Privacy policy

AI for Global Goals Ltd, a company registered in England and Wales (number 12035444), registered office 27 Old Gloucester Street, London WC1N 3AX, is the controller of the personal data described here. OxML is one of our programmes. You can reach us about anything in this policy at contact@globalgoals.ai or contact@oxfordml.school.

• Contact form: your name, email address, company, job title, phone number (if you give it) and your message.
• Newsletter: your email address.
• Enterprise pack download: your name, email address and company.
• Consent records: what you agreed to and when, with your IP address and browser type, so we can show we had your permission.
• Site analytics: the pages you visit, what you click, your browser and device type, and an approximate location from your IP address, collected with PostHog and Vercel Analytics without cookies.

When you register

• Your name, email address, country of residence, organisation type, affiliation, current position and highest degree. Your gender and LinkedIn profile, if you choose to give them.
• Your CV, which you upload as a PDF.
• Whether you need a visa invitation letter for an in-person ticket.
• How you heard about us, and how you reached the site: the campaign tags in the link you followed, the site that referred you, the page you landed on and when you first visited.
• For student tickets, your referee’s name and email address. We email your referee, with your name and email address, to confirm you are a student.
• Your billing address and payment details. Stripe processes your payment; we never see your full card number.
• Earlier registrations may include notes you added, such as dietary or accessibility needs. We used these only to make arrangements for you.

In the attendee app

• How you sign in: an emailed code or link, or Google sign-in.
• What you add to your profile: display name, photo, bio, interests, goals, industry, a fun fact and your LinkedIn profile.
• Whether you appear in the attendee directory. This is off unless you turn it on, and only signed-in attendees can see the directory.
• Coffee-chat requests and messages, poster votes and feedback, and your notification settings.

At the event

• When you check in, and who checked you in. Your name, affiliation and track printed on your badge.
• Notes our team adds to your registration, for example about a payment or a visa letter.

Emails

• Whether each email we send you was delivered, bounced or marked as spam. We don’t track opens or clicks.

When you follow, comment on or message our Facebook, Instagram, LinkedIn or X accounts, we see what those platforms show us, such as your public name, username and comment.

Our Meta app (“AI4GG Socials”) publishes to our own Facebook Page and Instagram account, creates and manages our own ads, and reads the performance figures of our posts and ads. It reads the comments on our posts, which means it processes the public name, username and text of each comment, and it may hide or delete abusive comments. It sends no automated replies. It has no “Log in with Facebook”, so it never receives data from your own Facebook or Instagram account.

globalgoals.ai sets no cookies for analytics or advertising. PostHog runs in memory only, so it stores nothing on your device.

oxfordml.school sets these cookies without asking, because the site needs them: our team’s admin sign-in, and a cookie that remembers your cookie choice (1 year). The 2026 attendee app, which also set a sign-in cookie, closed on 10 November 2026.

Only if you choose “Accept” on the cookie bar, oxfordml.school also uses:

• the Meta Pixel and the LinkedIn Insight Tag, to measure and target our ads;
• PostHog analytics cookies, to recognise you across visits;
• a cookie that remembers which ad or link brought you to the site, including Meta and Google click IDs (90 days).

If you don’t accept, none of these load, and PostHog runs in memory only. These tags never load in the attendee app. You can change your choice at any time with “Cookie choices” in the site footer.

If you accepted and you register after clicking one of our ads, we tell the ad platform about the purchase so we can see which ads work. We send Meta a scrambled (SHA-256 hashed) copy of your email address, the Meta click ID and the purchase value. We send Google the Google click ID, the time and the value, with no email address. We send nothing if you didn’t accept, and nothing for refunded registrations.

• To run your registration, issue tickets and invoices, run the attendee app and the event (because it is necessary for our contract with you).
• To keep the records tax and accounting law requires, such as invoices and payments, and proof of consent (legal obligation).
• To answer enquiries, keep our sites secure, notify our team of new registrations, moderate comments, and understand how our sites and posts perform (our legitimate interests).
• To send our newsletter, measure our ads with cookies and purchase events, and list you in the attendee directory (your consent, which you can withdraw at any time).

We use these providers, each under its own data protection terms:

• Amazon Web Services stores OxML registrations and CVs and sends OxML emails, in Ireland.
• Stripe takes payments and issues invoices.
• Vercel hosts both websites and provides basic visitor statistics.
• Sanity hosts the content of oxfordml.school.
• PostHog provides analytics (in the EU for oxfordml.school, in the US for globalgoals.ai).
• Google stores globalgoals.ai form submissions in Google Sheets, provides Google sign-in and the map in the attendee app, and, with your consent, measures our Google ads.
• Resend sends globalgoals.ai emails.
• Slack carries internal notices of new registrations to our team.
• Meta runs our Facebook and Instagram accounts, our ads and our Meta app. LinkedIn runs our LinkedIn ads. Both receive data from our sites only with your consent.
• Anthropic provides the AI assistant our team uses to answer questions about registrations, draft posts and summarise how posts and ads perform.
• EasyChair handles poster submissions.

Some of these providers process data outside the UK, for example in the United States. Where they do, we rely on recognised safeguards such as the UK International Data Transfer Agreement, standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework. We never sell your personal data.

• Registration, payment and invoice records: 6 years after the end of the financial year they relate to, as UK tax law requires.
• CVs: 3 years, then deleted automatically.
• Attendee app profile: until you ask us to delete it. The 2026 app has closed, so you can no longer delete it in the app yourself.
• Ad click IDs: up to 90 days.
• globalgoals.ai form submissions and consent records: up to 7 years, or until you withdraw consent or ask us to delete them.
• Comment details we copy for moderation and reporting: up to 2 years.
• Analytics: for the period our analytics provider allows.

You can ask to see, correct, delete or move your personal data, object to or restrict how we use it, and withdraw consent at any time. Email contact@globalgoals.ai or contact@oxfordml.school and we will reply within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Email contact@globalgoals.ai or contact@oxfordml.school from the address you used with us, with the subject “Delete my data”. Tell us what you shared with us (for example, an OxML registration, the contact form or the newsletter). We will delete it within one month and confirm by email. We keep only what tax law requires, such as invoices, for as long as it requires. To stop the newsletter straight away, use the unsubscribe link in any email.

The OxML 2026 attendee app closed on 10 November 2026, so you can no longer delete your account in the app. Email us and we will delete your app profile, and your registration too if you ask.

Our Meta app has no Facebook Login, so we hold no data from your Facebook or Instagram account. If you commented on one of our posts, you can delete the comment yourself on that platform, or email us and we will delete the comment and anything we copied from it.

If we change this policy, we will update it on this page and change the date at the top.