Privacy Policy (version 2.3)

This Privacy Policy describes how Avery Intelligence, Inc. d/b/a Humfrid ("Humfrid", "we", "us") collects, uses, and shares information when Humfrid acts as a data controller. Workspace content Humfrid processes on Customer's behalf is governed by the DPA. Cookie names and durations are in the Cookie Policy. Sub-processors for Customer data are listed at humfrid.com/subprocessors.

Data Roles. For the purposes of applicable data protection laws (including GDPR), Humfrid acts as a data processor when processing Customer workspace content on behalf of Customer, and as a data controller for account registration data, billing information, product and website analytics, and the business contacts we write to about Humfrid (see Business Contacts and Sales Outreach).

1. Information We Collect (as controller)

Information You Provide

• Account information (name, email, company name, billing information)
• Configuration data (workspace settings, preferences)
• Support communications

Information Collected Automatically

• Usage data (features used, interaction patterns, timestamps)
• Device information (browser type, OS, IP address, general location)
• Performance data (response times, error logs)
• Cookies (session management, authentication, analytics) — see the Cookie Policy

Information from Third Parties

• Payment transaction information from Stripe (we do not store full credit card numbers)
• Business contact details from introductions and public professional sources, for the people we write to about Humfrid (see Business Contacts and Sales Outreach)

Customer Content (processor). Messages, documents, files, connected-channel data, and the context library Humfrid builds from them are Customer's workspace content. Humfrid processes that content as a processor under the DPA. Categories of that data, security measures, retention, and international transfers for Customer Content are in the DPA, not in this Policy. Customer controls which channels and integrations AI features can access. Private direct messages between human users are not monitored unless an AI feature is explicitly added to the conversation.

2. How We Use Controller Information

We use controller information to:

• Provide, maintain, and improve the Services (account management, billing, support)
• Communicate service updates, security alerts, and billing notifications
• Detect and prevent unauthorized access, abuse, and security incidents
• Understand how the website and the Services are used, and which marketing activities lead to sign-ups
• Screen waitlist sign-ups and contact requests, using the details provided and publicly available information, to keep them free of spam
• Fulfill legal obligations

No Model Training. Humfrid will not train AI models on Customer Content submitted through the Services. That commercial promise is in the Terms. Processor-side retention and provider controls are in the DPA. We may use aggregate, anonymized data for product development.

Legal Bases (GDPR). Where GDPR applies, we process controller Personal Data on the following bases: (a) performance of our contract with Customer (account management, service delivery); (b) legitimate interests (security, fraud prevention, product improvement), balanced against data subject rights; (c) legal obligation (tax records, law enforcement requests); and (d) consent (where specifically requested, which may be withdrawn at any time).

Business Contacts and Sales Outreach

This section is our notice under GDPR Article 14 to the people we write to about Humfrid for work, and to people who write to us about it: mostly product leaders and others whose role is relevant to what we offer. Avery Intelligence, Inc. d/b/a Humfrid (address in section 12) is the controller of this data.

What we hold. Your name, work email address, job title and company, links to your public professional profiles (such as LinkedIn), the emails and messages we exchange, notes on our conversations and meetings, and whether you have asked us not to contact you.

Where it comes from. From you (when you write to us, join our waitlist, book a call, or meet us at an event or workshop), from people who introduce us, and from public professional sources such as your company's website, press coverage and professional networks.

Why, and on what basis. To write to you about work relevant to your role, mainly our product assessment, to keep track of our conversation, and to reply on X when you mention or reply to our account. The legal basis is our legitimate interest in business-to-business marketing (GDPR Article 6(1)(f)). We write only to work addresses and only about work, and every sales email says how to stop.

How our emails are written. Our sales emails are drafted by Humfrid, our AI assistant, from what is in our records and our published offer. A person on our team reads and approves each one before it is sent. When you ask for something on our website, such as a demo, we send an automatic reply with what you asked for. No decision with legal or similarly significant effects on you is made automatically.

Who processes it. Our email provider (Mailgun) sends and receives the emails, our cloud provider (Google Cloud, United States) stores the records, and AI model providers draft the text under terms that do not allow training on it. Transfers from the EEA, UK and Switzerland are covered as described in section 8.

How long we keep it. For as long as there is a reasonable prospect of working together, or until you ask us to delete it. If you opt out, your email address goes on a do-not-contact list, which we keep so that we never write to you again; on request we delete everything else.

Your choices. You can object at any time and we will stop: use the unsubscribe link in our sales emails (it takes effect immediately) or reply "unsubscribe". To see, correct or delete what we hold about you, write to [email protected]. You can also complain to your local data protection authority.

3. Third-Party Processing

Customer Content is processed by AI model providers as described in the DPA, under terms that do not allow them to train models on it. The list of Sub-processors is at humfrid.com/subprocessors.

Google API Services User Data Policy Disclosure

When you choose to connect your Google account to Humfrid (including Gmail, Google Calendar, Google Analytics, or Google Drive), Humfrid accesses, processes, and stores specific Google user data solely to provide user-requested workspace features:

• Gmail (gmail.readonly): Humfrid reads the email in the account you connect to prepare briefings, find what needs your attention and answer your questions. Access is read-only.
• Google Calendar (calendar.events, calendar.calendarlist.readonly, calendar.freebusy): Humfrid accesses calendar event titles, meeting times, attendee lists, and descriptions to provide meeting preparation briefings, contextual summaries, and schedule coordination for your team.
• Google Analytics (analytics.readonly): Humfrid accesses read-only performance metrics and reporting data to allow teams to monitor workspace and project health directly within their dashboard.
• Google Drive (drive.file): Humfrid accesses only specific files and documents that you explicitly choose to connect, in order to index contextual knowledge for your team.

Storage & Security. Google OAuth tokens and synchronized data are encrypted in transit (TLS) and at rest (AES-256). Access is limited to your workspace.

Data Retention & Revocation. Google user data is retained only for as long as your integration remains connected. You can disconnect your Google account at any time in your workspace settings, which stops Humfrid's access, and you can remove access at any time in your Google Account Permissions.

No Advertising or AI Model Training. Humfrid never sells Google user data, never uses Google user data for advertising, and does not use Google user data to train, retrain, or fine-tune generalized artificial intelligence or machine learning models.

Limited Use Compliance. Humfrid's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Slack App Data Disclosure

When your workspace installs Humfrid for Slack, Humfrid processes Slack data on the Customer's behalf, as a processor under the DPA, only to provide the features described at humfrid.com/slack:

• What it reads: messages sent to Humfrid in a direct message, messages that @mention Humfrid, and public channels a workspace admin has turned learning on for. It does not read private channels or channels it has not been added to.
• What it stores: Humfrid does not store the words of Slack messages. It stores the Slack workspace, channel and user IDs, the time and a link to a message, the bot token of the installation (encrypted at rest), and what it learned, written in its own words (for example a decision recorded from an opted-in channel, or a fact a person told Humfrid about themselves in their DM). When it answers, it reads the conversation from Slack at that moment.
• How it is used: to answer the people who ask Humfrid in Slack, and to build the workspace's plans and knowledge in Humfrid. Humfrid's answers are written by AI model providers listed at humfrid.com/subprocessors, under terms that do not allow training.

No Training. Humfrid never uses Slack data to train, retrain, or fine-tune AI or machine learning models, and never sells it or uses it for advertising.

Retention and Deletion. Slack-derived data is kept while the app is installed. Uninstalling Humfrid from Slack, disconnecting it in Humfrid, or revoking its token ends its access immediately. After a 3-day grace period (so an accidental uninstall can be undone), Humfrid deletes the installation, its token, the knowledge it learned from Slack channels, its links to Slack messages, and Slack identity links — within 14 business days; encrypted backups that still hold it expire within 35 days, as the DPA §11 sets out. What Humfrid learned about a person in their own conversations with it, in its own words, stays in that person's Humfrid memory, where they can see and delete it at any time; it is deleted with their account or workspace.

Your Requests. To access, export, or delete Slack-derived data, email [email protected]. Requests about a workspace's data are fulfilled with that workspace's administrator, under the DPA.

4. Data Storage and Security

Technical and organizational measures are in the DPA §3 and on our Security page. The Services are hosted on Google Cloud and Cloudflare. Our SOC 2 Type II audit is in progress.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

Data Breach Notification (controller data). If a breach affects account, billing, or other information for which Humfrid is the controller, we will notify affected individuals as required by applicable law. Breaches of Customer Content are notified to Customer under the DPA §6 (without undue delay, and no later than 72 hours after becoming aware); Customer is responsible for downstream notices to data subjects and regulators.

5. Data Sharing

We share controller information only in the following circumstances:

Service Providers. Providers that help us operate the Services and our business, each bound to protect the data. Beyond the Sub-processors, these are: Google Analytics (website and product analytics), Google reCAPTCHA (spam protection on forms), Google Fonts (website fonts), Salesforce (website contact forms), Slack (internal notifications to our team), Mailgun (email) and Stripe (billing).

Legal Requirements. We may disclose information if required by valid legal process, government requests, or to protect our rights, users, or the public. We will notify affected customers unless prohibited by law. Compelled disclosure of Customer Content is also addressed in the DPA.

Business Transfers. In connection with a merger, acquisition, or sale of assets, with notice to Customer and the opportunity to delete accounts before transfer.

With Consent. For other purposes with Customer's explicit consent.

6. Data Retention (controller data)

Customer Content retention is in the DPA §11. This table covers information for which Humfrid is the controller.

Prohibited data types are described in our Usage Policy. If prohibited data is accidentally submitted, contact [email protected] immediately.

7. Your Rights

All Customers

• Access, correct, or delete your personal information
• Request data in a structured, machine-readable format
• Object to certain processing
• Request restriction of processing

GDPR (EEA/UK/Swiss Customers)

• Right to withdraw consent at any time
• Right to lodge a complaint with your supervisory authority (edpb.europa.eu)
• Right not to be subject to solely automated decision-making with legal effects
• Automated features assist human decision-making but do not make legally binding decisions

CCPA/CPRA (California Customers)

• Right to know what personal information we collect, use, and share
• Right to delete, correct, and limit use of sensitive personal information
• We do not sell or share personal information for cross-context behavioral advertising

Automated Decision-Making Technology (ADMT). Humfrid uses AI to generate insights, summaries, and recommended actions from workspace content. These features support people's decisions; they do not, by themselves, make decisions with legal or similarly significant effects on individuals.

Categories of Personal Information Collected (CCPA Disclosure)

• Identifiers (name, email address, IP address)
• Commercial information (subscription plan, billing history, payment method tokens)
• Internet or network activity (usage logs, feature interactions, clickstream data)
• Professional or employment information (job title, company name)
• Communications content processed as a processor — see the DPA
• Inferences (AI-generated summaries and structured representations) processed as a processor — see the DPA

To exercise your rights: [email protected]. Include "GDPR Request" or "California Privacy Request" in the subject line. We will respond within 30 days (GDPR) or 45 days (CCPA/CPRA). For complex requests, we may extend by an additional 60 days (GDPR) or 45 days (CCPA/CPRA) with notice. Requests that concern Customer Content in a workspace are fulfilled with the Customer (controller) under the DPA.

Appeals. If we deny your request in whole or in part, you may appeal by replying to our response with "Appeal" in the subject line. We will review appeals within 30 days.

8. International Data Transfers (controller data)

Account, billing, and marketing-site data are stored in the United States. For transfers of that controller data from the EEA/UK/Switzerland, we use: EU Standard Contractual Clauses (2021 version); the UK International Data Transfer Agreement; and, for transfers from Switzerland, the FDPIC-approved version of the EU Standard Contractual Clauses (2022); plus supplementary measures including encryption, access controls, and data minimization.

Transfers of Customer Content are described in the DPA §7. EEA, UK and Swiss residents can exercise their rights by contacting [email protected].

9. Children's Privacy

The Services are intended for business use by individuals 18 or older. We do not knowingly collect personal information from individuals under 18. If we become aware of such collection, we will delete it promptly. Product eligibility and COPPA prohibited-data rules are in the Usage Policy.

10. Cookies

Cookie names, providers, purposes and durations are in the Cookie Policy. We use cookies for sign-in, security and analytics, and we do not sell personal information.

11. Changes

We may update this Privacy Policy. Material changes will be communicated via email at least 30 days before taking effect, except where required by law to take effect sooner. Material changes include new categories of controller data collected, new processing purposes, new third-party recipients, and reduced privacy protections. Continued use after the effective date is acceptance. If Customer does not agree, Customer must stop using the Services.

12. Contact

Avery Intelligence, Inc. 1300 El Camino Real, Suite 100 #66, Menlo Park, CA 94025

Contact: [email protected] — all privacy, security, and legal inquiries.

Data Processing Addendum: humfrid.com/dpa. Legal set: humfrid.com/legal.