Privacy Policy

Last updated: 2026-09-28

1. Scope

This Privacy Policy describes what personal information The AI Oversight Study (the “Study”) collects through oversight.study and the survey it hosts, how we use it, how long we keep it, and your rights in respect of it. It applies only to the Study. U22A8’s products have separate policies, and those policies do not cover the Study’s information.

2. Who is responsible

The Study is run by U22A8 Inc., a corporation incorporated under the laws of Canada (“we”, “us”), which is the controller of the personal information described here. We have designated a Privacy Officer for the purposes of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), reachable at .

3. What we collect

Survey answers: your answers, including the role, industry and organization-size categories you select and anything you write in optional free-text questions.
Your email address, only if you enter it, so that we can send what you ask for at the end of the survey.
Group: if you arrive through an organization’s invitation link, the link’s token, recorded with your answers. The token identifies the invitation, not you.
Referral: when a link to the study names where it was placed, such as a page on u22a8.ai, that name, recorded with your answers.
Invitation links: when an organization asks us for a link, the email address of the person who asked (and their name, if they give it), their organization, and the token we issue. A request made in the survey is kept with that person’s answers.
Technical data: our hosting provider processes request data such as IP address and browser type to deliver the site and protect it from abuse. We do not keep access logs of our own, and the site uses no analytics.

4. How we use it

To conduct the Study and publish its results.
To send what you ask for: the findings before they are published, an invitation link for your organization, or a reply to a request for a conversation.
To count the answers given through an invitation link together, and to send the person who asked for the link an analysis of how that group compares with the combined results, once enough answers have arrived.
To operate and secure the site.

Responses leave us only in aggregated or de-identified form: in the Study’s results, and in the comparisons described above. We compare only against groups large enough that no one in them can be identified. We do not use the Study’s information for sales or marketing, and we do not combine it with information from U22A8’s products or customers.

5. Legal basis (applicable in the EEA and UK)

Where the GDPR or UK GDPR applies, we rely on (a) your consent for your answers and any email address you give us, which you may withdraw as described in §10; and (b) our legitimate interests in counting answers with the organization that invited you, and in operating and securing the site.

We do not sell personal information. We share it only with service providers that process it on our behalf, and in response to valid legal process. Our service providers are:

Tally (Belgium): hosts the survey and stores the answers in the European Union.
Cloudflare (United States, operating globally): hosts and delivers this site.
Proton (Switzerland): handles email to and from .

No collaborator, co-author or client of ours receives a response in identifiable form.

7. Retention

Survey answers, and the group recorded with them: until December 31, 2028, 24 months after the survey closes. The Study’s combined results are kept.
Email addresses given in the survey: until we have sent what you asked for, and no later than December 31, 2028.
Invitation link records: until December 31, 2028, and deleted sooner on request. Deleting a record leaves the answers already given through the link in the combined results, with nothing left to connect them to the organization.

8. Cookies

This site sets one cookie, and only if you arrive through an invitation link: study_group, which holds the link’s token so that answers you give later count with the same group, even if you come back without the link. It lasts 90 days from the last time you opened the link. It is set by this site alone, cannot be read by scripts, and is not used for tracking or advertising. You can remove it at any time by visiting oversight.study/forget, or in your browser’s settings.

The survey form runs inside this page from Tally’s own address, tally.so. While you answer, Tally keeps your answers so far and a random respondent identifier in your browser’s storage for that address, so the form keeps your place. You can clear them in your browser’s settings.

9. International transfers

We are in Canada, Tally stores the answers in the European Union, Proton is in Switzerland, and Cloudflare operates globally. Our providers also use service providers of their own, some in the United States. Personal information may therefore be processed in Canada, the European Economic Area, Switzerland, the United States or other countries where these providers operate. Where the GDPR or UK GDPR applies, transfers rely on adequacy decisions (which cover Canada and Switzerland), the EU–U.S. Data Privacy Framework where the recipient is certified under it, or standard contractual clauses.

10. Your rights

Subject to applicable law, you may ask to access, correct or delete personal information about you, to restrict or object to its processing, or to receive your answers in a portable form, and you may withdraw your consent at any time. Withdrawing removes your answers from what we hold; it does not change results already published. You may also lodge a complaint with a supervisory authority, and Canadian residents with the Office of the Privacy Commissioner of Canada. To exercise these rights, write to .

Answers are stored without your name. If you did not give an email address, tell us enough for us to find your answers, such as the group you answered with and roughly when.

11. Children

The Study is for people answering about their work. It is not directed at children, and we do not knowingly collect personal information from anyone under the minimum age of digital consent in their jurisdiction.

12. Changes

We may update this Policy. The “Last updated” date changes with every update, and a material change is shown prominently on the site.

13. Contact

U22A8 Inc., Privacy Officer: .