Privacy Policy

Effective date: July 15, 2026

Who we are: Rare ("we", "us") operates Change Agent and is located at 1310 North Courthouse Rd., Suite 110 Arlington, Virginia 22201, USA.

This Privacy Policy explains how we collect, use, disclose, and retain Personal Information about the individuals and the devices and browsers that interact with our website, and subdomains thereof at changeagent.earth (collectively, the "Site"), as well as the Change Agent, AI features, and tools ("Services"). The Services and the Site are collectively referred to as the System. Change Agent is an AI behavioral-science thought partner for conservation practitioners.

This Privacy Policy also describes the rights that you may have regarding our processing of your Personal Information under applicable law. The terms "you" or "your" and similar terms refer to end users of our System.

By accessing or using the System, you acknowledge that your Personal Information will be processed in accordance with this Privacy Policy.

When you sign up for and use the System directly, Rare is the "controller" (under the GDPR, UK GDPR, and similar laws) or "business" (under the CCPA and similar laws) that determines the purposes and means of processing your Personal Information, and this Privacy Policy governs that processing.

Where we have a separate agreement in place with a business or institutional customer ("Customer") under which we process Personal Information on that Customer's behalf and at its instruction, that Customer is the "controller" or "business" and we act as the "processor" or "service provider." In that case, please refer to the Customer's own privacy policy and contact the Customer directly with questions about its handling of your Personal Information.

1. The Personal Information we process

Personal Information means any identifying information, such as your name in combination with another identifier, such as date of birth, postal address, email address, telephone number, or government-issued identification number. Personal Information does not include anonymous or aggregated data that can no longer be used to identify a specific person, even if combined with other data. The specific definition of Personal Information varies from one jurisdiction to another.

Depending on your use of the System, we may collect the following categories of Personal Information directly from you, or automatically through your use of the System:

• Identifiers, such as your name, email address, telephone number, user ID, account information, and online identifiers generated by us when you use or engage with our Services.
• Payment data, such as billing and account information.
• Commercial information, such as records of Services purchased, obtained, or considered, or other consuming histories or tendencies.
• Activity and Device Information and other Usage Data, including browser and device identifiers, model type, and settings; operating system; clickstream data such as the sections, links, and features of the website you interact with and use; cookies, and similar technologies; content, search and browsing histories within our System; content you view, click, access, or engage with; and other similar information related to your interaction with our System.
• Geolocation data, such as the general physical location of your device.
• Inferences, such as information reflecting a person's preferences.

Information Collected through the Services

When an account is created for the Services, you may use third party platforms such as Google or Microsoft ("Single Sign On" or "SSO"). If you elect to use SSO, we will receive certain information such as your name, email address, and any other information that you authorize the provider of the SSO to share with us. We use this information to provide the Services to you and communicate with you. We do not control their privacy practices, so please refer to the terms of use and privacy policy of the SSO provider. You may disconnect your SSO account from our Services by contacting us.

Below is a chart describing some additional information we collect through our Services:

We do not intentionally collect sensitive Personal Information and require that any users of the Services must not enter sensitive Personal Information into conversations.

Information We Collect Automatically

We and our partners use various tools and technologies such as cookies, pixels, localStorage, web beacons, software development kits, and similar technologies to collect data when you interact with our System, including email communications. This data may also include information about your operating system(s), device(s), and browsers.

We also collect activity and device information and other usage data automatically as set forth above.

2. Why we process Personal Information, and our lawful basis

We use the collected Personal Information to:

• Provide and manage our System
• Communicate with you about inquiries, updates, and campaigns
• Send newsletters, and promotional materials
• Improve the System, user experience, and our marketing effectiveness
• Comply with legal obligations and enforce our terms

Lawful Basis for Processing Personal Information

The legal basis for collecting and using the Personal Information described in this Privacy Policy will depend on the Personal Information concerned and the specific context in which we collect it. However, we will normally collect Personal Information from you only where we have your consent to do so, where we need the Personal Information to perform a contract with you or where the processing is in our legitimate interests and in some cases, we may also have a legal obligation to collect Personal Information from you. For example, we sometimes process your Personal Information to pursue our legitimate interests in running our business, including for delivering our System, protecting you from fraud, quality assurance, and marketing purposes. However, we also ensure that our legitimate use of your data does not materially infringe your rights, freedoms, or interests when compared to the processing.

If we ask you to provide Personal Information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Information is mandatory or not (as well as of the possible consequences if you do not provide your Personal Information). Similarly, if we collect and use your Personal Information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

3. Services — AI models and your data

When you use our Services, your prompts and responses are processed by third-party AI providers solely to generate responses for you. Your data is not used to train any AI model. Our model-routing account is configured to exclude any provider that trains on or publishes inputs, and our primary model is served under enterprise terms that exclude training. Please see our Sub-processors for the providers involved.

4. Who we disclose Personal Information to

Service Providers. We may sometimes employ other companies and individuals to perform functions on our behalf. These service providers have access to only the Personal Information needed to perform their functions, and are prohibited from using it for other purposes. Regarding our Services, we disclose Personal Information only with vetted service providers ("Subprocessors") who process it on our behalf under contract — for authentication, hosting, AI inference, and observability. The current list, with each provider's role and location, is published at our Sub-processor list. We do not sell your data or share it for advertising.

Business Transfers. We may disclose information with third parties to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding.

Compliance Matters. It may be necessary to release Personal Information if we reasonably believe we are compelled to cooperate with governmental investigations, or otherwise to comply with laws; enforce or apply terms and conditions of use of the Services, and other related agreements; or protect our rights, property, or safety.

5. International transfers

We are located in the United States, and the Personal Information that we collect is stored on servers hosted by us or our authorized third-party service providers located in the United States and elsewhere. This means that your Personal Information will be collected, processed, and stored in the United States or other countries, which may have data protection laws that are different from (and sometimes less protective than) the laws of your country or region. By sending us Personal Information, you agree and consent to the processing of your Personal Information in the United States, which may not offer an equivalent level of protection to that required in other countries (particularly the European Union), and to the processing of that information by us on servers located in the United States, as described in this Privacy Policy.

For transfers to or from the United Kingdom, we make use of the UK International Data Transfer Addendum. When we share Personal Information of individuals in the EEA, Switzerland or UK with third parties, we use a variety of legal mechanisms to safeguard the transfer including the Standard Contractual Clauses, as well as additional safeguards where appropriate. The safeguards we may take in our discretion include, for instance, entering into specific agreements in connection with any onward transfers of Personal Information. We may implement other mechanisms and take similar appropriate safeguards with our third-party service providers and partners, including the EU-US Data Privacy Framework where the provider is certified. Details available on request.

Enterprise and institutional clients may request a Data Processing Agreement (DPA) governing how we process Personal Information on their behalf. To request a DPA, contact info@rare.org.

6. How long we keep Personal Information (retention)

We will retain Personal Information from or about you as reasonably necessary and proportionate to achieve the purpose(s) for which the Personal Information was collected or processed as outlined in this Privacy Policy unless a longer retention period is required or allowed by law.

You can delete your individual conversations, or your entire account, at any time through the System (see "Exercising Rights" in §8). Where we process Personal Information on behalf of a Customer, our Services enable that Customer to delete account and/or conversation data.

7. How we protect Personal Information (security)

We implement physical, technical, and organizational security measures designed to safeguard Personal Information. These measures aim to protect the Personal Information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no measures can guarantee security.

8. Your rights

Depending on your location, you may have certain rights with respect to your Personal Information:

• The right to be informed about what Personal Information we collect from you and how it is used, as well as our purposes for processing your Personal Information, how long we retain your data, and who we share it with. This Privacy Policy lays out that information in general; please contact us for details specific to you.
• The right of access to make what's known as a "data subject access request" for a copy of the Personal Information we hold about you.
• The right to rectification and request that we correct Personal Information about you that may be incomplete or inaccurate.
• The right to erasure, where you may request we delete the Personal Information we have about you, subject to certain circumstances (unless there's an overriding legal reason we need to keep it).
• The right to restrict processing where you may have the right to request us to restrict processing Personal Information, subject to certain circumstances.
• The right to data portability of your Personal Information we have collected from you in an accessible form and have it transferred to another controller.
• The right to object to us processing your Personal Information (for example, if you object to us processing your data for direct marketing).
• The right to opt out of the processing of your Personal Information for the purposes of providing you with targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not use Personal Information for profiling in furtherance of decisions that produce legal or similarly significant effects for a consumer.
• Rights in relation to automated decision making and profiling, where you may have the right to not be subject to a decision based solely on automated processes (no human involvement).
• Right to appeal. At times we may be unable to process requests relating to your Personal Information, in which case, your request will be denied. If your privacy rights request has previously been denied by us and you believe we denied it in error, you may appeal for reconsideration of your request via emailing us or contacting your state attorney general.
• Right to lodge a complaint. You may lodge a complaint with a data protection authority for your country or region where you have your habitual residence, where you work, or where an alleged infringement of applicable data protection law occurs. A list of EEA data protection authorities is available here, the contact details for the UK Information Commissioner's Office are available here, and the contact details for the Switzerland Federal Data Protection and Information Commissioner are available here.

Exercising Rights. For our Services, you may exercise your right to access/portability by clicking in your account settings and downloading data exports as a JSON file, or your right to deletion by deleting your account or conversations in the chat history. For any other rights relating to the System, you may exercise any of these rights by contacting us at info@rare.org. Please note that we may need to authenticate your identity before your request can be processed, providing us with 2–3 pieces of Personal Information which we will match to the information we maintain about you. For authentication, you may be asked to provide certain Personal Information that we will match against our records. You may designate an authorized agent to make a request on your behalf; however, you will still need to verify your identity directly with us before your request can be processed.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. Cookies are small data files that help us keep track of your usage of the System. Many of the cookies we use enable the System to function as you would expect it to.

For the Services, we use only strictly necessary cookies/local storage for authentication and to keep you signed in.

For the Site, we use the following categories of cookies:

• Strictly Necessary Cookies are necessary for the Site to function. If you refuse them, you will not be able to use the Site, as the Site will not function properly without them.
• Functionality Cookies help us enhance the performance and functionality of our Site to remember your choices, settings, or preferences from one visit to the next. These are not necessary for your use. Still, certain functions or features may become unavailable if you refuse them.
• Analytical/Performance Cookies collect information about your use of our Site, including which pages you visit, and whether you experience any errors. These cookies do not collect any personally identifiable information. The information collected is only used to analyze how the Site is being accessed and used in order for us to improve the Site and your experience using it.

You can control cookies through your browser settings or opt out of certain tracking via tools such as the Network Advertising Initiative.

10. Marketing Communications

You have the right to opt out of marketing communications we send you.

If you no longer want to receive marketing-related emails from us, you can opt out of receiving such emails by clicking the "unsubscribe" link at the bottom of any marketing email you receive from us. Please be aware that you will continue to receive certain communications from us that are necessary for our System. If you are having difficulty unsubscribing from our marketing emails using the above method, please contact us directly by email at info@rare.org.

11. Do Not Track

The Site does not respond to browsers' Do Not Track signals.

12. Third Party Websites and Links

Our Site may contain links to other websites. These websites may have privacy policies different from our Privacy Policy. The Site may also contain certain social media icons or widgets like Facebook, X, LinkedIn, Pinterest, and WhatsApp. Although you can view the material we have linked to, you may have to create an individual account or register to use these third-party social media sites to use interactive features. Any interaction on social media or other third-party websites is governed not by this Privacy Policy but by the terms of use and privacy policy of the particular platform.

13. Children's Privacy

Our System is not directed or targeted to children under the age of 18. We do not knowingly collect Personal Information from children. If you believe we have done so inadvertently, please contact us for removal.

14. Changes to this Privacy Policy

We may update this Privacy Policy, and we will post the new version here and update the effective date, and provide notice of material changes where required.

15. Contact

Rare — 1310 North Courthouse Rd., Suite 110 Arlington, Virginia 22201, USA — info@rare.org.

If you need to access this Privacy Policy in an alternative format due to a disability, please contact us at info@rare.org.