Privacy policy

Last updated: November 2, 2026. Working draft for review by counsel before launch.

Your choices, without asking anyone: the privacy choices page lets you unsubscribe from the Brief, opt out of every non-essential email, download what we hold, and delete your personal data. Deletion is confirmed by a link emailed to the address, works once, and is logged.

The short version

We collect as little as we can. Reading the site needs nothing from you. The tools run in your browser and keep your answers there until you choose to save them. If you create an account we store your email address and what you put in your workspace, we keep it private, we never sell it, and you can export or delete it. We send email only when you ask for it. We use no advertising trackers.

1. Who is responsible

AI Governance Commons ("the Commons") is operated by Synthetic Labs, Texas, USA, founded by Justin Ryan. Synthetic Labs is the controller of the personal data described here. Contact us through the contact form on the site.

2. What we collect, and why

Visiting the site. Our server records standard request logs (IP address, page requested, time, browser type) for security and to keep the site running. Logs are kept for a short period and are not used to profile you. We do not use advertising cookies or third-party analytics that track you across sites.

Using the free tools. The Posture Review, What applies to me, Security Essentials, the CMMC self-check, the privacy check, the policy generator, and the others run in your browser. Your answers are stored in your browser's local storage so you can come back to them. They are not sent to us unless you click "Save to my workspace" or "Email me this". The domain check sends the domain name you type to our server so we can look up its public DNS records; we cache the result for an hour and keep a count of checks per connection to prevent abuse.

Creating an account. We store your email address, first and last name and organization if you give them, the role we assign you (member, contributor, editor, or admin), and sign-in times. Sign-in is handled by Clerk, including the sign-in methods offered on the sign-in page. The Commons application does not store your password.

Using a workspace. We store what you and your team put in it: AI systems, obligations, policies, evidence links and notes, assessment results and answers, incidents, questionnaire answers, team members and invitations, and your organization profile (jurisdictions, sector, size, and the yes or no flags that drive the tools). A workspace is private to its members unless you publish an attestation or a trust page, which are public by design and say so before you publish.

Subscribing to the Brief. We store your email address, the date you confirmed (double opt-in), and the date you unsubscribed. Each issue carries a one-click unsubscribe link.

Contacting us or submitting a form. We store what you send (name, email, organization, message, and the form fields) so we can reply and keep a record of corrections and claims.

Feedback and support. The help bubble stores your message, page address and title, optional email address, and conversation history. Feedback also includes the referring page, browser type, and viewport size to help diagnose issues. If AI support is enabled, your message, recent conversation, and relevant public page context are sent to the model provider to generate an answer. Avoid entering secrets or sensitive personal information. Asking for a person makes the conversation available to site staff for follow-up.

Registering for an event. We store your name and email for that event only.

Course certificates. We store the course, the score, and the date, linked to your account, and generate a certificate code. The public certificate page shows your name masked unless you are signed in as its owner.

API keys and webhooks. We store a hashed key, its label, when it was last used, and the webhook URLs you register.

3. Legal bases (for people in the EU and UK)

We process account and workspace data to perform the service you asked for (contract). We process logs and anti-abuse data for our legitimate interest in keeping the site secure and available. We send the Brief and event emails with your consent, which you can withdraw at any time. We handle contact form data for our legitimate interest in answering you.

4. Email

We send email only when you ask for it. We use no advertising trackers.

We send email only for things you asked for, and we keep a do-not-email list for addresses that have opted out: sign-in links, subscription confirmation, the Brief if you confirmed, workspace invitations, event registrations, alerts you turned on, replies to your messages, and reminders about an attestation you published. Marketing consent is never pre-ticked and we do not buy or rent lists. Email is delivered through a third-party provider acting on our instructions.

5. Who else sees your data

Named Synthetic Labs staff, for support with your consent, to investigate a security incident, or when the law requires, with administrative access logged. Service providers that host the site, store the database, and deliver email, acting on our instructions under contract. Automated editorial summaries use public laws and standards. If AI support is enabled, the model provider also receives the support messages and context described above. Nobody else, unless the law compels it. We do not sell personal data and we do not share it for advertising.

6. Public by design

Published attestations, trust pages, Wire posts you author, directory profiles you turn on, and corrections you make are public. The Ledger shows an organization's name, sector, size, jurisdictions, level, and dates. You choose whether to publish and can withdraw an attestation or unlist a profile at any time; copies others have made may persist.

7. Retention and deletion

Workspace data stays until you delete the workspace; deletion has a 14-day grace period and is then permanent. Deleting your account disables it, revokes keys, unsubscribes you, and schedules workspaces you alone own for deletion. Deleting your personal data from the privacy choices page goes further: it also deletes or anonymizes your messages and form submissions, event registrations, and course certificates, and adds your address to a do-not-email list so nothing is sent to it again unless you sign up afresh. Workspaces you alone own are deleted; workspaces with other members pass to them. Published attestations and trust pages are the organization's records and stay unless withdrawn from the workspace first. Contact messages and form submissions are kept while they are useful for the record of corrections and claims. Logs are kept briefly. Backups age out on their own schedule.

8. Your rights

You can export everything in a workspace as JSON from its settings page, change your account details, unsubscribe from any email in one click, opt out of all non-essential email, turn your directory listing off, withdraw an attestation, delete your account, and delete your personal data, all from the privacy choices page and the account page. If you are in the EU, UK, California, Texas, or another place with a privacy law, you may also have rights to access, correct, delete, restrict, or object, and to complain to a supervisory authority. Use the contact form; we answer within the legal deadline for your jurisdiction.

9. Cookies and local storage

A banner on your first visit asks which categories of cookies the site may use, and "Cookie settings" in the footer lets you change the choice at any time. Today the site sets one strictly necessary session cookie, to keep you signed in and to protect forms from cross-site misuse; no analytics or marketing cookies are in use, and if either is ever added it will run only for visitors who allowed that category. The tools use your browser's local storage to remember your answers; clear it from your browser or with "Start over" on any tool. We do not use advertising or cross-site tracking cookies. See the cookie notice for details.

10. Children

The Commons is for people at work. We do not knowingly collect personal data from anyone under 16.

11. Security

Encryption in transit, per-workspace access checks on every query, Clerk-managed sign-in, role-based access inside workspaces, and audit logging of administrative actions. No security is perfect; if you believe your data has been exposed, contact us and we will investigate and notify you as the law requires.

12. Changes

When this policy changes, the date at the top changes and the change is noted on the public change log. Material changes affecting account holders are emailed.

Automatic support answers

When automatic support is enabled, we send your question and up to 12 recent conversation messages to Anthropic, together with public site navigation and descriptions. Only recognized public navigation paths are included as page context, without query strings, fragments, or page titles. Private workspace and account records are not retrieved. Anything you type into chat is still sent: do not include secrets or sensitive personal information. Anthropic processes these messages under its API service terms and retention policies; deleting a conversation here does not itself delete provider-side records.

AI answers may be inaccurate and are not legal advice. You can skip AI and use "Talk to a person". That form goes to site staff, not Anthropic. Once requested, automatic answers stop for that conversation and it stays open for staff follow-up.