Transparency Policy
Evidence over assertion.
This is a Transparency Policy, not a privacy policy. We are transparent by default whenever we collect your data, so we are trust capable.
Most sites publish a privacy policy that asserts transparency. This one follows the Internet Transparency Code of Practice (ITCoP), which aligns with the transparency principles of Convention 108+. The Code's first principle is evidence over assertion, so this page is built to be inspectable, not just read. The machine-readable records behind this page are published as evidence: the Controller Identity Record, the notice record and the Notice Event Log, indexed at /.well-known/notice.txt. This policy is TCIEG's transparency_policy_point.
Transparency by default. We will provide you a notice for informed consent before your data is collected and a receipt to withdraw consent with.
1. Who is accountable, before you identify yourself
The Code requires that accountability be inspectable before anyone is asked to identify themselves. So, up front:
You do not need an account, a login, or to identify yourself to read any of the above.
2. What we process, and why
This covers tcieg.org and the Insights blog at insights.tcieg.org. Both process the minimum needed to serve pages, let you contact us, send the newsletter if you ask for it, and record expert survey answers if you give them. Each purpose, its lawful basis, and the processor acting for us:
| What | Why | Lawful basis | Processor |
|---|---|---|---|
| Network metadata (IP, timestamp, request) | Serve and secure tcieg.org and Insights | Legitimate interest | Hetzner Online GmbH (Helsinki, Finland) |
| Fonts and scripts | Page rendering | Not applicable | None: fonts and the Insights sign-up and search scripts are served from our own server, with no third-party call |
| Email you send us | Answer your message | Your request | Proton AG (Switzerland) |
| Newsletter, if you subscribe on Insights | Send the updates you asked for | Consent, given at the notice shown before you subscribe and evidenced by its receipt number. Withdraw anytime | Subscriber list: Hetzner, Finland. Delivery: Mailgun Technologies, Inc., a US company, from its EU region |
| Expert survey answers, if you respond at tcieg.org/survey | Input to the Internet Transparency Code of Practice (ITCoP), reported in summary without names unless you agree | Consent, given at the notice shown before you respond and evidenced by its receipt number. Withdraw anytime with that number, and your answers are deleted | Hetzner, Finland. No name, email or IP address is stored. Kept until the survey summary is published, and no later than 31 March 2027 |
| White paper at tcieg.org/whitepaper: downloading needs nothing and creates no record about you. Only if you record support for the ITCoP for AI, that fact and your name and role if given; and, only if you ask to be contacted about the review, your email address; with a consent receipt number, the notice version and the time | To give you the draft white paper, to record your support and give you a supporter badge if you ask, and, if you ask, to contact you about the review. Supporters are counted; names are not published | Consent, given at the notice shown before you download and evidenced by its receipt number. Withdraw anytime with that number, and your request and contact details are deleted | Hetzner, Finland. No IP address is stored. Kept until version 1.0 of the paper is published, and no later than 31 March 2027 |
| Following Insights from a fediverse account | Deliver Insights posts to accounts that follow it | Legitimate interest | Ghost Foundation, whose ActivityPub service runs on Google Cloud (US companies) |
We do not run advertising trackers, behavioural analytics, or profiling on this site.
3. Your rights, and how to use them
For legitimate-interest processing (site delivery and security) you may object and request access, correction, or deletion of any personal data we hold about you. For consent-based processing (the newsletter) you may withdraw consent at any time, and every email carries an unsubscribe link.
How: contact info@tcieg.org. We answer rights requests without requiring you to create an account. Derogations: none apply to the rights described here, with one exception. Newsletter email is held by Mailgun, a US company, and access to it by US authorities under US law is not governed by UK data protection law. You consent to that exposure at the notice shown before you subscribe.
If you are not satisfied with our answer, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
4. Cross-border movement and lifecycle
The Code requires cross-border conditions to be knowable before transfer, and notice changes to be logged over time.
- Hosting: tcieg.org and Insights are both hosted by Hetzner Online GmbH in Helsinki, Finland, for privacy and data control. Cloudflare provides DNS only and does not carry site traffic. Contact email is handled by Proton AG (Switzerland).
- Transparency badge: the 0PN Transparency Signal badge in the site footer is an image loaded from ca1.0pn.org, the Canada node of the 0PN Registry, operated by Global Privacy Rights in Montreal. Loading it sends your IP address and browser details to that server, as any image request does; the server keeps standard access logs for 14 days. The badge sets no cookies and runs no script.
- Transfers: hosting in Finland needs no further safeguard, because the United Kingdom recognises the EU and EEA as adequate. The newsletter is the exception. Mailgun Technologies, Inc., a US company, sends it from its EU region, and as a US company it can be required under US law to disclose data it holds, including your email address, to US authorities. That access is not governed by UK data protection law. It relies on your explicit consent, given at the notice shown before you subscribe, and you are shown a receipt number for that notice. We have raised this with Ghost as a sovereign security issue and are assessing alternative newsletter software.
- AI reuse: Insights content is licensed under CC BY 4.0. Machine reuse is additionally subject to the 0PN Machine Reuse Terms 1.1, and rights for AI training are reserved under Article 4(3) of Directive (EU) 2019/790 where those terms are not met. The reservation is published at /.well-known/tdmrep.json on Insights.
- Agent receipts: an AI agent may obtain a receipt on Insights by acknowledging those terms, and the text it then fetches is stamped with the receipt, the controller identity and the terms. We record the agent name and operator it declares, the terms acknowledged, and the time. No IP address is stored. The receipt log is append-only and hash-chained, anchored by a digest published at /.well-known/transparency/ai-receipts-digest.json. Receipts are voluntary and the content stays open without one.
- Social web: if you follow Insights from a fediverse account, federation requests pass through Ghost's ActivityPub service, run by the Ghost Foundation on Google Cloud.
- Retention: server logs are short-lived; the subscriber list is kept on our server in Finland only while you are subscribed, and email is deleted on request.
- Changes: material changes to this policy are dated and recorded in the Notice Event Log, with a hash of each version, so a change cannot be made silently.
Last updated 1 October 2026: the AI reuse terms for Insights move to version 1.1, which corrects the publisher's name and changes no condition. Questions: info@tcieg.org.