Privacy and data processing

aipoc-lab is a private, non-commercial research project. It collects publicly available publications on artificial intelligence in order to study the development of this field. The collected materials incidentally contain personal data — most often the names of authors of research papers. This page says what data, from where, for what purpose, and what you can do about it.

Last updated: 9 October 2026

Who processes the data

The data controller is a natural person running the aipoc-lab project — a non-commercial research project. For all matters concerning data processing, contact: [email protected]. Further information identifying the controller is provided to the person whose data is concerned and to the supervisory authority, to the extent required by law.

Why you learn about this from this page, and not from a message addressed to you

Because the project does not know who you are, and does not want to find out. The data does not come from the people it concerns — it arrives as part of a publicly available publication, for example the list of authors of a scientific article. To send each of these people a separate notification, one would first have to establish their address, that is, collect additional data about them that the project does not have and does not intend to have. The GDPR knows such a case: where notifying each person individually is impossible or would require disproportionate effort, the information may instead be made publicly available, with appropriate measures to protect these persons' rights (Article 14(5)(b) GDPR). The project relies on this exception — this page is that information, and its later sections describe the protective measures.

What data, and from which sources

All sources are publicly available without logging in. The project does not download anything from services that require an account, does not bypass security measures, and does not use sources that object to collection in a robots.txt file.

Materials are downloaded by an automated process once a day, from the project's server. Where a publisher publishes an RSS feed — a stream intended for machine reading — the process reads only that feed. Where there is no feed, it downloads the public page with a list of entries (and, in the case of darioamodei.com, also the pages of individual texts) — several requests a day per publisher, just as a reader's browser would make them. For the few items a day selected for the review, when a publisher's feed contains only a teaser, the process also downloads the article's own page and saves its text — after removing email addresses and phone numbers with the same filter as for other materials. The project does not search sites outside this list.

Purpose and legal basis

Purpose: private research into the development of artificial intelligence, and into the method of building an automated research chain itself — from collecting publications, through evaluating them, to writing overviews. The outcome is overviews and analyses published on this blog, always in aggregated form.

Legal basis: Article 6(1)(f) GDPR — the legitimate interest of the controller, namely conducting the research. The processing is of a research nature within the meaning of Article 5(1)(b) and (e) GDPR, with the safeguards required by Article 89(1) GDPR.

What the project does not do: it does not sell or share the data collected, does not build a contact database, does not conduct marketing, does not contact the people whose data appears in the materials, and does not profile anyone. The only party outside the project that receives the collected materials is the provider of language models, described below.

Who the project passes the materials to

Text processing is carried out by Google Gemini language models, called through Google's programming interface (Gemini API). Google receives fragments of the collected materials and returns the result. The project uses the free plan of the Gemini API, and under this plan Google may use submitted content to improve its services — therefore only materials already published by their authors reach the models. Google receives:

• every downloaded material — the title and the beginning of the content, so that the model can summarize it in two to three sentences and assign it to a category and to topics from a fixed dictionary;
• the titles, summaries and labels of materials, and the content of drafts and analyses — to compute vectors (the gemini-embedding-2 model), that is, a numerical representation of text, thanks to which the lab finds texts with similar content;
• materials selected for the review and the lab's notes — to write reviews, concept notes and weekly analyses, and to compare a finished text with its source;
• published entries — to be translated into other languages.

Email addresses and phone numbers are removed before a material is sent to the model, not only when it is saved to the database. Data of the blog's readers and messages sent to the contact addresses do not go to Google.

How the scope of data is limited

• Filter at write time — email addresses and phone numbers are replaced with a placeholder before a material enters the database and before it is passed on for analysis.
• Only what is already in the publication — the project saves the title, summary, content and source address. It does not establish the identities of authors, does not link their appearances across different publications, and does not build anyone's profile.
• Only aggregated content is published — the blog shows overviews and statistics, never copies of source materials or records concerning individual persons. The authors of cited papers appear only in the Sources section, as in a bibliography.
• No special category data — the project does not collect, and does not want to collect, data about health, opinions, religion or orientation.

How long

Research materials are kept for as long as the research lasts — the point of this project is to observe changes over time, which cannot be reconstructed afterwards. Raw downloads have their contact details cleared immediately, and those that are no longer needed are deleted. Data deleted on request does not come back.

Your rights

You have the right of access to your data, the right to have it rectified, erased and restricted, and the right to object to processing based on legitimate interest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Requests are accepted at [email protected]. For a request to be carried out, it is necessary to indicate where the data is located — for example, the address of the page from which it was downloaded. The project does not keep data that would allow a person to be identified in any other way, and will not collect it for this purpose (Article 11 GDPR).

Deletion means permanently clearing the content; the database keeps only a trace that the given material existed and has been deleted, without its content.

This website

The blog does not collect data about its readers: there is no tracking, there are no forms, and there are no cookies beyond those that support logging in to the editorial panel. Like every web server, the server and the attack-protection provider (Cloudflare) process visitors' IP addresses in technical logs — solely for security and for the proper functioning of the site.

Page view measurement. From 24 September 2026, the blog uses Cloudflare Web Analytics. The measurement script is added to the page by Cloudflare itself. It does not store cookies or anything else in the browser and does not assign identifiers to visitors, so it cannot be used to recognize the same person on a later visit. The project sees only aggregate figures: how many page views and visits there were, which pages they concerned, where readers came from (country, referring site), which browsers and devices they used, and how quickly the page loaded.

Content on the blog is produced with the involvement of language models, and a human decides whether it is published. A description of the method is on the How it works page.