Legal
Privacy notice.
This site publishes research about governments, not about the people who read it. The data it collects is limited to what is required to deliver pages, answer inquiries and distribute publications.
What is collected.
Correspondence. When you write to the inquiry address, the message and the address it came from are retained so the exchange can be answered and, where it concerns a published result, audited later.
Server logs. Requests to this site are logged by the hosting provider with an IP address, timestamp, requested path and user agent. Logs are used for security and capacity, not for profiling, and are discarded on the provider’s rotation schedule.
Publication requests. Where a report is requested by email, the address given is used to send that report and any correction notice affecting it.
What is not collected
No advertising or cross-site tracking technology is used. No data is sold, rented or shared with a data broker. Reading a ranking page does not create a profile, and no reader is identified in any published research output.
Legal basis and retention
Correspondence is processed on the basis of legitimate interest in operating a research institution and answering those who write to it. Publication requests are processed on the basis of consent, withdrawable at any time by replying to any message. Correspondence is retained for as long as the matter is open and for a defined period afterwards where it relates to a correction; server logs are retained for the shorter of the provider’s rotation period or twelve months.
Your rights
Depending on where you are, you may have the right to access the personal data held about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. Requests are answered within one month. If you are in the European Economic Area or the United Kingdom you may also complain to your national supervisory authority.
Processors and transfers
Hosting, email delivery and file distribution are performed by third-party providers acting under contract. Where a provider processes data outside your jurisdiction, that transfer is covered by the safeguards in the provider’s terms. A current list of providers is available on request.
Changes
Material changes to this notice are published here with a revised date. Where a change affects how correspondence already held is used, those affected are notified directly.
The rest of the notice
Cookies, security and where the data goes.
-
Cookies and similar technology
No advertising, analytics or cross-site tracking cookie is set by this site. Where a cookie is used at all it is strictly necessary — maintaining a session while you are signed in to the editor, or a security cookie set by the network provider that fronts the site — and it is not used to build a profile or to follow you elsewhere.
Because nothing here is used for targeted advertising, there is no consent banner to dismiss and no preference to set. If you send a Global Privacy Control or Do Not Track signal, there is no tracking for it to switch off; the signal is respected by default rather than by configuration.
-
Who processes data on the organization’s behalf
Hosting, content delivery and security filtering, email delivery and file distribution are performed by third-party providers under contract, each permitted to process personal data only on the organization’s instructions and only to deliver the service. They are not permitted to use it for their own purposes, and none is authorized to sell it.
A current list of providers, and the safeguards covering each, is available on request from [email protected]. Where a provider processes data outside your jurisdiction, that transfer relies on the standard contractual clauses or equivalent mechanism in the provider’s terms, and a copy of the relevant safeguard can be requested at the same address.
-
Security
Traffic is served over TLS, administrative access requires individual accounts, and access to correspondence is limited to those who need it to answer or audit an exchange. No transmission over the internet is completely secure, and no assurance of absolute security is given. If a breach affecting personal data occurs, affected individuals and the relevant supervisory authority are notified within the period the applicable law requires.
-
If you are in the United States
Personal information is not sold, and it is not shared for cross-context behavioral advertising, as those terms are used in California and comparable state laws. Nothing on this site is a financial incentive program, and you are never treated differently for exercising a privacy right.
Depending on your state, you may have the right to know what personal information is held about you, to have it deleted or corrected, to receive a portable copy, and to appeal a refused request. Requests and appeals go to [email protected]. Identity may need to be verified against the correspondence already held before a request is answered.
-
If you are in the EEA or the United Kingdom
The controller is Global AI Rankings. You may exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to [email protected]. Where processing rests on legitimate interest, you may object at any time, and processing will stop unless compelling grounds can be shown that override your interests. Where it rests on consent, you may withdraw it at any time, without affecting processing already carried out.
You may also complain to your national supervisory authority. Raising the matter directly is welcome first, but nothing here requires it.
-
No automated decision-making about you
The scoring on this site assesses governments and institutions, not readers. No score, rank or profile is produced about any individual reader, and no decision producing a legal or similarly significant effect on you is taken by automated means.
-
Personal data inside the research
Published research names office holders and institutions where their public role is the subject of assessment. That is processing in the public interest and in the exercise of the right to freedom of expression and information, and it is limited to information already in the public record. A named individual who believes a statement about them is inaccurate should use the corrections policy, which is faster than a data-protection request and produces a published record of the outcome.
-
Children
This site is not directed at children, and personal data is not knowingly collected from anyone under sixteen. If you believe a child has sent personal data to the organization, write to [email protected] and it will be deleted.
Two things on this page must be checked against reality before publication rather than taken on trust: the list of providers actually in use, and whether your hosting or CDN sets any cookie beyond the strictly necessary ones described above. A privacy notice that describes a configuration you do not have is worse than none.