We hold less about you than you probably expect.
We are a research body, not an advertising business. We do not sell personal data, we do not build profiles for anyone else, and the single most sensitive thing we hold is the identity of the people at enterprises who answer our questions. That is protected unconditionally and is explained in section seven.
Who we are
Global AI Forum is an independent enterprise research body with offices in San Francisco and Chennai. For the purposes of data protection law we are the controller of the personal data described in this notice. You can reach us at privacy@gaiforum.com or at 720 Market Street, San Francisco, CA 94102.
This notice covers gaiforum.com, the register and index, our research publications, our events and workshops, and correspondence with us.
What we collect
| Category | What it includes |
|---|---|
| Contact details | Name, work email, organization and role, when you write to us, request an edition, book a session or register for an event. |
| Correspondence | The content of emails and form submissions, including anything you choose to tell us in them. |
| Register correspondence | Where you answer a verification enquiry on behalf of an enterprise. Treated separately and far more strictly. See section seven. |
| Engagement records | For clients, the record of sessions delivered, attendees and materials shared, kept for the duration of the engagement and our contractual obligations. |
| Recruitment data | CVs, work samples and interview notes where you apply for a role with us. |
| Technical data | IP address, browser and device type, pages requested and timestamps, collected by our servers in the ordinary course of serving the site. |
We do not collect special category data, we do not ask for it, and you should not send it to us. We do not purchase personal data from brokers and we do not enrich what you give us against third-party databases.
Why we hold it
We hold personal data to answer you, to deliver work you have engaged us for, to run the verification correspondence the register depends on, to meet our legal and accounting obligations, and to keep the site running and secure.
Where the law requires a basis for processing, ours is the performance of a contract where you are a client, our legitimate interest in running a research body and corresponding with professionals in their professional capacity, your consent where you have asked to receive something from us, and legal obligation where we are required to keep records.
We do not use personal data for automated decision-making that produces legal or similarly significant effects.
Cookies and analytics
We keep this deliberately thin. We use cookies that are strictly necessary for the site to function, and privacy-respecting analytics to understand which pages are read and whether the site is working. We do not run advertising cookies, we do not operate retargeting pixels, and we do not share analytics data with advertising networks.
Where consent is required for any non-essential cookie, we ask for it before setting one, and declining has no effect on your ability to read anything on this site.
Who we share it with
We share personal data with service providers who process it on our behalf under written instructions: hosting and infrastructure, email delivery, analytics, and the tools we use to run the business. We require each of them to protect it and to use it for nothing else.
We share it where we are legally required to, and where necessary to establish or defend a legal claim.
We do not sell personal data, and we do not share it with vendors. If a technology company asks us who has been reading about them, who attended a session, or who answered an enquiry, the answer is no. That answer does not change for a client, a commissioning party or anyone else.
How long we keep it
- Enquiries and correspondence. Two years from our last exchange, unless it relates to a determination, in which case it follows the register retention below.
- Client engagement records. For the engagement and seven years afterwards, to meet accounting and contractual obligations.
- Register correspondence. Retained as part of the determination log for as long as the determination is published, and in archived form afterwards, because a record that cannot be audited is not a record.
- Recruitment data. Twelve months after a decision, unless you ask us to keep it longer for future roles.
- Technical data. Server logs are kept for ninety days.
Register correspondence
This is the part of this notice that matters most. Where you answer a verification enquiry on behalf of an enterprise, neither you nor your organization is ever named in anything we publish. The vendor is named. The customer is not, and no commercial relationship with us changes that.
What we publish from such an exchange is the fact that an organization of a stated type confirmed or did not confirm a stated deployment, at a stated stage, on a stated date. We do not publish your name, your email, your organization, or the content of what you wrote.
Your identity is visible internally to the people who maintain the register and to anyone reviewing a determination under the Ombuds route, because a determination that cannot be checked internally is worthless. It is visible to nobody else, including the vendor whose claim you were asked about, including where they are certain they already know.
You may withdraw your answer at any time by writing to us, and the determination it supported will be re-examined and, where it rested on your answer alone, withdrawn.
Your rights
Depending on where you are, you may have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where our processing relies on it.
To exercise any of these, write to privacy@gaiforum.com. We will respond within thirty days. We will not charge you and we will not ask why.
If you are in India, these rights sit under the Digital Personal Data Protection Act 2023. If you are in the European Economic Area or the United Kingdom, they sit under the applicable data protection regulation and you may complain to your supervisory authority. If you are in California, you may have rights under the CCPA as amended, including the right to know and to delete. We do not sell or share personal information as those terms are defined there.
One limit worth stating plainly: where a deletion request would require us to destroy part of a determination log that supports a published finding, we will remove your personal identifiers but retain the substance of the exchange, because the integrity of a published record depends on it. We will tell you if that applies to your request.
International transfers
We operate from the United States and India and our service providers may process data in other countries. Where personal data moves between jurisdictions we rely on appropriate safeguards, including standard contractual clauses with our processors.
Security
We use access controls, encryption in transit, and restrict register correspondence to the people who need it for their work. No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data and the law requires us to tell you, we will, without waiting to be asked.
Children
This site and our services are for professionals and are not directed at children. We do not knowingly collect personal data from anyone under eighteen. If you believe we have, write to us and we will delete it.
Changes and contact
This notice is version 1.0, in force from 19 October 2026. Material changes will be published with a new version number and date, and where the change affects how we handle data you have already given us, we will tell you directly.
Questions, requests or complaints go to privacy@gaiforum.com, or by post to Global AI Forum, 720 Market Street, San Francisco, CA 94102.
Anything here you want to query
Write to us directly. Privacy questions go to a person, not a ticket queue.