Privacy policy
Last updated 18 September 2026
Who we are
Theory AI is an AI and machine learning consultancy with its head office in Washington, DC. This policy covers www.theoryai.co and every form on it: the job application, the contact form, and the newsletter interest list.
For any question about your data, or to exercise a right below, write to hi@theoryai.co.
If you only read the site
We run no advertising trackers and no third-party cookies. We do not build a profile of you, and we do not sell your data to anybody.
We do count page views, using Vercel Web Analytics. It sets no cookie, keeps no identifier in your browser, and reports totals rather than people. We use it to see which pages get read and how fast the site loads.
The one thing this site keeps in your browser is your light or dark theme choice, and only if you change it. It never reaches us.
If you apply for a role
We ask for:
- Required: your name, your email address, your résumé, and your consent to store them.
- Optional: where you are based, a phone number, a note on why you want the role, a LinkedIn address, a portfolio or GitHub address, and how you heard about us.
We use all of it for one purpose: to assess you for that role and to contact you about it. We do not use it to market to you, and we do not add you to a mailing list.
Our legal ground is your consent. You give it with the checkbox on the form, and you can withdraw it at any time. See Your rights below.
Where an application is stored
The form record goes to our Sanity content system as an unpublished document. Unpublished means it is not readable from the public internet: only a person signed in to our editing tool can open it.
Your résumé file goes to private storage. It has no public address. A member of our hiring team downloads it through a link that we generate on demand and that stops working after five minutes.
The alert that tells us an application arrived carries the job title and nothing else. We keep this deliberately empty so that a mailbox does not become a second copy of your details.
The anti-spam and rate limits
The form runs Cloudflare Turnstile, which checks that a person and not a script is submitting. Turnstile sees your IP address and signals from your browser. It does not see what you typed.
We also cap how many submissions we accept from one IP address, and from one email address, so that nobody can flood the form. To count per email without storing your email, we store a keyed hash of it. The hash cannot be read back into an address. Both counters delete themselves when their window ends.
Who we share it with
Inside Theory AI, only the people involved in filling the role. Outside, only the service providers below, each of which processes data on our instruction and for the stated purpose alone. We do not sell your data, share it with advertisers, or pass it to a data broker.
Vercel (United States)
Hosting, private storage for résumé files, and counting page views
Request logs including IP address. Your résumé file. Aggregate page views, with no cookie and no profile.
Sanity (United States, EU)
Content management, and storage of the application record
Everything you type into the application form.
Cloudflare (United States)
Turnstile, the anti-spam check on the form
IP address and browser signals. No form field.
Upstash (United States)
Rate limiting, to stop automated submissions
IP address, and a keyed hash of your email. Never the email itself.
Resend (United States)
Sending your confirmation email
Your name and email address.
Attio (United States)
Customer relationship management, for business enquiries only
What you send through the contact form. No application data.
How long we keep it
We keep an application and its résumé for 24 months after we decide on the role. We keep them that long so that we can answer a question about our decision, and so that we can come back to you if a similar role opens.
At the end of that period we delete the application record and the résumé file together. Ask us sooner and we will delete them sooner.
No automated decisions
A person reads every application. We run no scoring model, no ranking, and no automated filter that rejects you. Nothing on this site makes a decision about you without a human making it.
Your rights
Whatever country or state you are in, you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete your application and your résumé;
- withdraw your consent, which we treat as a request to delete.
Write to hi@theoryai.co. We answer within 30 days. If you ask us to delete your application while we are still filling the role, we can no longer consider you for it. Tell us if you would rather we waited until the role closes.
We apply these rights to everyone. We do not check where you live before granting them.
How we protect it
The site is served over HTTPS only. Résumé files are private and reachable only through a short-lived signed link. Every credential that can read an application is held on the server and is never sent to your browser. Your name, email, phone number and file contents are kept out of our logs and error reports.
No system is perfect. If a breach affects your personal information we will notify you, and the Attorney General for the District of Columbia where the law requires it, as set out in D.C. Code § 28-3851 and following.
Children
This site is not aimed at children and we do not knowingly collect data from anyone under 16. Tell us if you believe we have, and we will delete it.
If you use the contact form
We ask for your name, your email address, an optional organisation, and your message. We use them to reply to you and to keep a record of the enquiry. We do not use them to market to you.
The enquiry goes to two places: an internal mailbox, and Attio, the customer relationship system we use to track business conversations. It is not stored in our content system alongside site content.
Our legal ground is our legitimate interest in answering an enquiry you chose to send. Ask us at any time to delete it and we will.
The newsletter interest list
The homepage has a "Newsletter, coming soon" box. If you enter your email address there, we store that address so we can tell you when the first issue is ready. We store nothing else from that form.
There is no newsletter yet. We send you one email to confirm you are on the list, and then nothing until the first issue exists. We do not sell or share the list.
To come off the list, reply to that confirmation email and we will remove you. We keep an address until you ask us to remove it, or until we decide not to publish a newsletter at all, whichever comes first.
Changes to this policy
The date at the top changes whenever this text changes. If a change affects how we use data you already gave us, we will contact you before it takes effect.