Action Hub

Privacy Policy

Last updated: 18 September 2026

This Privacy Policy describes how ControlAI US, Inc. ("we", "us", or "our") collects, uses, and shares your personal data when you use the act.controlai.org website (the "Service").

We are committed to protecting your privacy and processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.

1. Our Contact Details

You can contact us at [email protected].

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • Name
  • Profile picture (if provided via authentication services or uploaded by you)

2.2 Authentication Data

Depending on how you sign in, we may collect:

  • Google OAuth: Your Google account ID and profile information
  • Email OTP: Your email address and one-time passwords (temporarily stored)

2.3 Usage Data

When you use our Service, we collect:

  • Your responses to actions
  • Communication preferences
  • Feedback you provide through surveys, such as when leaving a group
  • Reports you submit about content or other users

2.4 Technical Data

We automatically collect certain technical information:

  • IP address
  • Browser type and version
  • Device information
  • Pages visited and interactions with the Service
  • Date and time of visits

2.5 Group Participation Data

If you join an action group, we collect:

  • Your phone number, which is required to join a group so that your group's organisers can stay in touch with you
  • Your approximate location (postal code, city, and country), used to match you with nearby groups

The people who run your group can see these details, along with when you joined and when you were last active, so that they can coordinate the group's activities.

2.6 Push Notification Data

If you enable push notifications, we collect the push subscription details needed to deliver notifications to your browser or device.

2.7 Lawmaker Contact Data

Some actions help you contact your elected lawmakers. If you use one, we collect:

  • Your name and, depending on your country, your home address (street address, city, state, and postal code) or your postcode, used to identify your lawmakers
  • Your phone number where the lawmaker's contact form requires one
  • If you call our hotline, your phone number and call activity, used to connect you to your senators’ offices and record your participation against your account
  • The subject and message you write, and which lawmakers you chose to contact

We store your address with your account so your next lawmaker-contact action can be prefilled.

3. How We Use Your Information

We use your personal data for the following purposes:

  • Service Delivery: To create and manage your account, authenticate you, and provide the core functionality of the Service
  • Communication: To send you weekly actions, service updates, security alerts, and account notifications, by email or, where you have enabled them, push notifications
  • Action Participation: To show you ControlAI actions, record your responses, and coordinate actions in groups you join
  • Group Coordination: To connect you with an action group and enable the group's organisers to contact you about group activities
  • Analytics: To understand how users interact with our Service and improve its functionality
  • Advertising Measurement: To learn which advertising brought you to the Service and to report the actions you take back to the advertising platforms we use, so that we can judge which campaigns work
  • Security: To detect, prevent, and address technical issues, fraud, or security threats
  • Legal Compliance: To comply with applicable laws and regulations

4. Legal Basis for Processing

Under the UK GDPR and EU GDPR, we process your personal data on the following legal bases:

  • Contract Performance: Processing necessary to provide you with the Service, including account creation, authentication, and delivering weekly actions
  • Legitimate Interests: Processing for analytics, security, and service improvement, where our interests do not override your fundamental rights
  • Consent: Where you have given explicit consent, such as for marketing communications. You may withdraw consent at any time
  • Legal Obligation: Where processing is necessary to comply with legal requirements

5. Data Sharing and Third Parties

5.1 Third-Party Service Providers

We use the following third-party services to operate our Service:

  • Google OAuth: For user authentication. Google's privacy policy applies to data they collect: policies.google.com/privacy
  • SendGrid: For sending transactional and notification emails. SendGrid is a Twilio service and Twilio's privacy policy applies: twilio.com/legal/privacy
  • Google Maps: For address search and matching you with nearby groups
  • Better Stack: For session replays and browser error monitoring. Better Stack’s privacy policy applies: betterstack.com/privacy.
  • Google Tag Manager and Google Ads: For loading our measurement tags and attributing actions to Google advertising. Google's privacy policy applies: policies.google.com/privacy
  • Meta: For attributing actions to advertising on Facebook and Instagram, using the Meta Pixel and Conversions API. Meta's privacy policy applies: facebook.com/privacy/policy
  • Reddit: For attributing actions to advertising on Reddit, using the Reddit Pixel and Conversions API. Reddit's privacy policy applies: reddit.com/policies/privacy-policy

5.2 Legal Requirements

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom and European Economic Area, including the United States, where some of our service providers are located.

When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

  • Transfers to countries with adequacy decisions from the UK or EU
  • Standard Contractual Clauses approved by the UK Information Commissioner's Office or European Commission
  • Other legally approved transfer mechanisms

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

  • Account data: Retained while your account is active and for 30 days after account deletion request
  • Authentication tokens: Email OTPs expire after one hour
  • Usage data: Retained while your account is active
  • Analytics data: Retained in anonymized form for service improvement

We may retain certain data for longer periods where required by law or for legitimate business purposes such as fraud prevention.

8. Your Rights

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you
  • Right to Rectification: You may request correction of inaccurate or incomplete data
  • Right to Erasure: You may request deletion of your personal data (subject to legal retention requirements)
  • Right to Restrict Processing: You may request that we limit how we process your data
  • Right to Data Portability: You may request a copy of your data in a structured, machine-readable format
  • Right to Object: You may object to processing based on legitimate interests or for direct marketing
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.

Right to Lodge a Complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a supervisory authority:

  • UK: Information Commissioner's Office (ICO) - ico.org.uk
  • EU: Your local data protection authority

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your authentication session
  • Remember your preferences
  • Analyse usage patterns
  • Record session replays and browser errors once you accept analytics cookies
  • Recognise which advertisement brought you here and report the actions you take back to Google, Meta and Reddit, together with a hashed form of your email address, so they can count them
  • Deliver push notifications you have enabled

Our cookie banner lets you choose "Only necessary". That choice, or a Global Privacy Control signal from your browser, stops the advertising cookies and pixels above and removes advertising identifiers from what we record. Your choice is shared between controlai.org and act.controlai.org and can be changed at any time from the link in the page footer.

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Service.

10. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

For significant changes that affect how we process your personal data, we will provide notice through the Service or by email before the changes take effect.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].

Working to keep humanity in control.

Questions or feedback?

[email protected]

ControlAI is a 501(c)(4) non-profit organisation that works to prevent the extinction risk posed by superintelligence and to secure a great future for humanity.