Privacy
What we do with what you send us.
We collect a small amount of information through two forms: the enquiry form and the certification application. This page explains what we hold, why, and how to ask us to change or delete it.
01
What we collect
Only what you send us. Our enquiry form collects the topic of your enquiry, your organization, your name, your email address, and your message. A certification application collects the same contact details plus the information you provide about your organization and how it uses AI. We do not buy or enrich contact data from third parties.
02
Why we hold it
To reply to you, to scope and carry out a certification assessment, and to keep a record of certifications we issue.
03
Where it goes
Submissions are stored in our hosted application database and emailed to the Ethicality certification team. Evidence you upload for an assessment is used to review your file against the standard and is shared with the named certification officer assigned to it, and with nobody else; everyone with access is bound by a written confidentiality undertaking. That first review is performed by an AI model under contract terms that prohibit the provider from using your evidence to train models. We use a hosted database provider (Supabase), an AI provider that performs that review, an email delivery provider, and a payment processor (Stripe, which stores the card you provide at submission - we never see or hold your card number). Each processes data on our instructions only. We do not share your information with any other organization unless the law requires it.
04
What becomes public
Nothing you send is published unless a certification is issued. At issuance, the public registry shows the organization name, the standard and its version, the scope, the certificate number, the issue and expiry dates, the current status, the certification officer who signed it, and founding-cohort membership where it applies. There are no scores or levels to publish. Assessment evidence, draft findings, and internal correspondence stay private.
05
How long we keep it
Enquiries that do not lead to an engagement are deleted 12 months after our last exchange. Assessment evidence and assessment records are kept for three years from the date of issuance - the one-year certification period plus two years - so that an issued certificate can be substantiated if it is later questioned, then deleted. If an application does not proceed to assessment, any evidence already sent is deleted within 90 days of the file closing. Registry entries for issued certifications remain published, including after expiry, as a permanent record of what was certified and when.
06
Your requests
Write to aiden@ethicality.ai to ask for a copy of what we hold about you, a correction, or deletion, and put "data request" in the subject line. We confirm receipt by the next business day and complete the request within 30 days. You can ask for deletion at any time; if you do so during an active assessment we will stop the assessment, because we cannot certify what we cannot keep a record of. Deletion does not remove a registry entry for a certification already issued. Our address is 2770 Dufferin St #223, North York, ON M6B 3R7, Canada.
Questions about certification itself are answered in the FAQ, and our terms of use are on the terms page.