Digital Policy Alert privacy policy

Effective date: 5 November 2026.

1. Who is responsible for your information

The St.Gallen Endowment for Prosperity through Trade (SGEPT) operates Digital Policy Alert. We are responsible for the personal information described in this policy. Contact us at office@sgept.org, or write to St.Gallen Endowment for Prosperity through Trade, Guisanstrasse 36, 9010 St.Gallen, Switzerland.

This policy covers digitalpolicyalert.org, the SGEPT account services used with it, the Ask DPA website chat, subscriptions to our updates, enquiries, donations and our related API and hosted Model Context Protocol (MCP) services. An MCP service lets an AI application request our policy data. Your AI application’s own handling of your conversations is covered by its provider’s privacy policy.

2. Information you give us

When you create an account, we collect your email address and authentication details. We store a password hash when you use a password. Your account can also include your name and other profile information you supply. If you choose Google or Microsoft sign-in where offered, we receive the account identifier and profile information authorised through that service.

We keep your product access, account status, subscription choices and saved notification filters. When you contact us or request data access, we receive your message and any contact, organisation or research information you provide. We use these details to answer you and supply the service you request.

For purchases and donations, Stripe processes payment details. We receive the information needed to administer the transaction, such as billing details, payment status, amount and customer or subscription references. We do not receive your full payment-card number.

3. Information collected when you use our services

Our servers and service providers receive technical information needed to deliver the service, including your IP address, request time, requested page or endpoint, browser information and response status. We use appropriate operational logs to protect accounts, enforce access limits and investigate failures.

With your analytics consent, Google Analytics 4 records how the website is used. This includes cookie and session identifiers, public page categories visited, time and interactions, device/browser information, language, approximate location and events such as downloads. We exclude account and authentication pages, search text, selected filters, URL query strings and fragments from the events sent by our website. Google states that GA4 uses IP addresses to derive location at collection and then discards them before logging. The remaining identifiers and usage data can still be personal information. How Google uses information.

With your separate consent to personalised service and outreach, our own browsing tracker, where enabled, can record public page categories, search result counts or errors, content views, downloads and changes or limits to access. It excludes search text, selected filters, account and authentication pages, and URL query strings and fragments. It uses a random identifier for a browser tab, renewed after 30 minutes without activity. When you permit account-linked personalisation, the tracker can connect consented activity to your account. A server-issued consent record is required before it sends browsing events. We use this account history as explained in section 4. Delivery infrastructure also processes connection information such as your IP address.

DPA serves its fonts, icons and map boundaries from its own website infrastructure. Where a form uses Google’s reCAPTCHA, Google processes device, network and interaction information to assess whether the request is automated. We use this for abuse prevention. Google privacy policy.

When you use our API or hosted MCP service, we record the account or API-key reference, endpoint, time, usage volume, result outcome and response time to administer access and investigate problems. We minimise request details. Routine usage logs exclude raw search text, filters and lists of requested policy-record identifiers. We keep the record identifiers needed to count distinct records against your usage allowance during the applicable billing window; these metering records are excluded from personalisation and external AI. Information you provide for a specific troubleshooting case is kept until that need ends. Error records can include a redacted request path, status and diagnostic description. Please avoid including personal or confidential information unnecessary for your query. Use of minimal usage evidence for personalised outreach is subject to the separate choice described below.

When you use Ask DPA, the website chat, Google's AI model receives your questions, the conversation so far and the DPA data retrieved for them in order to write the answer. We keep conversations so you can continue them, and record usage to apply limits and fix problems. Without an account, Cloudflare first checks that you are not an automated program, and we count your questions per browser session and per network address to apply the daily limit, storing only a code that changes daily rather than the address itself.

The DPA MCP server at mcp.digitalpolicyalert.org requests only the mcp:read scope, which lets its tools read DPA data. No DPA MCP tool stores or changes data. The server checks your access token with the DPA API on each request and does not store it.

Most DPA MCP tools send structured filters and keywords to the DPA API. The following tools send free-text search to SGEPT’s RAG service, the search service behind DPA’s semantic and analysis search:

• dpa_semantic_search: your search text, sent through the DPA API to SGEPT’s RAG service
• dpa_search_events, when it is given a semantic_query: that text, sent through the DPA API to SGEPT’s RAG service
• dpa_find_analyses: your search text and filters, sent to SGEPT’s RAG service
• dpa_search_analyses: your search text and the report IDs you selected, sent to SGEPT’s RAG service

dpa_find_analyses and dpa_search_analyses reach the RAG service with the MCP server’s own service key, so your access token is not sent with them. interpret_query, dpa_check_scope, lookup_policy_areas, lookup_economic_activities and the documentation tools (list_resources, read_resource) run on the MCP server alone and send nothing anywhere.

Sentry is used for the DPA MCP server only, not on our websites. When the MCP server hits an unexpected error, it sends a report to Sentry, our error-monitoring provider. A report contains the error and technical context from the failing request, which may include fragments of the tool arguments. It does not contain your account email, any other account identifier or your IP address. Expected input errors, such as an invalid filter value, are not reported. Sentry keeps each report for 90 days, then deletes it.

The DPA MCP service is designed for professional digital policy research and is suitable for users aged 13 and older. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

4. Account support, personalisation and communications

SGEPT maintains a shared relationship record for its services, including GTA and DPA. It can bring together your contact and account details, product permissions, enquiries, subscriptions and correspondence. This helps us answer requests and support the services you use. We may receive relevant professional contact details from your organisation or from public professional sources; we tell you the source, purpose and relevant privacy information within the applicable time limit, normally within one month, or at our first contact if sooner.

With your separate permission for personalised help and offers across GTA and DPA, we may add consented GTA and DPA browsing activity, optional email open/click evidence, and minimal API/MCP usage evidence to this shared record. API/MCP evidence used this way is limited to the service or endpoint used, request time, volume and result outcome; raw search text, filters and requested record identifiers are excluded. This can influence help and offers for either GTA or DPA. Each website can collect its own consented browsing events; the shared relationship record can combine them under that permission. Such analysis is a form of profiling. Permission for ordinary website analytics does not authorise us to create an account-linked marketing profile. We do not treat account registration as permission to send optional newsletters.

We use internal relationship software and AI-assisted tools to summarise relevant records, identify support needs and prepare or prioritise follow-up. Our own browsing records and information derived from them remain in SGEPT-controlled systems; we do not send them to external analytics or AI providers. Google Analytics collects separate usage information as described in section 3. External AI assistance for account support is limited to selected account information and correspondence, excluding our browsing records and information derived from them. SGEPT remains responsible for that use. Automated assistance can affect which help or offers you receive. You can ask us to review or correct an inference. We do not use this profiling to make decisions with legal or similarly significant effects solely by automated means.

We send the alerts and newsletters you request. Mailchimp helps us manage subscriptions and deliver messages. Delivery, bounce and unsubscribe records help us operate the service. We measure email opens and clicks only with a separate recorded choice; subscribing to a newsletter does not itself grant that permission. An open or click is an imperfect signal, because email software can generate it automatically.

You can unsubscribe using the link in a message, or contact us. You can object at any time to direct marketing and the profiling related to it. We then stop that use of your information. Necessary account, security and transaction messages may still be sent.

5. Purposes and legal grounds

We follow Swiss data-protection law. Where the EU or UK GDPR applies, we use the following grounds:

We use AI assistance under the ground that applies to the underlying purpose. AI assistance does not create a separate right to use your information. Optional analytics, profiling and marketing choices do not determine access to the core service. Without essential account or payment information, we may be unable to provide the feature you request.

6. Cookies and your choices

Cookies and similar browser storage keep you signed in, remember choices, enforce access limits and, with permission, measure use. Our cookie controls offer Accept optional, Reject optional and Manage choices. You can allow analytics without allowing the separately labelled personalised help and offers across GTA and DPA. Both the browser control and account settings explain this shared scope. Email preferences separately request permission to measure opens and clicks. Optional uses are off until you choose them.

Use Cookie settings in the website footer to change or withdraw a choice at any time. Withdrawal stops future consent-based collection and use; it does not change the lawfulness of processing carried out before withdrawal. The browser setting applies to that browser and website. If the personalisation choice is linked to your account, withdrawal also stops its use in the shared GTA/DPA relationship record and AI-assisted outreach. When you are signed in, Cookie settings also lets you change your account personalisation permission across our services. Email subscription and measurement choices are separate; you can change them using the links provided in our messages or by contacting us. You can also contact us to withdraw or object. Necessary API/MCP access and security records continue for their stated purpose. Browser settings also let you clear or block storage, although blocking essential storage can affect sign-in.

Browser storage lifetimes do not determine how long server records are retained. The retention criteria below apply separately.

7. Who receives information and where

Authorised SGEPT staff and providers receive information needed for their work. Our providers include Amazon Web Services and Hetzner for infrastructure, Cloudflare for the website chat's browser check, Google for analytics, form protection, the website chat's AI model and selected sign-in services, Microsoft for optional sign-in, Mailchimp and its transactional email service for communications, Stripe for payments, and contracted AI providers for the assistance described above. Website fonts, icon files and map boundaries are served from our own website infrastructure. We do not use Sentry, New Relic or session-replay services on these websites. Sentry (Functional Software, Inc.) processes error reports for the DPA MCP server only, as described in section 3.

Where a provider acts on our behalf, we require it to process information under an appropriate agreement. A provider may have its own responsibilities for services you choose directly, such as social sign-in, payment processing or your AI application. Its own notice explains that processing.

Information may be processed outside Switzerland and your home country. Subscription data (your email address, subscription choices, and delivery and unsubscribe records) is stored by Mailchimp (Intuit Inc.) in the United States. We rely on appropriate contractual safeguards for that transfer: the standard contractual clauses in the Mailchimp data processing addendum. We use an applicable adequacy arrangement or appropriate contractual safeguards for transfers that require them. You can request information about those safeguards, including a copy where applicable, at office@sgept.org. We may also disclose information when required by law or necessary to establish, exercise or defend legal claims.

8. How long we keep information

We keep personal information only while it is needed for the purposes described in this policy. We assess that need by the type of record, whether the service or enquiry is still active, the age and relevance of the information, and any applicable legal obligation. We review retained information and delete or anonymise it when that need ends. An ongoing account or a new visit does not, by itself, justify keeping every earlier record.

A specific legal obligation or an unresolved legal claim can require longer retention of relevant records. We restrict those records to that purpose. This does not justify keeping unrelated information indefinitely. Deletion covers identifying copies, exports and derived profiles in our systems and, where applicable, instructions to providers. Removing an account reference alone is insufficient if a record can still identify you.

9. Your rights and how to exercise them

Contact office@sgept.org to request access, correction or deletion, to withdraw consent, or to object to a use of your information. Depending on the law that applies, you can also request restriction of processing and a portable copy of information. We may ask for proportionate information to verify your identity. You do not need to know the technical time or location of a visit before making a request.

You have an unconditional right to object to direct marketing, including related profiling. For other processing based on legitimate interests, you can object on grounds relating to your situation. Where GDPR applies, we normally respond within one month; if a lawful extension is necessary, we tell you within that month and explain why.

You can complain to the Swiss Federal Data Protection and Information Commissioner, an appropriate EU/EEA supervisory authority or the UK Information Commissioner’s Office, as applicable. Contacting us first is optional.

10. Security, external services and changes

We use technical and organisational measures appropriate to the information and risks, including access restrictions and encrypted connections. No system can guarantee complete security.

Our services are intended for professional and general policy research and are not directed at children. Please contact us if you believe a child has provided information that should be removed. External websites, dashboards, media and AI applications have their own privacy practices when you choose to use them.

We update this policy when our processing changes and identify the current version on this page. For material changes, we provide an appropriate notice. If a new purpose requires your consent, we ask before using your information for that purpose.