Privacy — irabu.org

Last updated 3 August 2026.

The short version

We collect the nine fields on the application form and nothing else. We do not use analytics or tracking cookies on this site. We never collect data about the people you serve or about anyone under 18. Nothing goes in the public directory without your written agreement to the exact wording. We do not sell or share anything with advertisers.

Who is responsible

irabu.org is an access programme operated by Irabu. The separate legal entity for the nonprofit arm is in formation, so today Irabu is the controller of any personal data described here. When the entity is registered, this page will name it and say what transferred.

Data protection contact: privacy@irabu.org.

What we collect

When you apply

Nine fields, all about you in your professional capacity:

Your group’s name, type and country
A link showing the group exists
An estimate of how many people would use the platform
Your name, your role and an email address
Optionally, a short note about what you would use the platform for
Optionally, whether you would consider a public directory listing

Lawful basis: legitimate interests — we cannot assess an application without knowing who is applying. Where local law requires consent instead, submitting the form is that consent.

When you register as a sponsor

Your email address, whether you would sponsor as an organisation or an individual, the organisation name if applicable, and optionally a rough number of places. Used once, to tell you when sponsorship opens. That is consent-based and you can ask us to delete it at any time by replying or emailing the address above.

No payment details, because no payment is taken. There is no card form anywhere on this domain.

What the public directory publishes

If — and only if — your group agrees in writing, a listing shows your group’s name, type, country or region, a description of your work in your own words, what the tools would let you do, your team size and the annual cost to cover you.

You see the exact text before it is published, and nothing goes up until you approve it.
No individuals are named in a listing, and no photographs of people appear anywhere on this site.
Nothing about the people you serve is ever published.
You can be removed at any time by asking, with no effect on access you already have. We remove the listing; search engines may take longer to drop their cached copy, which is outside our control.

Lawful basis: consent, recorded with the date and the role of the person who gave it. A listing without recorded consent cannot be published — that is enforced in the code, not just in this policy.

What we never collect

Data about the people your group serves. Not on the form, not during the programme, not in a listing. If you send it to us by mistake, we delete it and tell you we have.
Data about anyone under 18.This site and this programme are for the staff, members and volunteers of organisations. If processing children’s data ever became necessary, it would need proper legal groundwork under FERPA, COPPA and UK/EU GDPR first — it is not a setting we would quietly switch on.
Demographic data about anyone. It would not change our decision, so we do not ask.
Special category data — health, religion, ethnicity, political opinion, sexual orientation, biometrics.
Payment details. When sponsorship opens, card handling will sit entirely with a hosted provider such as Stripe. Card data will never touch our servers.

Cookies and analytics

This site sets no analytics cookies, no advertising cookies and no third-party trackers. There is no cookie banner because there is nothing to consent to. If that ever changes we will ask first, and the default will be off.

Our host, Vercel, keeps standard server logs — IP address, user agent, requested URL — for operational and security purposes. We do not use those logs to build a profile of you.

Fonts and third-party requests

Typefaces are served from this domain, not from a font CDN, so loading a page does not tell anyone else that you visited.

Who sees your data

The people assessing your application, and our hosting and email providers acting on our instructions. We do not sell personal data, we do not share it with advertisers, and we do not pass applicant details to the commercial sales side of the business.

Sponsors do not receive your details. A sponsor is told which group they covered and that the workspace is running. They do not get your contact details, they never see inside your workspace, and they are given no information about the people you serve.

Data may be processed outside your country by those providers. Where that involves a transfer out of the UK or EEA, it relies on standard contractual clauses or an adequacy decision.

How long we keep it

Successful applications: for as long as the organisation is on the programme, plus two years, so we can answer questions about a decision.
Declined applications: two years, so that if you reapply we can see what we said last time and why.
Sponsor registrations: until we send the one message, or until you ask us to delete it — whichever is sooner.
Directory listings: removed from the site as soon as you ask. We keep the record of your consent for two years afterwards, because that is the evidence we were allowed to publish it in the first place.

Your rights

Depending on where you live, you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to it. You can also complain to your national data protection regulator.

Email privacy@irabu.org. We do not charge, and we do not require a particular form of words.

Security

Everything is served over TLS. Access to application data is limited to the people who need it. We have not completed a SOC 2 audit — that is true of the platform and of this programme, and we will not say otherwise until it is done.

The platform is separate

Once your organisation is on the programme, what happens inside your workspace is governed by the platform’s own privacy policy and terms at https://irabu.ai/privacy. In that relationship your organisation is the controller of its own content and we are the processor.

Changes

If we change this policy in a way that affects you, we will date the change at the top and, where it is material, email applicants and recipients directly rather than relying on you to re-read the page.

Related: Terms · Transparency · Contact