Lens Academy Privacy Policy
Last updated: 4 November 2026
This policy explains what personal data Lens Academy collects, why, who can see it, how long we keep it, and what rights you have.
1. Who we are
Lens Academy ("Lens", "we", "us") is a free online AI-safety education platform at lensacademy.org and its subdomains. Lens Academy is a fiscally sponsored project of Beacon Institute for Global Catastrophic Risk, a Delaware nonprofit corporation recognized by a 501(c)(3) public charity ("Beacon"). Beacon is the data controller for the personal data described here. The Lens Academy team runs the service.
Contact for anything in this policy: team@lensacademy.org
2. Personal data we collect
| Category | What it includes | Source |
|---|---|---|
| Identity and login | Name, preferred name, nickname; email; phone number; the account details we receive from the sign-in method you choose (such as your Google or Discord account ID, name, avatar and email); linked and merged accounts; login times | You; your sign-in provider |
| Profile and scheduling | Timezone; availability; cohort sign-ups; group membership and role; reschedules; the Zoom email and display name we use to match your attendance; RSVPs and minutes attended | You; Zoom; our platform |
| Applications | Your answers on application forms (for example education, career stage, location, profile links, CV, motivation, how you heard of us, people you nominate, your data-sharing choice); how long each question took and which questions you reached; an AI score of your application | You; our platform; our AI systems |
| Learning data | Content viewed and time spent; exercise and test answers; AI assessments of your answers, roleplays and meeting participation; course scores; certificates and other credentials | You; our platform; our AI systems |
| AI conversations | Everything you write to our AI tutor (on the site, in Discord, by WhatsApp, SMS or RCS, and in any other channel you turn on), the replies, and the full record of each request to the AI model; "memory" facts the AI tutor derives about you, with the passage they came from; conversation summaries; notes and ratings the Lens Academy team adds; token use and cost | You; our AI systems; the Lens Academy team |
| Voice | Speech from microphone features, sent to our server and a speech-to-text provider to turn it into text. | You |
| Group meetings | Meeting links; attendance; audio recordings, transcripts with speaker names, and AI summaries of breakout-room discussions (Section 5) | Zoom; our meeting bot |
| Surveys and feedback | Survey answers; answers to short questions in the app; feedback you send, including an optional screenshot | You |
| Communications | A log of messages we send you (by email, Discord, WhatsApp, SMS, RCS or other channels you turn on) and whether they were delivered; your notification settings; messages drafted by our AI for you | Our platform |
| Marketing and attribution | Referral-link clicks (browser type, referring page, landing page, a browser token, your consent choice); the campaign or referral that brought you; A/B test variant shown; your cookie choices | Your browser; our platform |
| Newsletter | Email address; the lists you chose; unsubscribe records | You |
| Analytics and session replay | Pages viewed, clicks and feature use; recordings of your sessions on the site (Section 7) | Your browser |
| Technical and security | IP address and browser type in logs of account and admin actions; error reports, which can include your account ID, username and email; automated flags that ask the team to follow up with an account or group | Your browser; our servers |
| Volunteer facilitators | Certification and training status, groups you lead, ratings from your groups, Zoom host details | You; our platform |
| Donations | Donations are handled by Every.org on its own site. Every.org may send us your name, email address and details of your donation | Every.org |
Use without an account. You can use most course content without an account. We then store a random ID in your browser so that your progress, answers and AI tutor chats are kept. We treat this as personal data. If you create an account later, we may link this data to your account.
Sensitive data. We do not ask for health, religious, political or similar sensitive data. If you include it anyway, it is not used to make decisions about you.
Data about other people. If you nominate or refer someone, share their details only with their permission. We use a nomination only to contact that person about Lens Academy, and we tell them where we got their details.
What you must give us. To join a cohort, you must create an account, give us your availability, complete any application the cohort requires, and take part in its coursework and recorded meetings (Section 5). Without these we cannot admit you or run your group. Everything else is optional.
3. Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and securing your account; sign-in; merging duplicate accounts | Contract |
| Running courses: enrolment, forming groups, scheduling, Discord channels, calendar invites, Zoom meetings, attendance, progress, exercises, grading, credentials | Contract |
| Reviewing and scoring applications (Section 6) | Contract (steps you ask for before you enrol) |
| Recording and transcribing breakout rooms, and using the transcripts to grade participation (Section 5) | Contract |
| Using meeting transcripts to personalise the AI tutor (Section 5) | Legitimate interest; you can opt out |
| The AI tutor, including chat by WhatsApp, SMS or RCS if you turn it on | Contract |
| AI tutor memory across conversations (Section 4) | Legitimate interest; you can ask us to turn it off or delete what it holds |
| The Lens Academy team and your facilitator reading AI conversations, to help you, check AI quality and keep people safe | Legitimate interest |
| AI tutor check-ins, study reminders and surveys, by email or Discord | Legitimate interest; turn them off in settings |
| The same messages by WhatsApp, SMS or RCS | Consent: we send them only if you turn that channel on, and you can turn it off at any time in settings or by replying STOP |
| Service messages (reminders, schedule changes, credentials) | Contract |
| Improving our courses, grading and AI systems, including re-running past answers and conversations through new prompts and grading methods | Legitimate interest |
| Research on how well our courses and admissions work, including following up with past learners and applicants | Legitimate interest |
| Making data anonymous, and publishing anonymous statistics and excerpts in research, reports and course material | Legitimate interest |
| Measuring how people use the application form | Legitimate interest |
| Referral-click logging, to measure campaigns and detect bots | Legitimate interest |
| Linking campaign and referral data to your account | Consent (marketing cookies) |
| Analytics and session replay | Consent in the EU, EEA, UK, Switzerland and Brazil; legitimate interest elsewhere (Section 7) |
| Newsletter | Consent; unsubscribe at any time |
| Sharing application and course data with organisations offering AI-safety jobs, fellowships or grants | Consent on the application form; withdraw at any time |
| Recording guests at meetings; contacting people nominated by an applicant | Legitimate interest |
| Publishing your certificate at a public link | Contract |
| Error tracking, security, audit logs, backups | Legitimate interest |
| Legal claims and complying with the law | Legal obligation; legitimate interest |
Our legitimate interest is to run a free education service well and to carry out our charitable mission.
You can object at any time to any use of your data that is based on legitimate interest. Email team@lensacademy.org.
4. AI features
- Providers. Our AI tutor, grading, application scoring, meeting summaries and some messages to you are produced by AI models from third-party providers, which process the data on our behalf.
- What is sent. Your messages, the course content you are working on, and what the AI tutor remembers about you.
- Memory. The AI tutor stores short facts about you (for example your background or goals) with the passage they came from, and summarises long conversations. You can ask to see or delete them.
- Who can read your conversations. The Lens Academy team, and the volunteer facilitator of your group. Facilitators see only their own group. Conversations with the AI are not confidential.
- Training AI models. Today we do not train AI models on your data; we improve our prompts and grading methods by re-running past work through them. If we start to train or fine-tune models for Lens Academy on learner data, we will tell you first and you will be able to opt out.
- AI-drafted messages. Some messages we send you are drafted by AI, and some routine ones are sent without a person reviewing them. You can turn these off in your notification settings.
5. Group meetings, recording and transcription
Group meetings run on Zoom, and we record attendance automatically. In breakout rooms, a Lens meeting bot joins as a visible participant. It records the audio and produces a transcript with speaker names and an AI summary. We use the transcripts to grade participation, to personalise the AI tutor, to help facilitators follow their groups, and to improve our courses.
Because participation grading depends on them, recording and transcription are part of the service you sign up for (Terms, Section 7). Using transcripts to personalise the AI tutor is optional: email team@lensacademy.org to turn it off. If you do not want to be recorded, you can use the self-study materials instead of joining a cohort. Guests can see the bot and can leave before the discussion starts.
6. Automated grading and scoring
- Coursework. Exercises, tests, roleplays and meeting participation are graded by AI models against rubrics written by the course team.
- Credentials. Your scores feed into any certificate or other credential we offer, under the scheme in place at the time.
- Applications. An AI model scores applications against the course's criteria. The team uses the score to review applications and form groups. A person makes every admission decision.
- Groups are formed automatically from the availability you give us.
If you think a grade or score is wrong, email team@lensacademy.org and a person on the team will re-assess it.
7. Cookies, analytics and session replay
Essential storage (no consent needed). Your login session, the random ID used to keep your progress, your consent choices, and your A/B test assignment.
Analytics and session replay. We use PostHog (hosted in the EU) to measure page views and feature use and to record sessions: a replay of what you did on a page. What you type into a field is masked, so passwords and other input are not recorded while you type. Text shown on the page is recorded, including answers and chat messages once you have sent them. Replays are deleted after 30 days. When you sign in, PostHog receives your user ID.
Where you are matters. When you first visit, your browser asks ipapi.co which country you are in. If you are in the EU, EEA, UK, Switzerland or Brazil, analytics and marketing storage only run after you agree. Elsewhere they run by default, and you can switch them off at any time in Cookie Settings.
Marketing. With your consent, we link your sign-up to the referral link or campaign that brought you.
Error tracking. We use Sentry to collect error reports. These can include your account ID, username and email. Error tracking is needed to keep the service working and is not affected by your cookie choices.
You can change your choices at any time in Cookie Settings, at the bottom of every page.
8. Who receives your data
The Lens Academy team and volunteers. Team members with admin access. Volunteer facilitators see the roster, progress, attendance and AI conversations of their own group only.
Partner organisations. If you join a cohort run by a partner organisation, that organisation sees your enrolment, attendance and progress in that cohort.
Organisations offering opportunities. If you agree to it on an application form, we may share your application and course record with organisations offering AI-safety jobs, fellowships or grants, so that they can tell you about opportunities. You can withdraw this at any time.
Service providers that process data for us:
| Provider | What they do for us | Location |
|---|---|---|
| Supabase | Database hosting | EU |
| Railway | Application hosting | USA |
| Cloudflare | File storage | USA |
| AI model providers | AI tutor, grading, scoring, summaries | USA and other countries |
| Speech providers | Text-to-speech and speech-to-text | USA and other countries |
| Messaging providers | WhatsApp, SMS and RCS messages and codes | USA and other countries |
| Zoom | Group meetings and attendance | USA |
| Recall.ai | Meeting bot: recording and transcription | USA |
| Sign-in, calendar invites, surveys and forms, email, fonts | USA/EU | |
| Resend | Sending email | USA |
| PostHog | Analytics and session replay | EU |
| ipapi.co | Country lookup for the cookie banner | USA |
| Sentry | Error tracking | EU |
| HubSpot | Contact management | EU |
| Substack | Sending the newsletter; we pass it the email address you subscribe with | USA |
Services that act under their own policies: Discord (our community server, bot messages, and the team channel that receives feedback you send, including screenshots), your sign-in provider, WhatsApp, Zoom and Google (your own accounts), Substack (if you have your own Substack account) and Every.org (donations).
Public. Each certificate has a public page at a unique link, showing your name, the course, your result and the date. You can ask us to unpublish it.
Research and publications. We may publish statistics, and short excerpts of answers, conversations and discussions, in research, reports to funders and course material. Before we publish an excerpt, a person checks that nothing in it can identify you or anyone else. If you want your words left out, email us.
Legal. We may disclose data where the law requires it, or to establish or defend legal claims.
9. International transfers
Beacon is based in the United States, several of our providers are in the United States or other countries, and the Lens Academy team works from several countries. Your data may therefore be processed outside your country. Where we transfer data from the EU or UK, we use the safeguards the law provides, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where a provider is certified. Email us for details.
10. How long we keep your data, and your rights
How long. We keep your data while your account is active and for 5 years after your last activity. We keep it this long because we re-grade past work when we improve our grading methods, use past learning data to improve our courses, and measure over several years whether our courses and admissions work. After that, or earlier if you ask, we delete it or make it anonymous.
- Meeting audio is deleted after 12 months. We keep it that long so that we can transcribe it again as transcription improves. We keep the transcript.
- Applications that were not admitted are kept for the same 5 years, so that we can check whether our selection was right. We may email you to ask what you went on to do.
- Certificates stay verifiable at their public link until you ask us to remove them.
- Analytics, session replays, error reports and backups are deleted automatically on our providers' shorter schedules, so copies there may remain for a limited time after a deletion.
Anonymous data. Statistics, scores and excerpts that can no longer be linked to you or anyone else are not personal data. We may keep, share and publish them without a time limit (Section 8).
Your rights. You can ask us to:
- give you a copy of your data, in a machine-readable file, or send it to another organisation where this is technically possible;
- correct it;
- delete your account and data;
- restrict our use of it while a dispute is resolved;
- stop a use based on legitimate interest;
- withdraw consent you gave (analytics, marketing, newsletter, data sharing).
Email team@lensacademy.org from the address on your account. We reply within one month. When we delete your account, we delete your data or make it anonymous. Group transcripts and summaries also contain other people, so we remove or anonymise your contributions and keep the rest of the group's record. We keep only what the law requires, and a record that a certificate existed, without your name.
If you used Lens Academy without an account, we can only find your data if you send us the random ID from your browser.
Complaints. You can complain to the data protection authority where you live or work.
11. Age
You must be at least 18 to create an account.
12. Security
Access to personal data is limited by role and logged. If a data breach puts you at risk, we will tell you and the authorities as the law requires.
13. Changes
We will post changes here with a new date. For important changes we will email you before they take effect.
14. Contact
Lens Academy, a project of Beacon Institute for Global Catastrophic Risk. Email: team@lensacademy.org