have already dropped several capable models for exactly this reason. We do not fine-tune or train any model, our own included, on your questions; doing so would be a material change requiring a fresh assessment before it shipped.

Google Analytics receives categorical events only (that a question was asked, answered, refused, rated, or a citation clicked). Your question text is never sent to Google Analytics.

The assistant answers questions and cites sources. It does not make any decision about you, and there is no automated decision-making with legal or similarly significant effect (UK GDPR Article 22 is not engaged). Answers are drafted by a language model and may be wrong — always check the primary source we link. Published answer pages additionally carry a named human reviewer with a resolvable ORCID iD.

Our full Legitimate Interests Assessment for question logging is published in the repository as docs/rag/lia.md and is available on request.

How long we keep things

Ask CASRAI data is deleted field by field, not row by row, by an automated nightly job. The numbers below are the ones the code actually enforces:

Data	Kept for	Why
Your question, as typed (after PII scrubbing)	400 days	One full annual funding cycle plus a comparison period — the shortest window in which seasonal gaps are visible
The answer text	90 days	Quality review and correction
Free-text feedback comments	90 days	Acting on a complaint about an answer
Keyed IP hash	30 days	Abuse investigation. Re-keyed daily, so it is not linkable across days
Rate-limit counters	≤ 48 hours	Enforcing the daily quota
Normalised phrasing, topic labels, and which pages were retrieved	Indefinitely	This is the longitudinal record of what the community needed to know, and is what tells us what to write next. Once the raw question is purged it is no longer attached to any utterance, and after 30 days it carries no network identifier at all

Server logs are kept 30 days. Other retention periods are disclosed on the form that collects the data.

Deleting your Ask CASRAI history

A question can exist in five places, so we built one control that clears all of them — the database row, the search index entry, any cached answer computed from it, the write-ahead log file, and the answer cache. Nothing is left behind in a corner.

Signed in? Use Delete my Ask history at /account/preferences, or the export-and-erase controls at /account/data.
Not signed in? Email [email protected]. Include the session identifier shown at the foot of the assistant, or tell us roughly when and what you asked.
You can also object to this processing at any time (UK GDPR Article 21). Because we rely on legitimate interests rather than consent, you do not have to give a reason: we will erase your questions and stop logging further ones from that session.

Opting out of Google Analytics

You can opt out of GA4 measurement in two ways:

Install the Google Analytics Opt-out Browser Add-on (works in Chrome, Firefox, Safari, Edge).
Use any browser extension that blocks googletagmanager.com or analytics cookies (e.g. uBlock Origin, Brave Shields, Privacy Badger).

Your rights (GDPR / UK GDPR / EEA)

You have the right to:

Access — request a copy of any personal data we hold about you
Rectify — correct inaccurate data
Erase — request deletion of your data (subject to legal-retention exceptions)
Port — receive your data in a portable format
Restrict / object — restrict processing or object to specific uses
Lodge a complaint with your national data-protection authority (in the UK: the ICO)

Signed in? You can download a copy of what we hold, including your Ask history and your subscription record, and erase your Ask history yourself at /account/data (Privacy & data).

Email [email protected] to exercise any of these rights. We respond within 30 days (typically sooner).

Lawful basis (UK GDPR Article 6)

Legitimate interests for analytics (understanding which content helps the research-administration community) — assessed against your privacy rights; opt-out available as above.
Legitimate interests for Ask CASRAI question logging — identifying what our documentation is missing, correcting answers that mislead, calibrating the assistant so it refuses honestly rather than guessing, and keeping a public endpoint backed by a paid API available and affordable. Assessed and documented in a written Legitimate Interests Assessment (docs/rag/lia.md), which records the minimisation applied before storage and the per-field retention above. You can object at any time, without giving a reason.
Consent for newsletter subscription and form submissions you initiate — including the optional “tell me when you cover this” email capture shown when the assistant cannot answer.
Contract / Legitimate interests for working-group membership records.
Contract and legal obligation for Regulatory Radar billing records and the weekday digest subscribers receive as part of the subscription.
Legitimate interests for the record of Regulatory Radar checkouts started (which pages and campaigns lead to a purchase) and the single email we send when a checkout expires unfinished (see Billing). You can object at any time, without giving a reason.

Data transfers

GA4 and Cloudflare are US-based services. Both rely on the EU-US Data Privacy Framework adequacy decision (effective 2023) for transfers from the EU/UK to the US. Server infrastructure runs in AWS us-east-1 (Virginia, USA).

Stripe (payments), LinkedIn (the Insight Tag) and Google Workspace (the mail relay that sends account email and the weekday digest) are also US-based services that transfer data under their own published safeguards; see their privacy policies linked above.

Qdrant and OpenRouter, the two processors behind Ask CASRAI, are also US-established but are not covered by that adequacy decision. Transfers to them rely on the Standard Contractual Clauses under Article 46, with the UK International Data Transfer Addendum where the UK GDPR applies. See “AI processing” above.