Privacy Policy

1. Introduction

AI Socratic ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and participate in our community events.

AI Socratic events and website are operated by Flow AI XYZ, Inc.

This policy applies to all visitors and users of aisocratic.org, regardless of location. We comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

For data protection inquiries, please contact us at privacy@aisocratic.org or via our contact page.

3. Information We Collect

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data based on the following legal grounds:

• Consent – For analytics cookies, marketing emails, and newsletter subscriptions. You may withdraw consent at any time.
• Contractual necessity – To facilitate event registration and deliver services you have requested.
• Legitimate interests – To improve our website, prevent fraud, and ensure network security, where these interests are not overridden by your rights.
• Legal obligation – To comply with applicable laws and regulations.

5. How We Use Your Information

We use the information we collect to:

• Facilitate event registration and attendance
• Send you updates about events, chapters, and community news (with your consent)
• Improve our website and services
• Respond to your inquiries and provide support
• Analyze usage patterns to enhance user experience (with your consent)
• Comply with legal obligations

6. Information Sharing & Third-Party Services

We do not sell your personal information. We may share your information with the following third-party service providers who process data on our behalf:

• Vercel – Website hosting and analytics (USA)
• Google Analytics – Website traffic analysis (USA). Only active with your consent.
• Supabase – Database and authentication services (USA)
• Postmark – Transactional email delivery (USA)
• Stripe – Payment processing for workshops (USA)
• Google Fonts – Web font delivery (served via Next.js optimization, self-hosted)

We may also share information with event co-hosts and sponsors (with your consent) and legal authorities when required by law.

7. International Data Transfers

Some of our service providers are located in the United States. When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on the service provider's compliance with the EU-US Data Privacy Framework.

8. Cookies & Tracking

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Contact form messages: 2 years from submission
• Newsletter subscriptions: Until you unsubscribe
• Event registration data: 3 years from the event date
• Analytics data: 26 months (Google Analytics default)
• Web vitals performance data: 12 months

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption in transit (TLS/HTTPS), secure database access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

11. Your Rights

Under the GDPR and other applicable data protection laws, you have the following rights:

• Right of access – Request a copy of the personal data we hold about you
• Right to rectification – Request correction of inaccurate or incomplete data
• Right to erasure – Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing – Request that we limit how we use your data
• Right to data portability – Receive your data in a structured, machine-readable format
• Right to object – Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent – Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at privacy@aisocratic.org or via our contact page. We will respond to your request within 30 days.

You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

12. Children's Privacy

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we may also notify you via email if you have provided one.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@aisocratic.org or via our contact page.