Privacy
What we do with what you send us.
Ethicality Inc. · Last updated October 16, 2026
We collect a small amount of information through two forms: the enquiry form and the certification application. This page explains what we hold, why, and how to ask us to change or delete it.
01
What we collect
Mostly what you send us. Our enquiry form collects the topic of your enquiry, your organization, your name, your email address, and your message. A certification application collects the same contact details plus the information you provide about your organization and how it uses AI. Like any website, our hosting provider also automatically records basic technical information when you visit, such as your IP address, browser type and the pages requested, to deliver the site and keep it secure. We do not buy or enrich contact data from third parties.
02
Cookies and browser storage
We do not use advertising cookies, tracking pixels, analytics or session-recording tools. Your browser stores a small amount of information on your own device only where it is needed for the site to work: your unfinished application, so you can return to it, and your sign-in session if you use the applicant portal. Payment card entry is handled by Stripe, which may set its own cookies to process the payment securely and prevent fraud. You can clear this storage at any time through your browser settings; clearing it removes any unsaved application progress. Full details are in our cookie notice at ethicality.ai/cookies.
03
Why we hold it
To reply to you, to scope and carry out a certification assessment, and to keep a record of certifications we issue.
04
Where it goes
Submissions are stored in our hosted application database and emailed to the Ethicality certification team. Evidence you upload for an assessment is used to review your file against the standard and is shared with the named certification officer assigned to it, and with nobody else; everyone with access is bound by a written confidentiality undertaking. That first review is performed by an AI model under contract terms that prohibit the provider from using your evidence to train models. We use a hosted database provider (Supabase), an AI provider that performs that review, an email delivery provider, and a payment processor (Stripe, which stores the card you provide at submission - we never see or hold your card number). Each processes data on our instructions only. We do not share your information with any other organization unless the law requires it.
05
What becomes public
Nothing you send is published unless a certification is issued. At issuance, the public registry shows the organization name, the standard and its version, the certificate number, the issue and expiry dates, the current status, the industry the organization selected, the website it gave us, and the certification officer who signed it. There are no scores or levels to publish. Assessment evidence, draft findings, and internal correspondence stay private.
06
How long we keep it
Enquiries that do not lead to an engagement are deleted 12 months after our last exchange. Assessment evidence and assessment records are kept for three years from the date of issuance - the one-year certification period plus two years - so that an issued certificate can be substantiated if it is later questioned, then deleted. If an application does not proceed to assessment, any evidence already sent is deleted within 90 days of the file closing. Expired certificates remain listed in the public registry, marked "Inactive." Registry entries remain a permanent record of what was certified and when.
07
Your requests
Ethicality Inc., a corporation incorporated in Ontario, Canada, is responsible for the information described in this notice. Write to aiden@ethicality.ai to ask for a copy of what we hold about you, a correction, or deletion, and put "data request" in the subject line. We confirm receipt by the next business day and complete the request within 30 days. You can ask for deletion at any time; if you do so during an active assessment we will stop the assessment, because we cannot certify what we cannot keep a record of. Deletion does not remove a registry entry for a certification already issued. Our address is 2770 Dufferin St #223, North York, ON M6B 3R7, Canada.
08
How we protect it
Access to submissions and assessment evidence is limited to the people who need it to do the work, protected by sign-in and database access rules. Our providers encrypt data in transit. No system is perfectly secure, so if we learn of a breach that creates a real risk of significant harm to you, we will tell you and report it as the law requires.
09
Children
Our services are for organizations and the adults who act for them. We do not knowingly collect information from children. If you believe a child has sent us information, write to us and we will delete it.
10
Links to other sites
Our site links to other websites, such as advisor profiles, official regulatory sources and our social media pages. Those sites have their own privacy practices, which we do not control.
11
Changes to this notice
If we change how we handle your information, we will update this page and the date at the top. If a change materially affects information you have already given us, we will tell you before it applies.
Questions about certification itself are answered in the FAQ, and our terms of use are on the terms page.