Privacy

Who is responsible

The Open Source Safety Consortium is not yet a legal entity. This website is operated on its behalf by Polymath Robotics, Inc. ("we", "us"), which is the controller of the personal data described here. Questions and requests about privacy go to hello@opensourcesafe.com.

What is collected

• Server logs. When you load a page, the web server records your IP address, the date and time, the page or file requested, the response, the page that linked you here if your browser sends it, and your browser's user-agent string.
• Page performance. Cloudflare Web Analytics measures how quickly pages load and counts page views. It uses no cookies or local storage and does not fingerprint visitors. We see only totals, never individual visits.
• Network traffic. Every request passes through Cloudflare, which delivers the site and protects it from attacks, so Cloudflare sees your IP address and request as well. If it ever needs to check that traffic is not an automated attack, Cloudflare may set a short-lived security cookie, used for nothing else.
• Email. If you write to us, we receive your address, your name if you give it, and whatever you write.

Nothing else is collected. We do not buy data about visitors, combine it with other sources, or build profiles.

Why, and on what basis

• Server logs and Cloudflare: to deliver the site, keep it secure, and diagnose faults. The legal basis under the GDPR is our legitimate interest in running a working, secure website (Article 6(1)(f)).
• Page performance: to learn which pages are read and whether they load quickly. Legitimate interests; the figures are aggregate only.
• Email: to answer you and carry on the conversation you started, including about membership. Legitimate interests, or steps you ask us to take before a membership agreement (Article 6(1)(b)).

You do not have to give us anything: the whole site can be read without sending us any information. No decisions about you are made automatically, and there is no profiling.

How long it is kept

• Server logs are held in a rolling log capped at 2 MB, which overwrites its oldest entries as new ones arrive and is erased whenever the site is redeployed. At current traffic that is a few weeks at most. Logs are not included in backups.
• Cloudflare keeps request data under its own retention terms as our service provider; see its privacy policy.
• Email is kept as long as the conversation, and any membership that follows from it, needs it. Ask and we will delete it, unless the law requires us to keep it.

Who else handles it

• Cloudflare, Inc. delivers and protects the site, provides the performance figures, and forwards email sent to this domain.
• Google LLC hosts the mailbox that email [email protected] is delivered to (Google Workspace).
• People working on the consortium may see your message where they need to in order to answer it.
• Authorities, if the law requires it.

We do not sell personal information, and we do not share it for advertising, as those terms are defined in California law. No third party tracks you across websites through this one.

We and these providers are based in the United States, so if you are in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred there. Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, and also offer the European Commission's Standard Contractual Clauses.

Your rights

Depending on where you live, including the EEA, the UK, Switzerland, California, and other US states with privacy laws, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy in a portable form. Email us to use any of these rights; we will reply within one month and will not treat you differently for asking.

To find log entries about you we would need your IP address and roughly when you visited. Because the logs roll over, they may already be gone.

You can complain to the data protection authority where you live or work: in the EU, see the list of national authorities; in the UK, the Information Commissioner's Office. We would appreciate the chance to put things right first.

Do Not Track and Global Privacy Control

This site does not track visitors over time or across other websites, and does not let third parties do so. Every visitor is already treated the way these signals ask, so there is nothing further for them to switch off.

Children

The site is written for engineers and organizations, not children. We do not knowingly collect personal data from anyone under 16.

Changes

Changes are posted on this page with a new effective date. If a change materially affects how personal data is used, we will also note it on the News page before it takes effect. Earlier versions are available on request.