Privacy Notice

Sustin newsletter & product updates

Controller and contact

SUSTIN C.I.C. is responsible for this subscription. Contact hello@sust.in for privacy questions or to withdraw consent.

Purpose and consent

With your consent, we use your email to send ongoing Sustin newsletters and product updates, including access-opening announcements and relevant early-access or testing opportunities. This is an ongoing subscription, not a one-time waitlist. It does not create a Sustin account. We do not subscribe you to unrelated Sustainable Intelligence newsletters, SSC communications or other mailing lists without separate, stated consent. Consent is optional and can be withdrawn at any time.

Information stored

We store your normalized email address, consent, server submission time, source page, privacy-notice version, a keyed email hash and a random unsubscribe token. The hash supports opt-out checks; the token lets you unsubscribe without signing in. We do not request a name, CV, password, profile or uploaded files. Earlier launch-only consent is not treated as consent to this ongoing newsletter.

Hosting, storage and recipients

The public service uses Cloudflare Pages and its Workers runtime. Subscription and suppression records are stored in a dedicated Cloudflare D1 database configured for EU jurisdiction. Cloudflare processes this service data as our hosting/storage provider, using its subprocessors. Authorised SUSTIN C.I.C. personnel may access records to manage subscriptions and privacy requests. No external newsletter-delivery platform or automated email sender is currently connected. We will update this notice before adding a provider that receives subscriber data. See Cloudflare’s Data Processing Addendum and Privacy Policy.

Security and Turnstile

The browser sends the form over HTTPS to our same-origin backend. The server checks the form, consent and Cloudflare Turnstile token before storing a subscription and confirms storage before reporting success. We send only the token and our secret to the Turnstile verification endpoint, not your email or IP address. The Turnstile widget itself processes browser/device and network signals, which can include IP address, to detect abuse. Cloudflare describes its processor role for this verification and its controller role for improving Turnstile in the Turnstile Privacy Addendum. The application does not log email addresses, unsubscribe tokens or request bodies, and does not store Turnstile tokens or IP/device information in subscription tables. Cloudflare’s infrastructure/security processing is separate.

Location and transfers

EU jurisdiction restricts where the D1 database runs and stores data. It does not restrict all Cloudflare network or Turnstile processing to the EU. Cloudflare may process service and security data internationally under its applicable data-processing terms and transfer safeguards, described in its Data Processing Addendum.

Active subscription retention

We keep active subscription records until you unsubscribe, withdraw consent, or the Sustin newsletter/service is discontinued. There is no 12-month automatic expiry and no age-based cleanup of active subscribers. Duplicate submissions do not create additional subscriptions.

Unsubscribe and suppression

Use the unsubscribe link included with a Sustin communication, visit our unsubscribe page, or email hello@sust.in from your subscribed address. Once processed, we stop Sustin newsletter and product-update communications and remove your active record. We retain only a keyed email hash and the opt-out time to honour the withdrawal and prevent accidental re-subscription. This is a suppression record, not an active subscription, and is not used for sending. We retain it only while needed to honour the opt-out while the service operates, and remove it when the service is discontinued. If you later want to subscribe again, contact us to provide fresh consent; a routine form submission does not override your opt-out.

Recovery copies

Deleted records may remain in Cloudflare’s restricted recovery history for up to 30 days, depending on the account’s recovery window. Recovery copies are not used for communications. Before using a restored database, we must reapply withdrawals and suppression decisions so opted-out people are not contacted.

Your rights

Contact hello@sust.in to request access, correction, erasure, restriction or portability where applicable, or to object to relevant processing. Withdrawal does not affect earlier lawful processing. You may complain to the UK Information Commissioner’s Office or your relevant supervisory authority. We do not sell subscription records, use them to train AI models, or make automated decisions about access to Sustin.

Consent wording

I consent to SUSTIN C.I.C. emailing me ongoing Sustin newsletters and product updates, including access, early-access and testing opportunities. I can unsubscribe at any time. No unrelated Sustainable Intelligence, SSC or other mailing lists.

Ask Sustin

Ask Sustin answers questions using approved public sources. Do not submit confidential, sensitive or personal information in questions.

Purpose and responsibility

SUSTIN C.I.C. provides Ask Sustin to explain Sustainable Intelligence, Sustin and i5Benchmark using approved public sources. Contact hello@sust.in about this processing. We process questions to provide the answer you request and use limited technical information to protect the service, on the basis of our legitimate interests in operating a useful, secure public information service. This interface does not carry out formal certification or a completed assessment.

What is sent and who processes it

The browser sends your question and at most two recent conversation turns over HTTPS to our Cloudflare-hosted backend. A dedicated Cloudflare Worker uses Cloudflare Workers AI to embed the search question and generate an answer from relevant public-source passages. Cloudflare is the hosting, inference and public-index provider. It also processes network and technical information needed to deliver and protect the service. No external model API, newsletter sender or profile service receives chat input through this implementation.

Conversation retention

The application does not write visitor questions, query embeddings or model answers to D1, KV, R2, Durable Objects, Vectorize, browser local storage or session storage. Recent turns remain only in this page’s memory and clear on reset, reload or closure. Request processing uses transient server memory. Application logs contain only numeric token counts, retrieval counts and completion status, not email addresses, prompt bodies, answer bodies or IP addresses. We do not use chat input to subscribe you, create a profile or add anything to the newsletter database.

Public-source index and abuse controls

A separate Cloudflare Vectorize index stores allowlisted public website passages from sust.in and i5benchmark.com, their embeddings, page URLs, titles, section headings and source/fetch dates. This index is refreshed daily and manually; visitor conversations never enter it. Native Cloudflare rate limiting uses a daily changing hash derived from the network address to apply short request limits. Questions, conversation length and answer length are also limited. This chat implementation does not load a Turnstile widget; the newsletter’s separate Turnstile flow is unchanged.

International processing

Workers AI inference and network processing are not promised to be EU-only. The newsletter database’s EU jurisdiction does not apply to Ask Sustin. Cloudflare may process data internationally under its applicable data-processing terms and safeguards. Cloudflare’s own service/security processing and temporary inference optimisations are separate from our application storage. See Workers AI data usage, Cloudflare’s Data Processing Addendum and Cloudflare’s Privacy Policy.

Your choices and rights

Using Ask Sustin is optional. You can stop an answer, clear the page’s conversation or use the source websites directly. Contact hello@sust.in for privacy requests, including objections to legitimate-interest processing. As the application does not retain conversations, we cannot retrieve earlier chats. Your applicable access, correction, erasure, restriction and complaint rights remain available; you may contact the UK Information Commissioner’s Office or your relevant supervisory authority.