Privacy Policy

1. Information we collect

We collect two kinds of information: information you give us directly, and information collected automatically when you use the site.

Information you provide directly. If you submit our compliance assessment, send us feedback, or contact us, we receive whatever you choose to share — for example your email address, your business's state and industry, the AI use cases you've selected, and any written comments. You control what you submit.

Information collected automatically. Like almost every website, our servers and third-party services automatically log technical details such as your IP address, browser type and version, device and operating system, referring URL, pages visited, timestamps, and approximate location (city or country) derived from your IP.

2. Cookies and similar technologies

We use cookies and similar technologies (like local storage) for three purposes:

• Strictly necessary: to remember your preferences and progress through the compliance assessment.
• Analytics: to understand which pages are useful and which aren't, so we can improve the site.
• Advertising: to serve ads through third-party networks and, where applicable, personalize them.

Consent. Analytics and advertising are non-essential, and we do not load them before you have decided. In the EU/EEA, the UK and Switzerland — and wherever we cannot determine your location — you are asked first, and until you accept the third-party scripts are not fetched at all. Declining does not mute a loaded tag; it means the tag is never added to the page. Elsewhere those tags load without a banner and “Cookie settings” in the footer of every page turns them off. We use Google Consent Mode v2 with all advertising and analytics storage set to denied by default. Your choice is stored in one small first-party cookie holding a version, two on/off flags and a timestamp — no identifier.

You can also block or delete cookies in your browser settings at any time. Blocking strictly necessary cookies may cause parts of the site (like the self-assessment) to stop working.

3. Advertising (Google AdSense disclosure)

AI Law Tracker uses Google AdSense, a third-party advertising service provided by Google LLC, to display ads on some pages. As part of serving those ads:

• Google, as a third-party vendor, uses cookies — including the DoubleClick DART cookie — to serve ads based on your prior visits to this site and other sites on the internet.
• Google and its partners may use information (not including your name, email, or other directly identifying information) about your visits to provide advertisements.
• Third-party advertising networks may also be used to serve ads and may place their own cookies in your browser.

You can opt out of personalized advertising by visiting Google's Ads Settings at google.com/settings/ads or the aboutads.info consumer choice page at aboutads.info/choices.

Google's use of advertising cookies is governed by Google's own privacy policy, available at policies.google.com/technologies/ads.

4. Analytics

We use Google Analytics 4 to measure aggregate traffic patterns — which pages are popular, what search terms brought visitors, how long people stay. GA4 is loaded on production pages only. Data it collects is processed by Google under its own terms. We do not sell analytics data.

GA4 is consent-gated exactly as described in Section 2: where prior consent is required, the Google Analytics script is not requested until you accept, and declining means it is never added to the page. You can check that yourself — decline, reload, and watch the network tab for any request to googletagmanager.com. The full description is in our data & AI practices.

5. How we use information

• To operate the site and deliver content you request (for example, generating your compliance report).
• To improve the site — identify what's working, fix bugs, and prioritize new content.
• To respond to emails, corrections, and support requests.
• To serve and measure advertising, as described above.
• To comply with legal obligations and enforce our terms.

6. Third-party services we use

We rely on several third parties to run the site. Each processes data under its own privacy policy:

• Vercel — site hosting and server request logs.
• Supabase — the database behind comments, votes, API keys, usage counters, and the newsletter list. This is where anything you submit is actually stored.
• Google AdSense — advertising (see Section 3).
• Google Analytics 4 — aggregate traffic measurement (see Section 4).
• Resend — outbound email: API-key delivery, report delivery, and direct correspondence we send you.
• Polar — payments and subscription billing for paid API plans. Card details go to Polar and its payment processors; we never see or store them.

We also use third-party services that touch public source material only, never your data — for example web-fetching infrastructure used to collect government pages, and language-model providers used to draft summaries from those public pages. Visitor data is not sent to them.

7. How we share information

We do not sell your personal information. We share information only with the service providers listed above, where required by law (subpoenas, court orders, valid legal requests), or to protect our rights and the safety of users. If AI Law Tracker is ever acquired or merged, data may transfer to the successor entity under the same privacy commitments.

8. Data retention

We keep assessment submissions, feedback, and similar records only as long as they're useful for the purpose they were submitted or as required by law. Server logs are typically rotated within 90 days. You can request deletion at any time using the contact details below.

9. Your rights (GDPR, CCPA, and similar laws)

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your personal information (the "right to be forgotten").
• Object to or restrict certain processing, including direct marketing and personalized advertising.
• Port your data to another service in a machine-readable format.
• Opt out of the "sale" or "sharing" of personal information (California). We do not sell personal information, but advertising cookies may qualify as "sharing" under CCPA — you can disable them in your browser or via the ad-settings links above.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@ai-law-tracker.com. We'll respond within 30 days.

10. Children's privacy

AI Law Tracker is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has submitted personal information to us, please contact us and we will delete it.

11. Security

We use reasonable technical and organizational measures to protect information, including TLS encryption in transit and access controls on our databases. No method of transmission or storage is 100% secure; we can't guarantee absolute security.

12. International transfers

Our service providers may process data in the United States and other countries. Where data is transferred from the EU/UK, we rely on Standard Contractual Clauses and other lawful transfer mechanisms offered by our providers.

13. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. When we make material changes, we'll update the "Last updated" date at the top of this page and, where appropriate, post a notice on the site. Continued use of the site after an update means you accept the revised policy.

14. Community comments, voting, and user-generated content

Some pages let you post comments and vote. When you post a comment we collect the comment text, the display name you choose, and your email address. Your display name and comment are public; your email address is never published and is not shown to other visitors.

We store your email privately and may use it to prevent spam and abuse, to follow up on your comment, and to send you occasional updates about the site. You can opt out of those updates at any time by emailing support@ai-law-tracker.com. To reduce spam and abuse we also store a one-way, non-reversible (hashed) form of your IP address; we do not store your IP address in plaintext.

Comments reflect the opinions of the people who write them, are not legal advice, and are published automatically without individual review. We may remove or hide comments that are reported by the community or that violate our terms. You can report a comment using the "Report" link beside it, or ask us to remove a comment or your email by contacting support@ai-law-tracker.com.

15. AI assistant connectors (MCP)

We publish a read-only connector at ai-law-tracker.com/mcp-directory so AI assistants can look up AI-regulation records on your behalf. This endpoint is informational only.

It collects no personal data. It requires no account, no sign-in, and no API key. It exposes only search and lookup tools over our published legal dataset — there is no tool on this endpoint that accepts an email address, creates an account, takes a payment, or writes any data. The search terms passed to it are used solely to answer that request. As with any page on the site, our host (Vercel) records standard technical request logs as described in Section 1, and those are rotated as described in Section 8.

We separately operate a full-featured connector at ai-law-tracker.com/mcp for API customers. Where that connector is used to create an API key or start a subscription, the email address you supply is handled as described in Sections 1, 5 and 7.

16. API accounts, the newsletter, and email we send you

API keys. Requesting an API key stores the email address you give us, a label, the key's tier, and a hashed form of the key itself alongside per-key request counters. We keep these for as long as the key exists so we can enforce rate limits and contact you about the key. Ask us and we will revoke the key and delete the record.

Newsletter. If and when the weekly email list is switched on, signing up stores your address, the exact consent wording you agreed to, when you agreed, the page you signed up from, and a hashed IP. We keep the consent record because that is the evidence that you opted in. Unsubscribing marks the row unsubscribed rather than deleting the consent history; ask us and we delete it outright.

Email we send to businesses. We run a small, manual business-to-business outreach programme: we contact companies at published work addresses about the AI-law API. We store the address, company, send and reply history, and a suppression flag. Reply asking us to stop, or use the opt-out line in the email, and the address goes on a permanent suppression list — which means we keep the address for the sole purpose of never contacting it again.

17. Contact

Questions, requests, or complaints about this policy or your data can be sent to support@ai-law-tracker.com. For anything else, see our contact page.