Privacy Policy

Sustain AI Index is a business-to-business platform for assessing AI-system trust, responsible AI, regulatory readiness, security, and sustainability criteria and, where authorised, publishing ratings in a public registry.

The controller for the activities described in this policy is Min Sone AS, organisation number 930 830 747, at Stasjonsveien 69, 0768 Oslo, Norway. This policy covers the public website, application portals, direct account administration, communications, and the public registry.

Privacy questions and rights requests can be sent to hello@sustainaiindex.com. Full company details are in the Legal Notice.

We act as a controller when we decide why and how personal data is processed. This includes our website, direct account administration, security, legal compliance, service communications, and registry processing for which we determine the purposes and means.

We act as a processor when a customer controls the personal data in assessment evidence and instructs us to process it. In that case, the customer’s privacy notice and our Data Processing Addendum govern that processing. Rights requests about customer-controlled data will normally be referred to the relevant customer.

• Account data: name, work email, organisation, role, and account identifiers.
• Authentication data: password hashes, multi-factor authentication metadata, session data, and identity attributes returned by a sign-in provider you choose.
• Assessment data: answers, evidence, scores, review records, methodology version, and submission or approval metadata.
• Communications: invitations, support requests, enquiries, and related contact history.
• Technical and security data: IP address, device and request data, security events, and error or reliability records.
• Cookie and device data: session identifiers, consent choices, and other browser storage described in the Cookie Policy.
• Registry data: the organisation and AI system, rating, status, date, scope, and methodology version for an authorised publication.

The service is not intended to collect special-category data, children’s data, passwords, access tokens, payment-card data, or other unnecessary sensitive information in assessment evidence. Customers must minimise personal data in anything they upload.

• Providing the service and administering accounts where processing is necessary for a contract or steps requested before a contract (GDPR Article 6(1)(b)).
• Security, reliability, support, abuse prevention, and audit integrity where necessary for our legitimate interests or those of our customers and users (Article 6(1)(f)).
• Meeting legal, accounting, regulatory, or disclosure duties where processing is necessary for a legal obligation (Article 6(1)(c)).
• Optional communications or non-essential technologies where you have given consent (Article 6(1)(a)). You can withdraw consent at any time.
• Publishing an authorised rating on the customer’s publication instruction and the applicable controller legal basis, while minimising personal data.

Where third-party sign-in is available, you may choose an external identity provider. That provider acts as an independent controller for its own authentication processing under its privacy notice. We receive only the identity attributes made available through the selected sign-in flow and use them for authentication and account administration.

A customer may authorise us to publish a rating. Public fields are limited to the organisation and AI system, rating information, status, assessment date, scope, and methodology version. Uploaded evidence, source documents, security-sensitive material, trade secrets, and unnecessary personal data are not published.

Individual names are not intended for publication unless there is a documented lawful basis and clear purpose. A rating is a point-in-time record. If it is withdrawn or superseded, a limited historical record may remain where necessary to preserve registry integrity, subject to privacy law and data minimisation.

Access within the service is role-based. A customer can access its own data, an authorised auditor can access the assessment assigned to them, and authorised service personnel can access data where necessary to operate, secure, support, or administer the service.

We use vetted service providers for functions such as hosting, storage, authentication, transactional communications, security, and reliability monitoring. They process data under written terms and may use it only to provide the contracted service. We may also disclose data where required by law, to protect legal rights or service security, or in connection with a corporate transaction subject to appropriate safeguards.

We do not sell personal data, share it for third-party advertising, or use customer personal data or evidence to train or fine-tune general-purpose or third-party AI models unless separately agreed in writing and supported by a lawful basis.

We aim to keep primary hosting in the EEA where configured. Some service providers may process data outside the EEA. Any such transfer must use a lawful mechanism under GDPR Chapter V, such as an applicable adequacy decision or the European Commission’s Standard Contractual Clauses, together with a transfer assessment and supplementary measures where required.

We retain personal data only for as long as necessary for the purpose for which it was collected, unless law or an agreement requires or permits a longer period. Our normal limits are:

• account data for the active account and up to 90 days after closure;
• support and enquiry records for up to 24 months;
• assessment evidence for the contract term and up to 90 days after it ends, unless a different period is agreed;
• audit and rating records for up to seven years where reasonably necessary for assurance, claims, auditability, or legal duties, with periodic necessity review; and
• registry data for the rating’s validity period and the minimum historical period needed to preserve rating integrity, with personal data minimised.

Backup copies follow controlled retention and deletion cycles and remain protected while retained.

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. These rights can be limited where an exemption applies or where data must be retained for legal claims, audit integrity, or another lawful reason.

Send a request to hello@sustainaiindex.com. You also have the right to lodge a complaint with a competent data protection supervisory authority. In Norway, the supervisory authority is Datatilsynet, the Norwegian Data Protection Authority.

We use technical and organisational measures proportionate to risk, including access controls, multi-factor authentication for privileged access, encryption, tenant separation, monitoring, rate limiting, backup and restoration processes, vulnerability management, and incident response. No service can guarantee absolute security.

Strictly necessary technologies support requested functions such as secure sign-in and session management. We ask for consent before any non-essential storage or access on your device. The Cookie Policy lists the active categories, purposes, and retention periods and explains how to change your choice.

The service is intended for business users and is not directed to children. We do not intentionally seek to collect children’s personal data.

AI or automation may support extraction, classification, consistency checks, scoring recommendations, or report generation. The public rating service is not intended to make decisions about natural persons based solely on automated processing. Any future product involving profiling or decisions about individuals will require a separate legal assessment before launch.

We may update this policy when our processing, services, or legal obligations change. The date at the top shows the current version, and we will communicate material changes where required.