Privacy Policy

OpenMined (“we,” “our,” or “us”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, and safeguard your information across our website, communications, and community platforms.

1. Who We Are

OpenMined is a globally distributed nonprofit organization. We maintain a digital presence through our website and community tools, including Slack and email communications. Our primary operations are based in the United States and the United Kingdom.

The data controller responsible for your personal information under this policy is:

OpenMined Foundation, a 501(c)(3) nonprofit
154 W 14th Street
New York, NY 10011
United States

2. What This Policy Covers

This policy covers openmined.org, the email we send you, and our community Slack workspace.

3. Information We Collect

We may collect the following categories of personal data:

• Contact information: Name, email address, affiliation, or other information you provide via forms or email communications.
• Community data: Slack username, participation details, and other interaction metadata when joining our community platforms.
• Technical data: IP address, browser type, pages visited, and the page or site you arrived from. Our analytics provider uses these to produce an anonymous, aggregate count and does not retain them in a form that identifies you — see section 7.
• Communication preferences: Your opt-in status, including records of email engagement and unsubscribe actions.
• Application data: The CV, contact details, and answers you submit when applying for a role — see section 11.
• Donation data: Your name, email address, and donation amount. We never receive or store your card details — see section 10.

4. How We Collect Information

We collect information through:

• Forms on our website, which are hosted and processed by HubSpot
• Slack workspace registration
• Newsletter sign-ups and event registration
• Email communications, through HubSpot and Google Workspace
• Our analytics provider, Plausible, which counts visits without identifying visitors
• Job applications submitted through Workable
• Donations processed by Stripe
• Contributor license agreements with companies and individuals contributing to our open-source and other published projects

5. How We Use Your Information

We use your data to:

• Send updates, newsletters, and community-related announcements
• Manage your participation in our programs and events
• Understand which pages and campaigns bring people to the site, in aggregate
• Understand how people find our community: when you submit a form, we record the link or page that brought you to it, and if you join our Slack, we connect your Slack account to that submission
• Learn which organisations our community comes from, using publicly available information about the organisation behind the email address you give us
• Process donations and issue receipts
• Consider your application for a role
• Monitor community engagement and opt-in preferences
• Comply with applicable laws and protect our community

Where GDPR or UK GDPR applies, we rely on your consent for marketing email, on legitimate interests for aggregate website measurement, for understanding how people find our community and the organisations they come from, and for protecting the security of our site, on the performance of a contract for processing a donation or an application you have submitted, and on legal obligation where a law requires us to retain or disclose information.

6. Cookies and Device Storage

Our website does not set any cookies of its own, and we do not use a cookie banner. There is nothing non-essential stored on your device to consent to.

The only thing our website stores on your device is a record of your light or dark display preference, saved when you use the theme switch so the site can honour your choice on your next visit. It contains no identifier and is never sent to us.

Two third parties may set or request data through pages you visit:

• HubSpot, which hosts our forms, sets a short-lived bot-protection cookie (__cf_bm, about 30 minutes) on its own domains when a page containing a form loads its form software. This is a security measure necessary to deliver the form.
• YouTube, on the small number of blog posts that embed a video. We use YouTube’s privacy-enhanced domain, which sets no cookies unless you choose to play the video. Opening one of those posts does contact Google’s servers to load the player, which means Google receives your IP address; if you then play the video, YouTube may also set cookies, under Google’s privacy policy rather than ours.

You can manage cookies in your browser settings.

7. Analytics

We use Plausible Analytics, an EU-based, EU-hosted analytics service, as our only website measurement tool. We do not use Google Analytics.

Plausible stores nothing on your device. It counts a visit by generating a one-way hash from your IP address, browser type, and our domain name, combined with a secret that is destroyed every 24 hours — so the same visitor cannot be recognised across days and no profile of you is ever built. We see aggregate counts of pages, referrers, and countries; we cannot see individuals.

We rely on our legitimate interest in understanding how our website is used (Article 6(1)(f) GDPR), and we have documented our assessment that this processing has a minimal effect on your privacy. You may object to it by contacting us at privacy@openmined.org, or by using your browser’s or an extension’s blocking tools.

8. Email Communications

Every marketing email we send includes a visible unsubscribe link, as required by law and supported by our email platform, HubSpot.

You may also ask to be removed from our communications by contacting privacy@openmined.org.

9. Slack and Community Platforms

By accepting an invite to our Slack workspace or participating in related programs, you acknowledge and consent to receive communication related to your involvement. Slack participation is considered an opt-in to community updates unless you indicate otherwise.

When you join through our website, we connect your Slack account to the invite form you submitted (by matching the email address), together with the link or page that brought you to it. We use this to understand which channels help people find our community. Nothing is stored on your device to do this.

Slack is operated by Slack Technologies, LLC, a Salesforce company, and your use of it is also subject to Slack’s own privacy policy.

10. Donations and Payments

Donations are processed by Stripe. When you donate, you are taken to a payment page hosted by Stripe, where you enter your card details directly.

Your card details never reach our website or our servers. We do not load Stripe’s scripts on our own pages, so no Stripe cookie is set while you are browsing openmined.org. We receive from Stripe only what we need to acknowledge and account for your gift: your name, email address, the amount, and the currency.

Stripe processes your payment information as its own controller, under Stripe’s privacy policy.

11. Job Applications

Open roles on our careers page are listed, and applications are received, through Workable, our recruitment platform. When you view our careers page, your browser requests the current list of roles from Workable; when you apply, you do so on Workable’s site, and the information you submit — including your CV and any answers you provide — is processed there on our behalf.

We use that information to assess your application, and we retain it only as long as needed for the recruitment process and any follow-up we have told you about.

12. Data Sharing and Service Providers

We do not sell or rent your personal information.

We share data with the following service providers, who process it on our behalf and only on our instructions:

• Amazon Web Services — website hosting and content delivery
• HubSpot — forms, email, and contact management
• Google Workspace — our email
• Plausible Analytics — aggregate website measurement
• Workable — recruitment

Two services we use also handle your data for their own purposes, as independent controllers under their own privacy policies:

• Stripe — payment processing and fraud prevention, as described in section 10
• Slack — operating the workspace itself, as described in section 9

We may also share data with legal or regulatory authorities where required by law, and with team members and contractors under confidentiality obligations, strictly for operations.

We do not publish contributor license agreements, but may share them privately with third parties to demonstrate that we have secured intellectual property rights in contributions to our projects.

13. Data Security

We use reasonable administrative, technical, and physical safeguards to protect your information. Our website is hosted on Amazon Web Services and served over HTTPS; our contact and email data is held in HubSpot and Google Workspace, with access restricted to authorized personnel.

No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

14. International Data Transfers

Because we operate globally, your information may be processed outside your country of residence, including in the United States and the United Kingdom.

If you are located in the European Economic Area (EEA) or the United Kingdom, we comply with GDPR and UK GDPR, and we rely on appropriate safeguards for transfers — including the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses with our service providers.

15. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access or request a copy of your personal data
• Request correction or deletion of your data
• Withdraw consent or object to processing, including our analytics
• Request that we restrict use of your information
• Request that we transfer your data to another provider
• Lodge a complaint with your local data protection authority

To exercise your rights, email privacy@openmined.org. We will respond within 30 days, as required by law.

16. Retention of Data

We retain your data only as long as necessary to fulfill the purposes described in this policy, unless a longer period is required by law. Our analytics data is aggregate and contains nothing that identifies you.

17. Children’s Privacy

Our website and community are not intended for children under the age of 16. We do not knowingly collect data from children. If you believe a child has submitted personal information to us, please contact us immediately.

18. Changes to This Policy

We may update this Privacy Policy occasionally. When we do, we’ll update the “Last Updated” date at the top. Significant changes will be communicated via our website or email.

19. Contact Us

If you have any questions or concerns about this Privacy Policy, or how we use your data, please contact:

OpenMined Privacy Team
📧 privacy@openmined.org