This privacy notice explains how Lancaster University processes personal data when users access Safe AI at Lancaster (SAIL), the University’s secure artificial intelligence environment. It describes what information is processed, why it is processed, how long it is stored, the lawful basis for processing, and the rights of users.
SAIL does not request personal or sensitive data. Users are strongly advised not to include special category data or information they would not normally share in a professional or academic setting. However, because SAIL accepts free text prompts, users may choose to include their own personal or sensitive data at their discretion.
If such data is provided, it will be processed securely and only for the purpose of generating the response requested by the user. It is not used to train artificial intelligence models and is not retained after the standard session retention period.
The types of data that may be processed include:
SAIL does not automatically access student records or other University systems.
Special category data includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, genetic or biometric identifiers, or other sensitive categories.
The University does not encourage users to provide this information. If users choose to include special category data in their prompts, it will be processed only to fulfil the specific user request and will be deleted automatically after the retention period. It is encrypted, not used for training, and not used for profiling or automated decision making.
SAIL processes data to allow users to:
Data is also processed for governance, security, auditing, and misuse detection.
SAIL does not make automated decisions that have legal or significant effects on individuals.
The lawful basis for processing personal data in SAIL is Legitimate Interest.
The University has assessed that providing a secure, centrally governed environment for artificial intelligence use is in the legitimate interests of both the University and users. A balancing test confirms that these interests are not overridden by the rights and freedoms of users.
Users may object to processing based on legitimate interest.
Prompts and files submitted to SAIL are sent to approved artificial intelligence models for the sole purpose of generating a response. These models operate under no training and no logging conditions. This means:
All data is encrypted in transit and at rest.
SAIL retains prompt and response history for up to 30 days. This is to support the user experience and allow users to revisit recent interactions. After 30 days all session data is automatically deleted.
Uploaded files, where enabled, are deleted immediately after processing.
The University does not retain conversations for model training or long-term analytics.
Users are responsible for the content they choose to upload or enter into SAIL. Users should avoid including unnecessary personal or sensitive data unless it is required for the task they wish SAIL to perform.
SAIL may produce inaccurate or incomplete responses. Users must review outputs carefully and should not rely on SAIL as a substitute for professional, academic, legal, or medical advice.
Users have the following rights:
You can view your chat history and uploaded content directly within SAIL. This provides direct access to the personal data you have entered.
SAIL does not store institutional personal data beyond what you supply yourself, for example text you type, files you upload or preferences you set. Because SAIL does not alter or enrich your data, this right does not generally apply within SAIL.
This right may apply in specific cases. SAIL automatically deletes session data after 30 days. Where additional erasure is requested, it will be assessed against the university’s legal obligations and any legitimate reasons to retain the data.
Since SAIL processes only the data you choose to input, you can self-manage this right by choosing what to enter. In certain circumstances individuals can exercise their rights to ‘block’ or suppress processing of their personal data.
This right applies to data processed under consent or legitimate interest. SAIL processes data under the university’s contractual and operational requirements for providing digital services, so data portability does not apply.
This right does not apply because SAIL operates under the legal basis of providing a university service that forms part of your digital account provision.
SAIL provides clear notices about data retention, privacy protections and PII detection to support responsible use.
You may contact the University Data Protection Officer if you have concerns about how your data is handled within SAIL.
Lancaster University’s designated Data Protection Officer is:
Mike Abbotts, Information Governance Manager
Email: information-governance@lancaster.ac.uk
Contact Mike if you have any concerns or complaints about this Notice or about the way your personal data is being used. You also have the right to complain to the Information Commissioner’s Office (ICO). Details of how to raise a complaint can be found on the ICO website.
Not all of the above rights are absolute and some may only apply in specific circumstances. For further information on your rights, please visit this webpage.
We may change this privacy policy as the service for SAIL or Data Protection legislation changes.
