Privacy Policy

01Who we are

This website is run by ThinkTanks Collective. In this policy, “we”, “us” and “our” mean ThinkTanks Collective. We are the controller of the personal information described here, which means we decide how it is used and we are responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

For anything about your information, write to hello@thinktanks.co. There is also a request form further down this page.

02What we collect, and why

We only collect what you give us, plus a little technical information needed to keep the site working and safe. We don’t use advertising or analytics trackers, and we don’t sell or rent your information to anyone.

When	What we collect	Why	Our legal basis
You send a message through the contact form	Your name, email address, organisation (if you give one), what you would like to do, the project you are asking about, your message and the page you sent it from.	To read and answer your message, and to follow up on the work or collaboration you asked about. We also email you a copy of your message.	Our legitimate interest in answering people who contact us; and, where you are asking about working with us, taking steps at your request before a contract.
You talk to the website assistant (“Ask Think Tanks”)	What you type, the assistant’s replies, the page you were on, and anything you choose to share, such as your name, email address, organisation or what you need. If you leave a question for the team, we keep that too.	To answer your questions, and so the team can read the conversation and reply to anything the assistant couldn’t answer.	Our legitimate interest in answering questions about our work.
You ask to be kept posted (the newsletter box, or the tick box on the contact form)	Your email address and, if you give it, your name, and where you signed up.	To send you occasional emails about new projects.	Your consent. You can withdraw it at any time with the unsubscribe link in every email.
You make a privacy request	Your name, email address, what you are asking for and any details you give.	To deal with your request and keep a record that we did.	Our legal obligation to respond to data protection requests.
You use any form, or sign in	A scrambled (hashed) version of your connection’s IP address, never the address itself, and the result of a quick “are you human” check by Cloudflare Turnstile.	To stop spam and abuse: for example, to limit how many messages one connection can send in an hour.	Our legitimate interest in keeping the website secure and usable.
You visit project pages or follow a demo link	Nothing personal. We count page views and clicks per project, per day, with no cookies and no IP addresses.	To see which projects people are interested in.	Not personal information.

You don’t have to give us any of this, but we can’t reply to a message without an email address. Please don’t send us sensitive information (about health, for example) through the website unless we have asked for it.

03The website assistant

The assistant is an AI, not a person, and it says so. To write its replies, the conversation is sent to OpenAI, which processes it for us under its business terms. It answers only from what is published on this website and from facts we give it.

The conversation is also saved on our website and passed to our team so we can follow up, so please don’t type anything you wouldn’t put in an email to us. Your browser remembers the conversation for 7 days so it carries on across pages; “Start a new conversation” in the assistant clears it.

Messages, assistant conversations, sign-ups and privacy requests sent through this website go to our own workspace at members.thinktanks.co, where our team handles them. A small number of service providers handle information for us, only on our instructions:

Our website host, which stores this website and its data.
Mailtrap, which delivers the emails this website and our workspace send (replies, copies of your message and, if you asked for them, updates).
OpenAI, which writes the assistant’s replies.
Cloudflare, which runs the Turnstile “are you human” check on our forms and serves some of the icons this website uses. Your browser connects to Cloudflare to load them, so Cloudflare sees your IP address.

If you go on to work with us, the people working on your project (members of the collective) will see what they need to. We may also share information if the law requires it, or to protect our rights or someone’s safety.

05Information sent outside the UK

Some of our service providers, including the AI provider, Mailtrap and Cloudflare, may process information outside the UK, for example in the United States or the European Economic Area. When that happens we make sure it is protected as UK law requires: by the UK’s adequacy regulations (including the UK–US data bridge) or by approved contract terms such as the International Data Transfer Agreement or Addendum.

06How long we keep it

Information	How long
Messages from the contact form	Up to 2 years after our last contact with you, unless we go on to work together (then as long as that relationship lasts, plus 6 years for our business records).
Assistant conversations	Up to 2 years after the conversation, unless it leads to an enquiry or work together (then as for enquiries).
Newsletter sign-ups	Until you unsubscribe. After that we keep only your address on a suppression list, so we never email you again by mistake.
Privacy requests	Up to 2 years after we have dealt with your request, as a record that we did.
Emails the website sends	Copies of the emails the website sends are kept as a record for up to 2 years.
Security identifiers	Scrambled (hashed) connection identifiers are kept for minutes to a few days, only to stop abuse.

You can ask us to delete your information sooner (see below).

07Your rights

Under UK data protection law you can ask us to:

give you a copy of the information we hold about you;
correct anything that is wrong or incomplete;
delete your information;
limit how we use it, or stop using it, including for any reason based on our legitimate interests;
give you your information in a form you can take elsewhere;
stop sending you updates (or use the unsubscribe link in any of them).

Use the form below, or write to hello@thinktanks.co. It’s free. We will reply within one month, and may ask you to confirm who you are first. Some rights have limits (we may need to keep some records by law, for example); if so, we will tell you why.

Make a privacy request

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

08Other things to know

Cookies. This website uses no tracking or advertising cookies. The Cookie Policy lists what it does store in your browser.

Demos. The project demos at demo.thinktanks.co run on sample data. Anything you enter there stays in your own copy of the demo, is kept apart from our real records, is cleared regularly, and is never used to contact you.

Members and clients. This policy covers the website. If you become a member of the collective or a client and sign in at members.thinktanks.co, we will tell you how we use the further information you give us there.

Other websites. Links to other websites (our social media pages, for example) are covered by those websites’ own policies.

Children. This website is meant for adults and organisations. We don’t knowingly collect information from children.

Security. The website uses HTTPS, our systems are protected by access controls, passwords are stored only in scrambled (hashed) form, and keys to other services are stored encrypted. No system is perfectly secure, but we take care and will tell you and the regulator if a breach puts you at risk.

Changes. If we change this policy we will update the date at the top. If a change matters to you, we will tell you.