Responsible AI Studio operates the AI-governance tools and content at responsibleaistudio.com. We are the data controller for personal data processed through our services.
Contact: support@responsibleaistudio.com
When you use our tools you provide contextual inputs such as jurisdiction, industry, staff size, risk appetite, and optionally an organisation name. This information is used to generate your requested document during the request and is not linked to any individual identity. We do not require you to create an account to use our tools.
We collect your email address on the following surfaces — each with its own purpose. Where the law requires consent, we collect it before sending marketing email; where the relationship is purely transactional we rely on contract or our legitimate interest in responding.
checkout.session.completed webhook. We add the email to the Responsible AI Studio Brief audience so you receive product updates and tips relevant to the tool you purchased. You can unsubscribe at any time via the link in any email; doing so does not affect your access to the tool or the document you generated. If you do not want to receive the weekly brief, unsubscribe immediately after your purchase confirmation.chatbot.All payments are processed by Stripe under their own PCI-DSS certified infrastructure. We never see, store, or process your card or banking details. Stripe provides us with limited transaction metadata (transaction ID, amount, timestamp, payment status, and the email you entered at checkout) for order fulfilment and refund processing.
Our hosting infrastructure (Vercel for the frontend, Railway for the backend) records standard server logs including IP addresses, request paths, response timestamps, and user-agent strings. These logs are retained for approximately 30 days for operational and security purposes and are not used for marketing or advertising.
For the chatbot specifically, we store a salted SHA-256 hash of your IP address — not the IP itself — so we can apply rate limits and detect abuse without retaining your raw IP.
We use a minimal set of cookies described in our Cookie Policy.
We do not use your data for behavioural advertising, profiling, or sell it to third parties.
We share personal data only with the processors below, each under a data-processing agreement.
support@responsibleaistudio.com.We do not share your data with advertisers, data brokers, or any third party for marketing purposes.
The Responsible AI Studio Assistant chatbot is anonymous by default. When you open the widget we issue a session identifier (a UUID) and store it in a first-party cookie named raisChatSessionId with a 30-day lifetime and SameSite=Lax attribute. The cookie carries no personally identifying information; it is the key under which your conversation is stored in our Supabase database.
We log each user message and assistant reply against the session ID, plus a salted SHA-256 hash of your IP address (we never persist the raw IP) and a coarse user-agent summary (e.g.mobile-safari). We log the IDs of retrieved content chunks used to ground each reply so we can audit the chatbot’s adherence to its source material.
If you choose to provide an email mid-conversation (for example to receive a personalised summary or a sample artifact), the session is linked to that email, the email is added to the Responsible AI Studio Brief audience in Resend with a chatbot source tag, and you receive the welcome sequence. You can clear the cookie and start a fresh anonymous session at any time using the “Forget this conversation” button inside the widget. You can unsubscribe from the Brief at any time using the link in any issue.
Depending on your jurisdiction (GDPR, UK GDPR, Quebec Law 25, CPRA, and similar regimes), you may have the right to:
To exercise any of these rights, email support@responsibleaistudio.com. We aim to respond within 30 days.
Our services operate globally and your data may be processed in jurisdictions outside your own (in particular the United States, where our hosting and AI providers operate). Where personal data is transferred internationally, we rely on appropriate safeguards including standard contractual clauses or equivalent mechanisms provided by each processor.
All data transmission uses TLS encryption. Payment information is handled exclusively by Stripe’s PCI-DSS-certified infrastructure. The chatbot database uses Supabase row-level security; our chatbot backend authenticates with a server-side service key never exposed to the browser.
Our services are not directed at children under 16. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time. Changes will be posted to this page with an updated date. For material changes we will email subscribers using the address on file.
Privacy questions and data-rights requests: support@responsibleaistudio.com.