Privacy policy

What we collect

• Membership applications (on the website or through an AI agent): name, email, phone, country, organisation, job title, website and LinkedIn links, and your answers on the form. Applications made through an AI agent also record the agent’s name, the application ID, and the date you confirmed by email.
• Domain checks: the website domain you ask us to confirm, the verification code, and whether it was found in your DNS records or on your website.
• Member accounts: your email, a securely hashed password (we never store it in plain text), sign-in sessions with the time, approximate country and browser type, and your settings (for example newsletter preference).
• Trust Diagnosis: the company details and questionnaire answers you give, and results from a scan of public information about the company’s website and presence.
• Messages you send to the Secretariat, and payments for Advanced membership. Card payments are handled by Stripe: we never see or store card numbers, only the subscription status and receipts.
• Technical data: IP addresses and request counts, kept briefly to stop abuse and spam (rate limits and bot checks).

How we use it

• To review applications, run your membership and member account, and contact you about them.
• To issue and publish your CGBB trust.json and keep its public verification record up to date.
• To produce Trust Diagnosis reports and internal ratings used by the Secretariat.
• To send emails you asked for (sign-in codes, reports, welcome and membership emails) and, if you opted in, the CGBB newsletter.
• To keep the services secure and prevent misuse. We do not sell personal data and we do not use it for advertising.

What is public

• If you hold a CGBB trust.json, its record is public by design: organisation name, website domain, membership level, number, status and dates, shown at api.cgbb.org/verify and in the file on your website. It contains no personal contact details.
• Your name and photo appear in the public member directory only if you agreed to this on your application.

Who we share it with

• Service providers that run the services for us, under their own security and privacy terms: Cloudflare (hosting of the API and data storage, bot checks), GitHub Pages (website hosting), Resend (sending email), Stripe (payments), Anthropic (AI used in the Trust Diagnosis and to read public information about an organisation) and Google Fonts (web fonts).
• CGBB staff and the Secretariat, who review applications and manage memberships.
• Authorities, if the law requires it. We do not share personal data with anyone else without your permission.

How long we keep it

• Member records: while you are a member and for a reasonable period afterwards, unless you ask us to delete them.
• Applications made through an AI agent that are never completed: 90 days. Email confirmation links expire after 14 days.
• Sign-in sessions: up to 30 days. Rate-limit and bot-check data: hours to days.
• Trust Diagnosis reports and payment records: as long as needed for the service and for legal and accounting obligations.

Your choices and rights

• You can ask to see, correct or delete your personal data, or withdraw consent, by emailing secretariat@cgbb.org.
• You can unsubscribe from the newsletter at any time from any newsletter email or your account page.
• You can remove your trust.json from your website at any time, and ask us to withdraw its public record.

AI agents

• If an AI agent applies for you, the contact person must confirm by email before anything is submitted, and the agent cannot confirm for you. The CGBB connector does not require sign-in and does not read anything from your AI assistant beyond what the agent sends in a request.

Security

• We use encrypted connections (HTTPS), hashed passwords, signed trust.json files, rate limits and bot checks. No system is perfectly secure; if you believe your data is at risk, email us straight away.

Changes

• We will post any changes on this page and update the date at the top.

Contact: secretariat@cgbb.org