Privacy Notice
Last updated 6 August 2026
Important status notice: The Machine Assurance Institute ("MAI," "we," "us," "our") is a newly formed nonprofit corporation. Our application for recognition of exemption under Section 501(c)(3) of the Internal Revenue Code (IRS Form 1023) is currently in drafting and has not yet been filed or determined. Until we receive an IRS determination letter, contributions to MAI may not be tax-deductible as charitable contributions. Do not rely on deductibility until we publish confirmation that a favorable determination letter has been issued. We intend to seek retroactive reinstatement of deductibility to the effective date of incorporation if eligible, but no assurance of that outcome can be given.
Last updated: 6 August 2026
Overview
This Privacy Notice describes how the Machine Assurance Institute ("MAI," "we," "us," "our") collects, uses, discloses, and protects personal information submitted through our public web intake form, currently published in connection with DEF CON and the "Open Source the Vote Initiative." MAI is a nonpartisan nonprofit organization conducting election voting-system security research.
What We Collect
We collect the following information when you submit our intake form:
- Name — to identify and address you.
- Email address — to send a one-time verification code and to communicate with you. Verified by a one-time code sent to the address you provide.
- Mobile phone number (optional) — to send a one-time SMS verification code. Verified by a one-time code sent to the number you provide.
- Employer — to identify potential conflicts of interest and to understand your professional context.
- Role — to match you to suitable volunteer, donor, or vendor-participation opportunities.
- Skills — to match you to research or contribution opportunities.
- Free-text background — any additional information you choose to share about your experience, interests, or availability.
- Consent records — timestamps and records of your consents to this Legal Notice, SMS, email, and public acknowledgement.
Why We Collect It (Purposes and Lawful Bases)
| Purpose | Lawful basis (GDPR) | Legal basis (CCPA/CPRA) |
|---|---|---|
| Verify your identity and contact details | Contract (taking steps at your request) | Necessary to perform a contract you request |
| Match you to volunteer, donor, or vendor opportunities | Consent and legitimate interests | Consent and business purpose |
| Communicate with you about your submission and our programs | Consent and legitimate interests | Consent and business purpose |
| Maintain records for governance, audit, and legal compliance | Legal obligation and legitimate interests | Legal obligation and business purpose |
| Prevent fraud, abuse, and unauthorized testing | Legitimate interests | Business purpose |
Who Can See It
Access is restricted to authorized MAI personnel with a need to know. We do not sell your personal information. We may share information with:
- Our sub-processors (listed in Section 1.7), solely to provide hosting, email, and SMS services.
- Professional advisors (legal, accounting) under confidentiality obligations.
- Regulators or law enforcement if required by law or court order.
Retention
We retain submission data for two (2) years after your last interaction, or longer if required by law, audit, or active litigation hold. You may request earlier deletion (see Section 1.9).
Encryption at Rest
All form submissions are encrypted at rest. The decryption key is held offline and is not accessible to our hosting provider or any sub-processor. Only a small number of authorized MAI personnel can access decrypted data, and only for the purposes described above.
Sub-Processors
We use the following third-party service providers. Each is a sub-processor under GDPR and a service provider under CCPA/CPRA:
| Provider | Service | Purpose |
|---|---|---|
| Cloudflare, Inc. | Web hosting, bot mitigation, DDoS protection | Serves the intake form and protects it from abuse |
| Microsoft Corporation (Microsoft 365) | Sends verification codes and program communications | |
| Twilio, Inc. | SMS one-time codes | Sends SMS verification codes to verify mobile numbers |
Each provider processes data under its own privacy policy and applicable data-processing agreements. We have not authorized them to use your personal information for their own commercial purposes.
International Transfers
MAI and its primary infrastructure are based in the United States. Cloudflare, Microsoft, and Twilio may process data in the United States and other countries. If you are located outside the United States, your information will be transferred to and processed in the United States. By submitting the form, you consent to that transfer. We rely on Standard Contractual Clauses or other appropriate safeguards where required for transfers from the European Economic Area, the United Kingdom, or Switzerland.
Your Rights — GDPR
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), subject to legal retention obligations.
- Restrict or object to processing.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time (without affecting processing already carried out).
- Lodge a complaint with your supervisory authority.
To exercise any right, email vote@aisecurityfoundation.org. We will respond within one month, extendable by two months where necessary.
Your Rights — CCPA/CPRA
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used.
- Access and delete your personal information.
- Correct inaccurate personal information.
- Opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined by CCPA/CPRA.
- Limit use of sensitive personal information — we do not collect sensitive personal information as defined by CCPA/CPRA beyond what you voluntarily provide in free-text fields.
- Not receive discriminatory treatment for exercising these rights.
To exercise any right, email vote@aisecurityfoundation.org. We will verify your identity before responding. Authorized agents may submit requests with written authorization.
Children
The form is not directed to children under 18. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us for prompt deletion.
Contact
Machine Assurance Institute Email: vote@aisecurityfoundation.org
Changes
We may update this Privacy Notice. Material changes will be posted on this page with an updated "Last updated" date.