Privacy Policy
The Record Institute — Archive of Rare Historical Artifacts Last revised: April 2026
1. Overview
The Record Institute (TRI) operates therecord.institute as a non-profit digital archive and research museum. This Privacy Policy describes the limited categories of personal information we collect, how we use it, and the rights available to visitors under applicable data protection laws — including the European Union General Data Protection Regulation (GDPR), the United Kingdom Data Protection Act, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
We collect the minimum information necessary to operate the archive, communicate with our readers, and improve the visitor experience. We do not sell personal information. We do not host advertising. We do not share data with brokers or marketing networks.
2. Information We Collect
The Record Institute collects three categories of information.
Email addresses — collected when a visitor voluntarily submits a contact form, requests information, or subscribes to editorial updates from the archive. Submission of an email address is always voluntary, and we collect only the address itself together with the message or subscription request that accompanies it.
Analytics data — collected automatically through Google Analytics 4 (GA4) when visitors browse the archive. GA4 records information including IP address, browser type and version, device type, operating system, referring URL, pages viewed, time spent on each page, and approximate geographic location derived from IP. We use IP-anonymization features where available. We do not use GA4 to build advertising profiles.
Language preference cookies — a single cookie storing the visitor's selected interface language (English, Thai, Japanese, French, Spanish, Chinese Simplified, or Korean) so that the preference persists across visits. This cookie contains no personal identifier and is used solely for site functionality.
We do not operate user accounts, login systems, or membership databases. We do not collect names, addresses, telephone numbers, payment information, or government identifiers. We do not collect the special categories of personal data defined under GDPR Article 9.
3. How We Use Information
The information we collect is used for clearly defined purposes:
Email addresses are used solely to respond to the visitor's inquiry or to deliver the editorial updates the visitor has requested. Email addresses are never sold, rented, traded, or shared with third parties for marketing purposes.
Analytics data is used to understand how the archive is accessed, which artifacts and editorial entries draw scholarly and public interest, which languages are most frequently used, and how the archive performs across devices and regions. This information informs our editorial and conservation priorities.
Language preference cookies are used solely to deliver content in the visitor's chosen language on subsequent visits.
We do not use any of the information described above for automated decision-making or profiling within the meaning of GDPR Article 22.
4. Legal Basis for Processing (GDPR)
For visitors in the European Union, the United Kingdom, and other jurisdictions where GDPR-equivalent law applies, our legal bases for processing are:
Consent (Article 6(1)(a)) — for analytics cookies and email subscription, where consent is requested and may be withdrawn at any time.
Legitimate interest (Article 6(1)(f)) — for the operation, security, and improvement of the archive, and for responding to inquiries voluntarily submitted by visitors. We have assessed these interests against the rights and freedoms of visitors and consider them proportionate and minimally intrusive.
Necessity (Article 6(1)(b)) — for the technical operation of the language preference cookie, which is required to deliver the visitor's chosen language.
5. Cookies and Similar Technologies
The Record Institute uses two categories of cookies:
Strictly necessary cookies — including the language preference cookie described above. These are required for the basic operation of the site and are set without consent under standard GDPR and ePrivacy guidance.
Analytics cookies — set by Google Analytics 4 to support the analytics functions described in section 2. Where required by applicable law, these cookies are set only after the visitor provides consent through our cookie banner. Consent may be withdrawn at any time by clearing browser cookies or adjusting browser settings.
We do not use advertising cookies, social media tracking pixels, retargeting tags, or third-party marketing trackers.
6. Third-Party Services
Two external services receive limited data through the operation of the archive:
Google Analytics (Google LLC) — receives the analytics data described in section 2 for the purpose of providing usage analytics to The Record Institute. Google's processing of this data is governed by its own privacy policy, available at policies.google.com/privacy. Google may transfer data to the United States; transfers are governed by Google's Standard Contractual Clauses and applicable transfer mechanisms.
Email service provider — receives email addresses voluntarily submitted by visitors for the purpose of delivering responses or editorial updates. The provider acts as a data processor under our instructions and does not use the addresses for its own marketing purposes.
We do not share visitor data with any other third party except where required by law (for example, in response to a valid legal process), or where necessary to protect the rights, property, or safety of The Record Institute, its visitors, or the public.
7. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:
Email addresses submitted through contact forms are retained for the duration of the inquiry and for a reasonable period afterward to enable follow-up correspondence, then archived or deleted. Email addresses submitted for editorial updates are retained until the visitor unsubscribes.
Analytics data is retained according to the default GA4 retention settings, currently 14 months unless otherwise configured. Aggregate, non-identifying analytics summaries may be retained indefinitely for institutional reporting.
Language preference cookies are retained for up to one year on the visitor's device and may be cleared at any time through browser settings.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
Access — to request a copy of the personal information we hold about you. Rectification — to request correction of inaccurate or incomplete information. Erasure — to request deletion of personal information, subject to legal exceptions. Restriction — to request that we limit our processing of your information. Portability — to receive your information in a structured, machine-readable format. Objection — to object to processing based on legitimate interests. Withdrawal of consent — to withdraw consent for processing where consent is the legal basis.
California residents have additional rights under the CCPA/CPRA, including the right to know what personal information has been collected, the right to delete personal information, the right to correct inaccurate personal information, and the right to limit the use and disclosure of sensitive personal information. The Record Institute does not sell personal information and does not share personal information for cross-context behavioral advertising.
To exercise any of these rights, please contact us using the information in section 11. We will respond within the timeframes required by applicable law.
You also have the right to lodge a complaint with the data protection authority in your jurisdiction.
9. International Data Transfers
The Record Institute is based in the United States. Information collected through the archive is processed in the United States and, in the case of Google Analytics, may be processed in additional jurisdictions where Google operates. Where required by GDPR or equivalent law, transfers are governed by Standard Contractual Clauses and supplementary safeguards.
10. Children
The Record Institute is intended for a general audience. We do not knowingly collect personal information from children under the age of 16. If you believe a child has submitted personal information through the archive, please contact us so that the information can be removed.
11. Contact
For privacy inquiries, requests to exercise your rights, or questions about this policy, please contact:
The Record Institute Privacy Office Seattle, Washington, USA Email: [insert official contact email]
For matters relating to copyright, fair use, or DMCA, please refer to our Copyright & Conservation policy.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, in applicable law, or in the services we use. Material changes will be noted at the top of this page with the revised date. The current version is always available at therecord.institute/privacy.
The Record Institute · Seattle, Washington, USA · Established 2026