CapFORGE Privacy Notice (interim, version 1)

This interim notice was prepared by the engineering team and is pending review by the Legal department.

In short. CapFORGE holds your account details, records what you do in the tool, and keeps the content you and your colleagues write and upload. It uses an AI model that runs inside the NATO environment. It does not record audio or video, does not send anything to external services, and does not use analytics or advertising.

Who is responsible. [Name of the NATO body operating CapFORGE]. Questions and requests about personal data: [Data Protection focal point contact].

What is collected and why.

• Account details: username, display name, optional email address and a one-way hash of your password. Used to sign you in and to attribute your work.
• Sign-in events: successful and failed sign-ins, sign-outs and password changes, with the time and the network address of your device. Used for security.
• Your actions: every change, approval, export and administrative action is recorded against your account. Used for accountability; reading across programmes is permitted and relies on this record.
• Content you write: comments, notes, section text and approvals, attributed to you. This is the work itself.
• AI quality assessment: if you take part in blinded judging of AI output, your judgements and reasoning are recorded against your account.
• Diagnostics: when the tool encounters an error, the entry may include your username and the page you were using.
• Access logs: the web server records the network address, page and time of each request.
• Your confirmation of these notices: which version you agreed to or declined, when, and from which network address and browser.

What is not collected. No audio or video recordings, no transcripts, no location, no device fingerprinting, no analytics or advertising identifiers.

AI processing. When you ask the tool to draft a section, relevant content from the document, its upstream documents, attachments and the reference corpus is assembled into a request for an AI model that runs on the same host, inside the NATO environment. The full request and the model's response are stored as the record of how the draft was produced. If uploaded documents or notes contain personal data about other people, that data may be included in those records and in the tool's search index. Text you type is separated from the model's instructions so that it cannot alter them. These notices are never part of any request to the model.

Where your data is kept and how it is protected. In one database on one host within the NATO environment. Uploaded files are stored inside the database. Backups are encrypted and taken daily, and the most recent thirty are kept. Every export carries a classification marking on every page. Access is by personal account and team permission, and all actions are recorded.

How long. [Retention periods to be confirmed by Legal and Security.] At present, content, records of actions and AI drafting records are kept for the life of the system; backups older than thirty days are deleted; diagnostic entries are capped. The working assumption for records of actions is one year in the live system and seven years in archive.

Your rights. You may ask to see or correct your account details, and to have your account deactivated, through an administrator or the focal point named above. Records of your actions are retained because the accountability trail must remain complete.

Cookies. CapFORGE sets one cookie to keep you signed in for up to 24 hours. It is not readable by scripts and is sent only over encrypted connections. No other cookies are set by the application.

Framework. This notice is issued under the NATO Personal Data Protection Framework Policy [reference to be supplied].