Your account

In order to use this tool, you must hold a valid account with the Open Data Institute. You can register for a new account here.

Upon logging in, this tool collects the following data about you:

• Name (first name and last name)
• Email
• Time and date of login

Project data

All the data you create is stored in a cloud database. System maintainers have access to the database for administration. Reading and extracting data for purposes other than ensuring the system is online and functioning is strictly prohibited.

In addition to what you see on the screen, each project has the following data associated with it:

• Project owner (ID)
• User IDs for users the project is shared with
• Last modified date

Interactions data

The system sends an "interaction message" to the ODI Customer Relationship Management (CRM) system (HubSpot) each time you do any of the following:

• Login
• Start an assessment
• Complete an assessment
• Delete an account or assessment(s)

This data is shared so the ODI can monitor:

• Number of active users (last login, number of times logged in)
• Number of assessments in progress
• Number of completed assessments

This data helps us measure the popularity of the system and make the case for additional development and funding.

This data is stored against your record in the CRM system and can be managed alongside your account via the Open Data Institute website.

User data

The system stores very little user data. Access to user data is not necessary as it will only tell you your own name and email.

If you wish to delete your account, you can do this from the profile page.

Note: This does not delete your ODI account, just the associated record in this system. We do not archive the account, it is deleted, and we do not store a record of this operation.

Project Data

All project data can be downloaded from within the system as JSON, which is the format it is stored in, so there is very little difference between this and the stored data. The main difference is that we remove the IDs of users your project might be shared with.

If you delete a project, it is gone. We do not archive; it is deleted there and then. The only place it will exist is within an automated backup.

Backups

We take backups of the system purely to ensure that in the event of a disaster we can restore the system to a good state. Should this happen, it may be discovered that data has been restored that a user has deleted. This is a rare occurrence, and we will contact users to let them know that a backup has been restored and communicate the impact on saved/restored data.

The CARE tool is hosted on a Digital Ocean server in the UK which is maintained with the latest security updates.

Cloudflare is used as the content devlivery platform and to protect against attacks.

Account data (name, email, time and date of login etc) and project data is stored in MongoDB atlas which is in turn hosted on Microsoft Azure infrastructure located in Ireland. Data is encryted at REST in Azure, so Microsoft/Mongo cannot see the data. System maintainers have access to the database for administration. Reading and extracting data for purposes other than ensuring the system is online and functioning is strictly prohibited.

The tool is developed in NodeJS and regular valnerability audits are automatically carried out, reported and actioned as necessary.

The tool integrates with the ODI's website for authentication and HubSpot for statistics reporting, please refer to the ODI privacy policy for more details.

This deployment is configured to use Anthropic with model claude-sonnet-4-6 when you choose to run the optional AI features.

You can choose to use AI assistance during consequence scanning. Throughout the tool, you will have the option to generate suggestions and ideas for your project to help you identify consequences and plan risk mitigation.

To use the AI features, we process your input and send it to the configured provider’s API. You can see what data is sent, and the exact prompt, before you confirm.

Important: No project data is sent to the AI provider without your confirmation. You can use the tool without AI: choose ‘No’ or ‘Continue without’ when prompted.

Training and logging: We aim to use provider account and API settings that limit retention and use of your assessment content for training or evaluation where the vendor offers such controls. We reserve the right to change provider or model over time as we evaluate options both for compliance and ethical considerations; this page reflects the current deployment configuration.

When using this tool, consider whether AI is appropriate for your content and avoid entering personally identifiable, sensitive, or commercially sensitive information unless your policies allow it. Apply your organisation’s rules as required.

For the latest information on how Anthropic handles data, see their privacy policy (and related terms).

The ODI may change provider or model over time as we evaluate options; this page reflects the current deployment configuration.

For bugs and issues

Please use GitHub issues to raise an issue with functionality, etc.

Everything else

Contact us