Privacy notice
How Speak Sustainability handles your data
Pilot version — last updated September 11, 2026. Covers the waitlist signup and install-access flow for the Speak Sustainability skill pilot. This is a short, plain-language notice for a small pilot, not a full corporate privacy policy.
What we collect
When you join the waitlist, we collect:
- Email address (required) — to send you the confirmation email and, later, pilot access details.
- Role and organization (optional) — context that helps us understand who's interested; never used to decide whether you get access.
- Consent choices — whether you agreed to be contacted about pilot access, and separately, whether you're open to occasional feedback requests.
- Abuse-prevention signals — a salted, one-way hash of your IP address and a coarse browser/user-agent string, captured at signup and again when you confirm your email. We can't reverse these back into your actual IP address; they exist only to spot obvious bot/abuse patterns.
Why we collect it
Our lawful basis is your consent (UK GDPR Art. 6(1)(a)). Confirming your email and receiving pilot-access emails is a transactional purpose — it's what you signed up for by ticking the required box. If you also tick the separate, optional feedback box, that's a distinct purpose (occasional feedback requests) with its own consent, and you can withdraw from it without affecting your pilot access.
Who it's shared with
We use a small number of processors to run this pilot:
| Processor | Purpose |
|---|---|
| Resend | Sends the confirmation and pilot-access emails. |
| Supabase | Hosts the database where your signup record is stored. |
We don't sell your data or share it with anyone outside of running this pilot — the table above is the complete list of processors for now.
How long we keep it
- If you never confirm your email, we delete your signup automatically after 7 days.
- Once confirmed, we keep your record while the pilot relationship is active, and review/delete it after 12 months of no interaction, or sooner on request.
- Page-view/access logs (once the install page is live) are kept 90 days, then only in aggregate.
Your rights
You can withdraw consent, ask what we hold about you, or ask us to delete it, at any time. Email bschauer@rare.org and we'll respond within 30 days. Every email we send also carries an unsubscribe/erasure link scoped to that email type — for example, opting out of feedback requests doesn't opt you out of install-access emails, and vice versa.
Questions
Contact bschauer@rare.org for anything covered here. This address is a temporary alpha/pilot contact and will move to a team-owned inbox before wider launch.