LATEST THINKING Privacy Policy

Version 1.0, effective 2026-10-13

This Policy covers lt.org, our content services, including educational content, the LATEST THINKING researcher app, and enquiries to LT. It applies to website visitors, app researchers, authors, speakers and other contributors. LT Publication and LT Researcher Portrait are app-created videos; LT Publication Plus is manually produced. These products and other formats can involve different data flows. We explain those differences below.

1. Who is responsible

Latest Thinking GmbH, Am Feenteich 4, 22085 Hamburg, Germany, is the controller for the processing described here. Contact [email protected] or write to this address. The LT team handles privacy and content-rights requests, under the current responsibility of Pajam Sobhani as LT Rights and Privacy Lead.

The EU General Data Protection Regulation (GDPR) is our central data protection framework. This Policy explains processing; it does not seek blanket consent. A video licence, including CC BY 4.0, does not remove your statutory data protection rights.

2. Information we use and its sources

Website visits generate technical request information, such as IP address, time, requested page, status, browser or device information and referring page. Video players and forms receive additional information when you use them. You do not need a researcher account merely to browse public content.

App account and profile information includes name, email, sign-in details, ORCID iD, biography, research interests, affiliations, website or social links, and profile photo. When you connect ORCID, LT receives and stores the full public record returned by ORCID. Publication information comes from you, ORCID and OpenAlex and includes titles, authors, DOIs, years and languages.

App production information includes your image and voice, chapter recordings, cover images, teleprompter scripts, titles, cited works, approval status and feedback. Processing creates transcripts, subtitles, content-check results and supporting texts. Necessary registration and production information is needed to provide those features; additional biography and social links are optional. Self-service app creation is for adults aged 18 or over.

For manually arranged productions, information includes contact and scheduling correspondence, the contributor’s name and professional description, research and publication details, image and voice recordings, supplied materials, edits, approvals and rights documentation. Sources include the contributor and, where involved, the commissioning organisation, production team and public research sources. The precise material depends on the project and participation notice.

Enquiries, support and rights requests contain contact details, messages and related correspondence. Please avoid sending unnecessary confidential information or sensitive personal information about other people. If a production requires such information, it needs a specific lawful arrangement; a general content licence does not supply one.

3. Why we process data

We use necessary account, publication and recording data to provide the services agreed with you, including sign-in, publication searches, production, review and publication of approved content. Article 6(1)(b) GDPR applies where processing is necessary to perform our agreement with you or take requested steps before it. An agreement solely with your institution is not automatically an agreement with you.

Technical operation, proportionate security, abuse prevention and general enquiries rely on Article 6(1)(f), our legitimate interests in running a secure, reliable service and responding to requests. For professional contacts introduced by an institution, our interest is arranging and administering the relevant production; this does not automatically authorise publication of that person’s image or voice. Support necessary to perform your agreement also falls under Article 6(1)(b).

Communicating approved research, promoting it and maintaining accurate scholarly records can rely on Article 6(1)(f), subject to balancing these interests against your rights. The scholarly-record purpose can apply to LT Publication videos and LT Publication Plus; it does not automatically apply to profile videos, interviews or podcasts. You may object as explained in section 11.

Where a specific legal obligation requires processing, Article 6(1)(c) applies. Where consent is needed, Article 6(1)(a) applies and consent must be obtained separately; it can be withdrawn. For a manually arranged contribution, its participation notice identifies the applicable publication basis and any consent requested. Signing a rights licence is not blanket GDPR consent.

4. Website delivery, analytics and video players

Hosting and delivery services process request data to load pages, deliver media and protect the website. Our services use Hetzner and Cloudflare as described in section 8. Information sent with a request is not necessarily anonymous simply because the visitor has no account.

We use Umami Cloud (https://umami.is), the hosted analytics service of Umami Software, Inc., to understand visits to lt.org and improve the website. Analytics include pages viewed, referring pages, visits and their duration, browser, operating system, device type and approximate location. LT’s website is assigned to the EU analytics region. Our current setup does not include Umami session recordings or heatmaps. The use of Umami does not itself mean that every website data flow is anonymous or that no consent is required.

Audience measurement requires an appropriate GDPR basis. Consent under Article 6(1)(a) applies where required; Article 6(1)(f) can support proportionate measurement only where its conditions are met. Rules on storing or reading information on your device apply separately. This notice does not itself give consent or establish an exemption for a particular analytics or player setting.

Playing a Vimeo embed sends Vimeo visitor information such as IP address, browser or device details, the referring page and requested video. Vimeo is used for LT promotional material on relevant pages. Delivery of new app-created researcher videos uses LT’s media infrastructure. The provider used for a particular existing item depends on its player; the app production flow should not be assumed to describe every older page.

Necessary delivery is assessed against the legitimate interests described above. Optional tracking or device access may require separate consent, including when associated with an embedded player. Ordinary links to external websites do not themselves give those websites the information held in your LT account; when you follow a link, the destination processes your visit under its own policy.

5. Automated app production and AI

App speech is transcribed on LT’s processing server using Whisper. Technical editing also takes place there. Anthropic’s Claude receives the transcript, chapter names and cited-publication details for content checks, English subtitle translation and supporting outputs such as summaries, concepts and research-field suggestions. This flow does not send the recording, audio, cover or a separate account identifier to Claude. Transcripts and publication information can still identify people.

An automated content check assesses the contribution and can issue a warning or reject it, stopping further processing. AI may be inaccurate. You can explain your position, contest a result and request human review at [email protected]. Formal publication of your video requires your approval and LT’s acceptance. Not every internally generated text is displayed publicly.

Where LT displays AI context information alongside or linked to a video, it is identified separately as AI-generated and potentially inaccurate. It can include summaries, keyword explanations and educational background based on the contribution, the underlying publication where relevant, and background knowledge. It is supplied by LT, not attributed to the researcher as their own statement or endorsement. LT may update it independently of the approved video. Publication and updates can process personal information contained in those sources; they remain subject to the purposes, applicable legal bases and rights explained in this Policy. Report errors or request correction at [email protected].

LT does not use submissions to train its own AI models. Model processing is distinct from model training. The app and LT’s server application do not currently use a separate analytics or error-tracking service; external technical and diagnostic flows described below still occur.

6. Manual productions and other formats

LT Publication Plus and other manually produced contributions, including educational content, involve recording and human editing under the relevant production arrangement. LT uses the material to prepare the agreed output, organise review, record permissions and publish and distribute the authorised version. Those purposes do not automatically authorise processing of every unused recording indefinitely.

The automated app workflow, its AI recipients and its deletion clocks do not apply to a manual production merely because the result appears on lt.org. A project-specific participation notice supplements this Policy where a production involves additional recipients, tools or retention arrangements. This Policy does not by itself authorise sending older recordings to a new AI provider.

7. Who can see content and account information

Researchers can access their own app accounts and works. LT staff with administrative access can access researcher data and recordings and can open a researcher account to work on it. This capability includes private submissions, not only diagnostic information. For manual projects, production personnel involved in the arrangement may receive recordings and review material needed for their role.

In the current app flow, finished videos, posters and subtitles are accessible without signing in to anyone with their exact media link, including before approval. Rejected and unpublished processed files remain accessible unless separately removed. Profile photos are also stored at publicly accessible addresses. An obscure link is not private access protection. This description is specific to the app flow, not a claim about every manual project’s preview system.

Published content and associated attribution can be seen worldwide, indexed and shared. Depending on the format, pages show a name, professional description, video or audio, cover, title, chapters, subtitles and publication details. App information supplied to the website can also include ORCID and OpenAlex identifiers and biographies; not all supplied fields are displayed.

LT Publication Plus is released under CC BY 4.0 and may be copied and adapted by others under that licence. LT Publication, LT Researcher Portrait and other formats use the Standard LT License, subject to valid earlier or specific licences. It permits the defined personal uses and requires an LT agreement for institutional embedding or republication. The Terms and Conditions explain these permissions. Copyright licences do not remove data protection rights. If LT distributes approved content on LinkedIn or another social platform, that platform receives the published material and processes viewing and interactions under its own policy.

8. Service providers and other recipients

Hetzner hosts LT’s app account and profile data, raw recordings, photos, processing files and results, and backups in Germany. Cloudflare stores and delivers finished app media and provides website and network services. Its global network also receives IP addresses and normal request information when the app checks its internet connection.

Anthropic receives the text and publication information described in section 5. Amazon’s email service receives recipient addresses and message content for sign-in and confirmation messages; LT uses its Frankfurt region.

ORCID handles authentication and supplies the public ORCID record. OpenAlex receives ORCID iDs, publication-search text and DOIs to find works. Formspree receives support, contact and deletion form submissions, including contact details, messages and any consent field submitted with a form.

Google’s face-detection library supports recording composition on the phone. Images, video and face-detection results are not sent to Google in this flow. Google receives device and app details, an installation identifier and diagnostics such as performance, image format and resolution, events and errors. These identifiers are not treated as anonymous solely because they omit your name.

Umami Software, Inc. receives and hosts website analytics data through Umami Cloud for the measurement described in section 4. Vimeo supports the embedded-video functions described there. Apple and Google operate app distribution and their own store services; distribution does not add a researcher-usage feed from the LT app. Any Google library diagnostics are the separate flow described above.

Production personnel, editors and technical providers for manually arranged projects are identified by their involvement and, where needed, the project notice. An institutional commission does not itself give an organisation access to an app researcher’s private drafts or account. We may also disclose necessary information where required by law or for establishing, exercising or defending a concrete legal claim.

9. Processing locations and international access

The app’s main hosting and processing systems are in Germany. Cloudflare finished-media storage has a Western Europe location preference, while its delivery network is global. Amazon transactional email uses Frankfurt. Anthropic processes the information described in section 5 through its entity in the European Union, and any transfer of that information outside the European Economic Area takes place under the EU adequacy decision. EU storage for one service does not mean all providers, support access or international delivery remain within the European Economic Area.

Some service providers operate internationally, including Vimeo and Umami Software, Inc., which are based in the United States. LT uses the EU analytics region of Umami Cloud. This regional assignment does not itself guarantee that all provider administration, support or subprocessors operate exclusively in the EEA. International transfers require the applicable GDPR conditions, such as a relevant adequacy decision or appropriate contractual safeguards. Contact [email protected] for information about the safeguards and how to obtain a copy. This Policy does not claim that an EU location preference supplies those safeguards.

10. Retention, deletion and published records

We must limit retention to an applicable purpose and legal basis. Relevant criteria include completing a requested production or enquiry, maintaining lawful published content and attribution, meeting a specific legal obligation, and retaining necessary evidence for a concrete claim. A copyright licence, technical setting or absence of automatic deletion is not an unlimited right to keep personal data.

For the current app, account details remain while the account is active unless removed earlier. In-app account deletion removes access, account identifiers and profile details, including the stored ORCID record. Raw recordings, scripts and covers for unpublished works and the profile photo are removed from live storage shortly afterwards. Local app content is cleared when the app signs out.

Deleting or canceling an individual app work schedules its raw recordings, scripts and cover for removal after 30 days. Canceled works can be restored during that period. This does not remove all processed outputs. Uploaded recordings on the phone are cleared 30 days after upload; unuploaded recordings remain until removed, sign-out, account deletion, uninstall or device cleanup, subject to device behavior.

Published app videos and attribution, including the author’s name and ORCID iD, remain after account deletion. This includes published LT Researcher Portrait videos. Finished files from processed unpublished works, transcripts, generated texts and deletion records also remain. These items and app server logs currently have no fixed deletion period. Account closure alone does not deactivate every media link. You can request further removal or restriction; a scholarly-record rationale does not automatically justify retaining a profile video.

Deleted app data can remain in production backups for approximately eight weeks. Cached finished media can persist for up to a year. Temporary processing working files are removed after each job; that does not remove stored transcripts or other processing results.

Raw recordings from manually arranged productions are stored on secured LT servers, with access by LT employees, and deleted three months after publication of the finished contribution. This is separate from the app’s recording and deletion arrangements. Published LT Publication Plus and other authorised catalogue content may remain available for their continuing publication purpose, subject to applicable rights. Editing projects, rights documentation, correspondence and material from productions that are not published require retention suited to their own purpose; the post-publication rule does not create an indefinite right to retain them.

Our current Umami Cloud plan provides a two-year retention period for website analytics. Other website technical records and form correspondence require periods suited to security and resolving the enquiry; they are not governed by the app account’s lifetime. Fully anonymised statistics cease to be personal data only when individuals can no longer be identified. Contact LT about information held on a particular visit, enquiry or production.

If you no longer have the app, use the website deletion form or [email protected]. A form submission requires human follow-up and does not itself perform the in-app deletion. We verify the request and arrange handling of removal or lawful retention. This route also covers published content, manual productions and publicly accessible links.

11. Your rights and how to use them

Subject to applicable conditions, you may request access and a copy, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

You may contest an automated rejection and request human review. GDPR protections against solely automated decisions with legal or similarly significant effects remain available where applicable. Contact [email protected]; an active app account or a paid service is not required.

We respond without undue delay and normally within one month. If a permitted extension is needed for complex or numerous requests, we explain it within the first month. Requests are normally free. We may request proportionate identity verification. If we cannot grant a request, we explain why and the available options.

You may complain to a competent data protection authority, including where you live or work, and seek a judicial remedy. LT’s local authority is the Hamburg Commissioner for Data Protection and Freedom of Information: https://datenschutz-hamburg.de.

12. Updates

We update this Policy when processing changes and provide information where required before a new purpose or recipient is introduced. A new content format does not automatically authorise new data uses. Updating this notice does not itself create consent. The published Policy shows its version and effective date.