Privacy Policy

Last updated 24 August 2026

Who is responsible for your data

• Controller: [ENTITY NAME, Inc.], a corporation incorporated in the State of Delaware, United States
• Delaware file number: [FILE NUMBER]
• Registered agent in Delaware: [AGENT NAME AND ADDRESS]
• Principal place of business: [STREET ADDRESS], Arlington, Virginia [ZIP], United States
• Contact: info@goescalate.ai
• EU representative (GDPR Article 27): [NAME AND EU ADDRESS — see the note below, or delete this line if it does not apply]
• Data protection officer: [CONTACT — or delete this line if none is appointed]

What we collect

Everything below is either something you typed and sent us, or something your browser told our server while it was answering your request. We ask for nothing else, we buy nothing from anybody, and we run no third-party tracker.

What you send through the contact form. The email address you typed, the subject, the message, whether you ticked the newsletter box, the choices you had made in the cookie banner at the time, and the date and time you sent it. Stored alongside them is what the request itself carried: a salted, shortened hash of your IP address instead of the address, the country that address resolves to when a local geolocation database is installed, whether the request came from a desktop, a tablet, a phone or a bot, the host name of the site that referred you, your browser's user-agent string, the first language your browser asked for, and the results of our spam checks and, where it ran, of the reCAPTCHA check. We do not ask for your name, your company or your phone number, and we do not collect any sensitive category of data.

Basic measurement of every visit. For each page our server sends you it records the path you asked for, the host name of the site that referred you (never the full address of the page you came from), your device class, the country your address resolves to when that database is installed, and a visitor hash: a salted, shortened digest of your IP address and your browser's user-agent string. The salt is replaced at midnight UTC every day and never kept afterwards, so a hash from yesterday cannot be matched to one from today. Nothing is written to or read from your device in order to do any of this, and your IP address itself is never stored.

We do not call that anonymous, because it is not: for as long as we hold the day's salt we could re-derive the hash from a known address, which makes it pseudonymous data and keeps it inside the GDPR. Its legal basis is our legitimate interest under Article 6(1)(f) — knowing whether the launch announcement reached anyone — and not your consent, and because it stores nothing on your device it is outside the consent requirement in Article 5(3) of the ePrivacy Directive. It is never used to profile you, never combined with anything else, never used for advertising, and never shared.

Because that basis is legitimate interest, you have an absolute right to object, and objecting works. If your browser sends Global Privacy Control or Do Not Track, we discard the record before it is written. You can also switch the measurement off for this browser, which stores one small marker on your device so that we stop counting you. That marker is the only thing the objection itself stores, and it exists purely to honour your refusal.

The extra detail we collect only if you accept it. If you accept the analytics category in the banner, a small script of our own adds how long you stayed on a page, how far down it you scrolled, and which parts of it you interacted with. That runs on your consent, it is first-party like everything else here, and it stops the moment you withdraw it. One thing is recorded whichever way you answer, and that is the answer itself: a refusal we were not allowed to record would leave us unable to tell a refusal from a visit nobody was ever asked about.

Why we use it, and on what legal basis

Your address is used for one purpose: to write to you once, on the day Escalate AI opens. If you ticked the newsletter box, we will also use it to send you our newsletter when it starts.

If you are in the European Economic Area or the United Kingdom, the legal basis for both is your consent under Article 6(1)(a) of the GDPR (and the UK GDPR), given by sending the form and, for the newsletter, by ticking that box. Consent is entirely voluntary and costs you nothing to refuse.

If you are in the United States, we rely on your request and consent, and we honour the rights described below under Virginia, Delaware and California law as applicable.

Newsletter and how to unsubscribe

Ticking the newsletter box does not subscribe you. It sends one email to the address you gave us asking you to confirm, and nothing is sent to you again unless you click the link in it. If you never click it, the pending record is deleted on a schedule and that is the end of it. When you do confirm, we record the moment you did, a hash of the address the confirmation came from, your browser's user-agent string and the exact wording you agreed to, because consent we cannot evidence is consent we cannot rely on.

Every newsletter we send carries a working unsubscribe link, and the standard List-Unsubscribe header beside it, which is what lets some email clients show an unsubscribe control of their own next to the message. Both lead to the same page, and pressing either takes effect immediately. It works from any state, including a subscription you never confirmed, and it needs no account, no password and no reply from us. Withdrawing consent is as easy as giving it.

Where your data is processed

We are a United States company. Your email address is stored and processed in the United States, and by our email provider wherever it operates.

If you are in the EEA or the UK, that is an international transfer. It is covered by [CHOOSE ONE: our certification under the EU–US Data Privacy Framework and the UK Extension / the European Commission's Standard Contractual Clauses, together with a transfer impact assessment]. You can ask us for a copy of the safeguards in place by writing to info@goescalate.ai.

How long we keep it

Until the launch email has been sent, or until you withdraw your consent, whichever comes first. After that we delete the address, unless we are legally required to keep evidence that we obtained your consent properly. If you subscribed to the newsletter, we keep it until you unsubscribe.

Who else sees it

Our email is delivered through the mail service the operator of this site has configured for it — a Gmail account or an ordinary SMTP server, or both, with one taking over when the other fails. Whichever is used acts as a processor on our instructions and sees the address it is delivering to and the message being delivered, and nothing else. We may also disclose data if we are legally compelled to, or to protect our rights, but we will tell you unless the law forbids it.

If you accepted the security cookie, Google also receives data through reCAPTCHA on the contact form: your IP address, browser and device information, and how you interacted with the page. Google acts as an independent controller for that, under its own privacy policy and terms. Refuse it and the script is never loaded, so Google is never contacted — the form works either way.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising, as those terms are defined under California, Virginia and Delaware law.

Your rights

If you are in the EEA or the UK

• Access — a copy of what we hold about you.
• Rectification — correct anything inaccurate.
• Erasure — delete it.
• Restriction and objection — limit or object to what we do with it.
• Portability — receive it in a machine-readable format.
• Withdraw consent — at any time, without affecting what we did before you withdrew it.

If you are in the United States

• Know and access — what we collect and hold about you.
• Correct — fix inaccurate personal data.
• Delete — have it erased.
• Portability — a copy in a portable format.
• Opt out of sale, targeted advertising and profiling — we do none of these, so there is nothing to opt out of.
• Non-discrimination — exercising any right never changes how we treat you.

Write to info@goescalate.ai and we will act free of charge. We may ask you to confirm control of the address you are asking about, since it is the only identifier we hold. If we refuse a request, we will explain why and how to appeal.

How to complain

If you are in the EEA, you can complain to the data protection authority of the country where you live or work. In the UK it is the Information Commissioner's Office, ico.org.uk. In Virginia and Delaware, complaints go to the state Attorney General. In California, to the California Privacy Protection Agency. We would rather you came to us first, at info@goescalate.ai.

Cookies, analytics and reCAPTCHA

We ask before we track. On your first visit you are offered analytics cookies and Google reCAPTCHA, and neither loads until you choose. Reject and no script ever runs; the only thing stored is the record of your refusal, so we stop asking.

The legal basis for both in the EEA and the UK is your consent, and you can withdraw it at any time from the Cookie settings link at the bottom of the home page. Refusing reCAPTCHA does not cost you the contact form: it falls back to checks that contact nobody and store nothing on your device. There is no analytics provider to name — the measurement described above is our own, runs on our own servers, and is shared with no one. The full list of what is stored on your device is on the cookies page.

Children

This site is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has submitted an address, write to us and we will delete it.

Security

We apply appropriate technical and organisational measures to protect your address against unauthorised access, loss or disclosure. No system is perfect, and we will notify you and the relevant authorities of a breach where the law requires it.

Changes to this policy

We will update this page as the service develops. The version published here is always the one in force, and the date at the top tells you when it last changed.