Privacy & Data Policy

Privacy & Data Policy

Last updated: 28 September 2026

Canonical document. Published at aifirstnation.org/privacy-policy; linked from across the ecosystem’s sites.

I run the AI-First Nation (AIFN) family of sites as a sole operator based in Singapore. This policy says what the sites collect, why, where it goes, and what you can make me do with it. It is written to describe what the sites actually do, not what a template says they might do.

1. Who is responsible

The data controller is Laurence Liew (sole operator), Singapore. For anything data-related (access, correction, deletion, questions), contact me through the contact form on any of these sites. For the purposes of Singapore’s Personal Data Protection Act (PDPA), I am also the data protection contact for these sites.

2. Which sites this document covers

The AIFN ecosystem has three kinds of sites:

Static sites (covered by this policy in full): these are generated as plain HTML, run on Cloudflare’s network, have no user accounts and no databases, and no server-side code beyond form handlers. They collect nothing unless you fill in a form.

• aifirstnation.org: the AI-First Nation book site and AIFN Insights essays
• airi.foundation: the AI Readiness Index framework
• ai4sme.org: AI for small and medium enterprises
• hokkien.me: the free course (What Has Hokkien Mee Got to Do With AI?): watch, read, or listen; lesson videos and audio are served from the site itself
• aiready.sg: the AI readiness home for working professionals; the free AI For Everyone course (watch, read, or listen) with progress kept in your own browser, and course videos and audio served from the site itself. The readiness assessments it points to run on airihub.io, which carries its own policy below

The application platform (own privacy policy): airihub.io: the AIRI assessment and editions platform. It runs accounts, assessments, an API and surveys, and collects what those need. It is not a static site and not covered by this policy; its own privacy notice at airihub.io/privacy-policy covers everything that happens there.

WordPress sites (own privacy notices): these have user accounts, plugins, analytics, and their own data collection. They are not covered by this policy beyond the links below.

• community.aifirstnation.org: the AIFN community (forums, member profiles). Its own privacy notice, published on that site, covers everything that happens there.

If you are unsure which kind of site you are on: if it has a login, an assessment, or a forum, it runs its own policy (airihub.io, community.aifirstnation.org). If it is articles, downloads, courses, and a newsletter sign-up, it is a static site covered here.

3. What the static sites collect

3.1 Browsing · essentially nothing

Four of the five static sites (aifirstnation.org, airi.foundation, hokkien.me, aiready.sg) run no analytics, no advertising, no social-media pixels, and set no cookies of their own. There is no consent banner because there is nothing to consent to. Fonts and assets are served from the sites themselves, not Google. Cloudflare, the content network these sites run on, processes request data (including IP addresses) as a service provider under its own privacy policy to serve pages and block abuse. ai4sme.org matches all of this except that it sets one functional access cookie of its own, a cookie that unlocks the full use-case library once you have completed the free AIRI assessment. It stores only a cryptographic hash of its code, never the code itself; the Cookie Statement carries the full table.

If we add measurement later, it will be the cookieless kind (such as Cloudflare Web Analytics, which stores no cookies and no personal data), and this page will say so on the day it goes live.

3.2 Newsletter and download sign-up

Three of the five static sites offer email sign-ups: the AIFN Insights newsletter and book download on aifirstnation.org, the framework download on airi.foundation, and the resource-guide download on ai4sme.org. hokkien.me and aiready.sg have no forms at all. If you use a sign-up:

• Collected: your first name, last name and email address. The consent checkbox must be ticked for the form to send; the tick is checked in your browser and is not itself transmitted or stored.
• Where it goes: the form posts to the site you are on, which forwards it to the central AIFN mailing list on our own infrastructure. It is not sold, shared, or used for anything else.
• Double opt-in: you receive a confirmation email first. Nothing is sent to you until you click it. That confirmation record is our proof you asked to be subscribed.
• Purpose and basis: sending you the newsletter and download links you asked for. Legal basis: your consent (under both GDPR and PDPA). Withdraw it any time via the unsubscribe link in every email, or by contacting me.
• Retention: until you unsubscribe; contacts inactive for around two years are pruned.

3.3 The emails we send

Our mailing system records whether an email we sent you was opened and which links in it were clicked, tied to your contact record. This is used to stop sending mail to dead addresses and to see which content is read.

Signed download links emailed to you are unique to you and expire after seven days.

3.4 Contact forms and spam screening

The static sites that have forms (aifirstnation.org, airi.foundation, ai4sme.org, hokkien.me) protect every form, contact and sign-up alike, with content screening:

• CleanTalk (a security service) receives the submitted email address, name, your IP address, browser type, roughly how long you took to fill the form, and the message itself, to judge whether the submission is spam. Spam verdicts are dropped silently. The sender sees the same confirmation either way.

Contact-form messages are relayed by our email provider to the site mailbox and answered by me.

3.5 Embedded video

Some Insights essays on aifirstnation.org embed YouTube videos behind a click-to-play panel. The preview image loads from Google’s image servers (i.ytimg.com) when you scroll to it; the video itself loads in Google’s privacy-enhanced embed (youtube-nocookie.com) only after you click play. From that point Google’s own terms and privacy policy apply to that interaction. hokkien.me’s lesson videos and audio, and aiready.sg’s course videos and audio, by contrast, are served from the sites themselves. No third party is involved in playing them.

4. No accounts on the static sites

The static sites have no logins, no profiles, no quizzes and no tracking of anything you read. Accounts exist only on airihub.io (assessments and editions), aiready.sg (courses) and community.aifirstnation.org (community), each governed by its own notice.

5. Children and young people

The ecosystem’s courses and community that use accounts (aiready.sg, community.aifirstnation.org) are intended for learners aged 16 and over. Under 16, a parent or guardian must enrol you and consent on your behalf; we do not accept sign-ups from anyone under 13. hokkien.me is the exception by design: a free course written for ages 8 to 80, with no sign-up, no accounts, and no tracking of any kind. Its only form is the contact form (section 3.4), which collects just what a reply needs; course progress is saved on your own device only (see the Cookie Statement). The static sites collect nothing from anyone, of any age, beyond what is described in section 3.

6. Where your data is processed

Service providers involved in the above: Cloudflare (site delivery and security; a US company participating in the EU–US Data Privacy Framework), SMTP2GO (email delivery, relays contact-form messages and the mailing list’s email to recipients), Fastmail (hosts the mailboxes that contact-form messages are delivered to), CleanTalk (spam screening for form submissions; receives only what is listed in 3.4), and Google (only if you load a YouTube panel in 3.5). The mailing list itself runs on AIFN’s own infrastructure. If any cross-border transfer mechanism these providers rely on is legally disturbed, I will suspend that flow rather than carry on unprotected.

7. Your rights

Wherever GDPR or the PDPA gives you rights over your data, you have them here: access (what I hold), correction, deletion, a copy of your data, withdrawing consent (unsubscribe at any time), objecting to processing, and restricting it. Send your concerns and queries via the contact form; I will answer within 7 business days, normally much sooner.

For data held by the platforms that run their own notices (airihub.io, aiready.sg, community.aifirstnation.org), exercise your rights through the mechanisms described there.

8. Changes

When this policy changes, the date at the top changes with it, and material changes are announced in AIFN Insights. The live page always describes the live sites; where the two could ever disagree, fixing the gap is on me, not you.