Data and Privacy Policy

This website is owned and operated by the International Rescue Committee (IRC). The International Rescue Committee Inc. (IRC) is a non-profit organization that helps people affected by humanitarian crises to survive, recover, and rebuild their lives. 

Our website hosts Giannis, an AI assistant developed by the International Rescue Committee, Inc. (IRC) to provide clear and reliable information about human trafficking. Giannis helps users understand key definitions, recognize warning signs, and learn safe response strategies. This assistant is designed solely as a digital tool for education and awareness and does not offer legal advice, medical support, or emergency services.

The settings on our website are designed to store as small an amount of personal data as possible and share as little as possible with the third parties that make the service work. Geolocation options are switched off by default.  Unless you specifically change them, they will remain: default off. 

IRC is committed to protecting your privacy and handling your personal data responsibly. This PrivacyPolicy outlines how we collect, use, and protect your personal data. IRC collects personal data solely for the purposes of providing and facilitating access to humanitarian assistance. 

Why Do We Collect Data? 

We collect data through the platforms that support our online work to better help you in the following ways:  

  • To offer services via www.antitraffickingresponse.org /WhatsApp to deliver curated IRC content and reflective prompts to facilitate your educational progress and reinforce key learning concepts .  
  • To adapt the chatbot to your needs and interests based on what you choose to share.  The chatbot uses artificial intelligence (AI) to personalize responses and suggest content but only based on what you choose to share.
    • This data is not shared or sold for any reason, and users can opt-out of reminders and personalization features at any time via WhatsApp commands or settings.  
  • To refine our service offering and user experience that works with AI tools that are adjusted to ensure that the program delivers a safe, secure, reliable, and optimized service in support of our website.  
  • To provide insights and analytics: We collect data on your experience and interaction with our website in order to improve user experience and reach.

Overall, all of the data that we collect is so that we can continue to provide you with the best service possible. We do not transfer, sell, or otherwise use any personal data for any reason other than to provide our services.  

Data We Collect 

We may collect data that is requested directly in support of our website: 

  • WhatsApp phone number (used as the only identifier). Any additional personal data under your WhatsApp phone number is not collected by us and is managed by Meta under their Whatsapp’s own privacy policy such as “profile name, photo, and device information.”  
  • Interaction data (e.g., which topics users access, buttons and links clicked, topic modules completion rates, time spent) 
  • Learning progress (e.g., completed topic modules, user responses to reflection, learning, and feedback prompts) 
  • Contextual information that users choose to share, such as: 
  • Location (e.g., city and state) 
  • Preferred language 
  • AI completions and assistant mode interactions may be stored temporarily for performance optimization and are not used for training.  
  • Chat logs are retained on our secure builder platform and may include structured and unstructured user messages. Chat logs include free-text AI inputs, which may contain sensitive data that users voluntarily disclose. This data is not intended to be shared and is filtered post-hoc. These logs are used strictly for:
    • Monitoring and evaluating chatbot performance 
    • Content quality assurance and relevance to ensure that the chatbot is accurate, helpful, and meets quality standards. 
    • AI red-flagging to detect inappropriate, harmful, or policy-violating content 

Access to logs is restricted to authorized IRC team members and approved third-party contractors and vendors under contractual agreements. We do not track users outside the chatbot or use third-party trackers or ad tools. We do not integrate third-party trackers, pixels, or metadata collection systems into the chatbot flow. 

We may collect, process and store the following personal data that is available through your device when using Giannis: 

  • Personal data of individuals who send us a message through one of our communication channels WhatsApp for the purpose of facilitating access to humanitarian assistance. This information will be provided by you, and may include information on racial or ethnic origin, religious beliefs, health information, sexual orientation, or data from a known child. 
  • Name, e-mail, phone number, system IP address, and/or any sensitive information shared by a person. 

We may also collect user information provided by third parties, such as: 

  • Pre-aggregated user data collected by third parties (including Meta and Google) for the purposes of data analytics and insights. This information is only available in an anonymized format, meaning it is not data that we can link with the identity of a user.
  • User demographic and activity data (for example age, gender, city, country, language, engagement time, session source).  

Use of AI and Content 

We do not train or fine-tune our AI models on user data. However, our website, in particular through Giannis, uses securely stored user profiles and context injection techniques throughout our flow builder platform to improve the quality of responses during each session. This means the Giannis chatbot remembers key details you’ve previously shared, such as your learning goals on a specific topic, so it can offer personalized, relevant support and pick up where you left off in your last conversation. 

The core content used in our website, such as training modules, fact sheets, reports, videos, guidelines and prompts, is developed and curated by IRC, based on developed content produced and distributed by IRC. Large Language Models (LLMs) are used to support delivery and contextualization, but they do not generate core content and operate under safety protocols. In addition to delivering structured IRC-designed content, our website, and in particular Giannis, uses LLMs to generate personalized responses to the user’s questions, guide reflective exercises, and adapt tone and content based on user profile data under strict safety constraints. 

Data Storage  

We store personal information about you on computer systems operated by us or our service providers. We keep various records that contain personal information in accordance with applicable regulations, or pursuant to contractual obligations. In general, we aim to keep personal information only for as long as necessary and only for the reason(s) we collected it. It may be necessary to keep personal information longer than we otherwise would for legal or regulatory reasons, including litigation. To support us in managing how long we hold personal information and our record management, we maintain a data retention policy which includes clear guidelines on retention and deletion. 

The same personal information about you may be included in more than one record and used for more than one purpose, each of which may be subject to different retention periods based on the factors listed above. 

Third Party Processing

Our website uses technology tools including a number of third-party vendors who process personal data on our behalf. We have a contractual relationship with each vendor that obligates them to protect your data. For example, backend database storage, hosting, customer support are provided by other companies. 

For example, we use OpenAI, Google, & Anthropic to provide the LLMs based features by processing your queries through our website interface. We ensure that, by default, this data is not used for training their models unless you explicitly opt-in. Data is encrypted both in transit and at rest. Most data is stored for a limited time for abuse monitoring or security purposes. For example, OpenAI retains data for abuse monitoring for up to 30 days. We also use a zero data retention policy where available.

Data Sharing, Disclosure, Legal Basis

We will share your data with staff of the IRC network only on a need-to-know basis.  Other than third-party processors as mentioned above, we will only share your data with an outside organization, if you give us permission to do so. 

We may also share your information as part of a business transfer (i.e. we are or may be acquired by or merged with another organization, including a non-profit or a for-profit entity, or substantially all of our assets are transferred to another organization, or as part of a bankruptcy proceeding), in response to a legal process, or to protect us or others.  

The legal basis for the processing of personal data for our website is legitimate interests in that such processing is necessary to provide you with information to enable you to access resources, understand your rights, and make informed decisions. Responsive information initiatives, aligned with human rights and humanitarian principles, are undertaken to counter disinformation and misinformation. This form of charitable work aims to safeguard essential human rights that can be compromised due to the dissemination of false information, such as the Right to Security of Person, Non-Discrimination, Right to Health, and Freedom of Expression. 

Data Security  

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, or alteration. Please note that no data security method is always effective. These may include: 

  • Encryption; 
  • Access controls (role-based access control, multi-factor authentication);  
  • Data storage within the European Union; 
  • Risk assessments to identify potential vulnerabilities and threats to data;  
  • Employee training and awareness; 
  • Secure Network Configurations (firewalls) 

Unfortunately, the transmission of information via the internet is not completely secure. Although we try to protect your personal information, we cannot guarantee the security of your personal information transmitted to our website. 

Your Rights 

We understand that by providing us with your personal data, you are trusting us to take good care of it and to respect your rights concerning that data. Your rights are as follows: 

  • Access: Depending on your jurisdiction, you may ask us whether we process any personal data that relates to you. If this is the case, subject to certain conditions, you may ask us to provide you with a copy of the data. Depending on your jurisdiction, you may also have the right to:
    • Know and request information about the categories and specific pieces of Personal Information we have collected about you, as well as the categories of sources from which such information is collected, the purpose for collecting such information, and the categories of third parties, or specific third parties, depending on your jurisdiction, to whom we share such information, as well as the categories of Personal Information shared.  
    • Know if we have sold or disclosed your Personal Information, including the categories of third parties, or specific third parties, to whom we have sold Personal Information and the categories of the Personal Information sold.
    • Access any inferences derived from your Personal Information.
    • Know whether we use or sell your Personal Information for the purpose of training large language models.
  •  Rectification: You may ask us to correct or update any inaccurate or incomplete personal data we process about you. 
  • Erasure: You may ask us to erase the personal data that relates to you if they are no longer necessary for the purposes for which we processed it, if you have withdrawn your consent and we do not have another legal ground for processing your data, or if your personal data has been unlawfully processed. We may not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect. We may delete the contested personal information as an alternative to correcting the information if the deletion of the personal information does not negatively impact you, or you consent to the deletion. 
  • Restriction: Subject to certain conditions, you may request the restriction of the processing of your personal data if you have contested its accuracy, if the processing is unlawful and you prefer restriction over erasure, if we no longer need your personal data for a purpose but you need them for the establishment, exercise, or defense of legal claims, or while your exercised right to object is being reviewed. You may also have the right to limit the use and disclosure of sensitive personal information. Because we do not use or disclosure your sensitive personal information, we do not offer this option. You may also have the right to not have your sensitive personal information, or the sensitive personal information of a known child, processed unless you have provided consent.  
  • Objection to processing: You may object to our processing of your personal data based on our legitimate interest. You may also ask us to erase your personal data, unless there is an overriding legitimate interest for the processing. You have the right to withdraw your consent to any processing for which you have previously given that consent. 
  • Data portability: You may request receipt or transmission to another organization of your personal data in a commonly used machine-readable format. 
  • Withdraw consent: You may withdraw your consent to the processing of your personal data at any time.    

Data solely retained for data backup or archive purposes is principally excluded from these rights until it is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose. 

We do not discriminate against you if you choose to exercise any of these rights. 

You may also be entitled to request in writing a list of the types of personal information that we have disclosed to a third party for their direct marketing purposes during the preceding year and to whom that information was disclosed. 

In addition, you may have the right to opt-out of sharing of personal information, targeted advertising, and profiling in furtherance of solely automated decisions that produce legal effects. We currently do not sell personal information to third parties and we do not share your information for purposes of targeted advertising or engage in profiling, therefore we do not offer this option. Should you wish to change your preferences, please contact us.  

You may also have the right to limit use and disclosure of sensitive personal data or consent to processing of your sensitive data before said processing takes place; but because we do not collect any sensitive personal data we do not offer this option.  

These rights do not apply to pseudonymous data if the information necessary to identify the consumer is kept separately and is subject to controls that prevent access to the information. Pseudonymous data is personal data that can no longer be attributed to a specific individual without the use of additional information, if the additional information is kept separately and is subject measures to ensure that personal data is not attributed to the specific individual.  

Please note that depending on your jurisdiction, we are only obligated to respond, free of cost, to personal information requests. Depending on your jurisdiction, after you have exceeded the applicable number of requests, if the request is manifestly unfounded or excessive, or if you request additional copies of your data, we reserve the right to charge a reasonable fee to fulfill your request. In addition, to the extent the applicable state privacy laws apply, and for the protection of your personal information, we may be limited in what personal information we can disclose. 

We will maintain all of your Consumer Data Rights requests for at least 2 years. This information will not be used for any other purpose except to review compliance processes; it will not be shared except as necessary to comply with a legal obligation. Sensitive data which we no longer have consent to process will be deleted and rendered permanently anonymized or inaccessible within a reasonable period a time after withdrawal of consent.  

Exercising Your Rights 

  • To exercise any of your rights, contact us via the details provided below.  
  • Lodging a complaint: If you feel that we are not treating your personal data properly or as stated in this privacy notice, you are also entitled to lodge a complaint at data.privacy@rescue.org or antitraffickingresponse@rescue.org.  

We must verify your identity before fulfilling your personal information request. To verify your identity, we will collect information from you, including your name and contact information, to match this information against information we have previously collected about you. Information collected for purposes of verifying your request will only be used for verification and to respond to your personal information request. 

If we are unable to verify your identity as part of your request, we will not be able to satisfy your request. We are not obligated to collect additional information in order to enable you to verify your identity. For deletion requests, you will be required to submit a verifiable request for deletion and then confirm separately that you want personal information about you deleted. 

If you would like to appoint an authorized agent to make a request on your behalf, we require you to verify your identity with us and/or confirm that you have provided the agent with your permission to submit the request on your behalf directly before we provide any requested information to your approved agent. Alternatively, your authorized agent may provide evidence of having power of attorney or acting as a conservator for you, in which case we will not contact you directly.  

There may be circumstances where we will not be able to honor your request. For example, if you request deletion, we may need to retain certain personal information to comply with our legal obligations or other permitted purposes. We will notify you if we are unable to honor your request. You have the right to appeal our decision with regard to your request. Depending on your jurisdiction, you may have the right to contact your state Attorney General to submit a complaint if you have concerns about the result of the appeal.  

Children and Minors 

Where possible, the IRC does not knowingly ask children ages 13 and under for any information without parental consent. Visitors 13 and under should ask their parent or legal guardian for assistance and should not submit any personally identifiable information to the IRC. We may, however, collect information about a known child from the child’s parent or guardian, as outlined above.  

If we learn we have collected or received personal information from a child under the age of 13, we will promptly delete the information. If you believe that we might have any information from or about a child, please contact us via the methods listed below in the “Contact Us” section at the bottom of this Privacy Policy. This does not apply in instances where IRC provides services to unaccompanied youth. In that case, IRC may collect and share the information described above in accordance with this policy. 

Do Not Track 

Currently our systems do not recognize browser ‘do-not-track’ requests. While IRC does not recognize Do-Not-Track signals, do-not-track requests may be sent to data-requests@signpost-global.zendesk.com if Giannis AI is contacted by Whatsapp. 

Contact Us  

If you have any questions, concerns, or requests regarding your personal data or the information contained in this Privacy Policy, please contact us at data-requests@signpost-global.zendesk.com. You may also contact our Data Privacy team at Data.Privacy@rescue.org and antitraffickingresponse@rescue.org.