last updated 21 October 2026 · Human Forward LTD · hello@humanforward.io · United Arab Emirates
Privacy
This policy explains what personal data Human Forward LTD collects, why, who we share it with and what your rights are. It covers our website, our sessions, our Shopify apps, our AI tools and our community platform.
Who we are and how to contact us
Human Forward LTD is the controller for the personal data described in this policy, except where we say we act as a processor. We are a company registered in England and Wales under number 17452304. Our registered office is 66 Paul Street, London EC2A 4NA. We trade as Human Forward.
Contact us about anything in this policy at hello@humanforward.io or by post at the address above. We are registered with the Information Commissioner's Office, registration reference ZC279404. Data protection questions go to hello@humanforward.io, marked for the attention of the data protection lead.
What this policy covers
This policy covers personal data we handle through:
- Our website at humanforward.io, including enquiry forms, newsletter sign up, session bookings and the free findability score
- Sessions and consulting work, including intro calls, paid working sessions and client engagements
- Our Shopify apps, including the Findability app, and any subscription services sold through them
- Our AI tools, whether used on the website, in an app or as part of a service
- Our community platform, including white label apps we run for brands
We act as a controller when we decide why and how personal data is used. That covers our website visitors, our clients and the merchants who install our apps.
We act as a processor when we handle personal data on a client's instructions. That covers your customers' data if you give one of our apps or services access to it, and the members of a community we host for a brand. In those cases the client or brand is the controller, their privacy notice applies, and our Data Processing Agreement governs what we do. Contact the brand or merchant first if you want to exercise your rights over that data. We will help them respond.
The data we collect
| Where | What we collect | Where it comes from |
|---|---|---|
| Website visits | Pages viewed, approximate location, device and browser type, referring site, bot checks | Automatically, through our hosting and the Cloudflare Turnstile captcha. See our Cookie Policy |
| Enquiry and interest forms | Name, email, company, website, what you want help with | You |
| Newsletter | Email, name, how you signed up, which emails you open and click | You, and our email tool |
| Session bookings | Name, email, company, time zone, the session booked, anything you add to the booking, NDA details, meeting notes and recordings where you agree to them | You, and our booking tool |
| Free findability score | The store or website domain you submit, your email if you ask for the results, the score and report we generate | You, and public content on the domain |
| Client work and invoicing | Contact details, contract and billing details, correspondence, work product | You |
| Shopify apps | Store name and domain, store owner name and email, app settings, usage, scores and reports, subscription status. Only if you grant it and the app needs it: order and customer data | Shopify when you install, and your use of the app |
| AI tools | The inputs you submit, the outputs we generate, usage logs | You, and the AI providers we use |
| Community platform (brands) | Brand admin names, emails, roles, billing contact, Stripe account connection | The brand |
| Community platform (members) | Profile, email, posts and messages, event bookings and payments, approximate location if you turn on nearby features, connected accounts such as Strava if you link them | Members, processed on the brand's behalf |
We do not deliberately collect special category data, such as health or religion. If you include it in a message, a session or a community post we hold it only as part of that content.
How we use your data and our legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Answer enquiries and run sessions | Contact details, booking details, notes | Contract, or steps before one |
| Deliver our apps, AI tools and subscriptions | Store data, inputs, outputs, usage, billing status | Contract |
| Bill and collect payment | Billing details, subscription status | Contract, legal obligation |
| Send our newsletter and updates | Email, name, engagement | Consent. For existing clients, our legitimate interest in telling you about similar services, with an opt out in every email |
| Run, secure and improve the services | Usage logs, device data, bot checks, aggregated results | Our legitimate interest in a service that works and is not abused |
| Enforce our terms and Acceptable Use Policy | Usage logs, account data | Legitimate interest, legal obligation |
| Keep records and meet legal duties | Contracts, invoices, correspondence | Legal obligation |
We do not make automated decisions about you that have legal or similarly significant effects. Our AI tools produce recommendations. People decide what to do with them.
AI processing
Our AI tools send what you submit, and relevant content from your store or site, to third party AI providers to generate a result. Depending on the tool this includes Anthropic, OpenAI, Google, Perplexity, xAI, DeepSeek and any other engine named in the app you are using. We use these providers under their business API terms. Under those terms they do not use your inputs or outputs to train their models, and they keep data only for a limited period for abuse monitoring.
We do not train our own models on your data. We keep inputs, outputs and scores to provide the service, show you your history, investigate abuse and improve the tools. We may use aggregated and anonymised results, such as average scores across all stores, in our research and marketing. That data cannot identify you or your store.
Do not put personal data about other people into our AI tools unless you have a lawful basis to share it with us. You are responsible for what you submit.
Our Shopify apps
When you install one of our apps Shopify sends us your store's domain, the store owner's name and email, and the permissions you grant. Each app asks only for the access it needs. The Findability app reads public store content such as products, collections, pages and theme settings, and does not request access to your customers' personal data. If a future app or service needs order or customer data we will say so at install, and our Data Processing Agreement will apply to it.
Billing for our apps runs through Shopify. We see your subscription status but not your payment card details.
When you uninstall an app Shopify tells us. We delete your store data within 30 days of uninstall unless we need to keep it for billing records or a legal reason. We also honour Shopify's data request and deletion webhooks for customer data.
The community platform
Brands use our platform to run their own communities, including white label apps published in the brand's name. The brand decides who can join, what the community is for and how members' data is used, so the brand is the controller for members' data and the brand's privacy notice is the one that applies to members. We process members' data on the brand's instructions under our Data Processing Agreement.
We are a controller for a small amount of member data where we have our own relationship with you, for example if you contact our support directly, or where we must keep records for security or legal reasons.
Payments for memberships and events go through the brand's own Stripe account using Stripe Connect. Stripe handles card details under its own privacy policy. We receive confirmation of payment, not card numbers. If you link a third party account such as Strava, we only receive what that service shares with the permissions you grant, and you can disconnect it at any time.
Nearby and location features are off unless you turn them on. When on, we use your approximate location to show you people, groups and events near you. You can turn it off in your settings.
Who we share data with
We share personal data with the providers below, who act as our processors unless stated. We do not sell personal data.
| Provider | What for | Location |
|---|---|---|
| Shopify | App hosting in your store, billing, install and uninstall data | Canada, US |
| Vercel | Website hosting and analytics | US, with edge servers worldwide |
| Railway | App hosting and databases | US |
| Cloudflare | Turnstile bot protection and network security | US, with servers worldwide |
| Resend | Transactional email, including the sign in codes for the web app | US |
| Klaviyo | Email, newsletter and forms | US |
| Cal.com | Session bookings | US |
| Stripe | Payments, and Stripe Connect for community platform payments. Stripe is an independent controller for card processing | US, Ireland |
| AI providers: Anthropic, OpenAI, Google, Perplexity, xAI | Generating scores, reports and other AI outputs | US |
| DeepSeek | Checking how your store appears in its answers. We send it public store content only, never account or customer data | China |
| Our email, document and accounting tools | Running the business | UK, EU, US |
We may also share data with professional advisers, insurers, a buyer if we sell the business, and courts, regulators or law enforcement where the law requires it. Where a PR partner or an on the ground community partner works on your engagement we will tell you, and they will be bound by confidentiality.
International transfers
We are based in the UK. Most of our providers are in the US and some are elsewhere. When we send personal data outside the UK or the European Economic Area we rely on one of the following:
- An adequacy decision, including the UK Extension to the EU to US Data Privacy Framework for certified US providers
- The International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
- The EU Standard Contractual Clauses for transfers from the EEA
You can ask us for a copy of the safeguards we rely on for a specific provider. Where we process personal data on a customer's behalf, our Data Processing Agreement at humanforward.io/dpa sets out the transfer mechanisms in detail.
How long we keep data
| Data | Kept for |
|---|---|
| Enquiries that do not become clients | 12 months from the last contact |
| Newsletter data | Until you unsubscribe, then a suppression record so we do not email you again |
| Booking and session records | 3 years from the session, longer if part of a client contract |
| Client contracts, invoices and correspondence | 6 years after the engagement ends, for tax and legal records |
| Free findability score submissions | 12 months |
| Shopify app store data | While the app is installed, then deleted within 30 days of uninstall |
| AI inputs and outputs | While your account is active and up to 90 days after, unless kept for an abuse investigation |
| Community platform member data | As instructed by the brand, and deleted or returned when the brand's contract ends |
| Security and access logs | 12 months |
We delete or anonymise data when it is no longer needed. Backups may hold copies for a short period after deletion.
Security
We protect data with encryption in transit and at rest, access controls, two factor authentication on our accounts, and providers that hold recognised security certifications. Our apps use Shopify's authentication and request only the permissions they need. Nobody can guarantee security, so if you think your data has been compromised tell us straight away at hello@humanforward.io. Where a breach is likely to put people at risk we will tell you and the relevant regulator as the law requires.
Your rights
Under UK and EU data protection law you can ask us to:
- Give you a copy of your personal data
- Correct anything inaccurate
- Delete your data, where we have no overriding reason to keep it
- Restrict or object to how we use it, including any use based on legitimate interests
- Give you your data in a portable format
- Stop using your data where we relied on your consent. Withdrawing consent does not affect what we did before
Email hello@humanforward.io. We will respond within one month, or tell you if we need longer. We may ask you to prove your identity. There is no charge unless a request is clearly unfounded or excessive.
If you are in the United States, state laws such as the California Consumer Privacy Act give you similar rights to access, delete and correct your data and to opt out of sale or sharing. We do not sell or share personal data for targeted advertising. If you are in Australia, the Privacy Act 1988 gives you rights to access and correct your data and to complain to the OAIC. Wherever you are, the contact above is the way to exercise your rights.
If we act as a processor, contact the brand or merchant who controls the data. We will help them respond.
Marketing
We only send marketing email if you sign up, or if you are an existing client and we are telling you about similar services. Every email has an unsubscribe link. You can also email hello@humanforward.io to opt out. We do not send marketing on behalf of other companies and we do not pass your details to anyone for their marketing.
Children
Our website, apps and services are for adults running or working in a business. We do not knowingly collect personal data from anyone under 18. Brands that run communities on our platform set their own minimum age, must comply with the law on children's data if they allow anyone under 18 to join, and must tell us before they do.
Cookies, changes and complaints
Our Cookie Policy explains the cookies we use and how to control them.
We may update this policy. The date at the top shows the current version. If a change matters to you we will tell you by email or a notice on the site before it takes effect.
If you are unhappy with how we handle your data, contact us first and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority if you are in the EU.
Market terms: United Arab Emirates
These terms apply in addition to the document above when you are in the United Arab Emirates, and prevail where they differ.
1. Who we are and which law applies
Human Forward LTD is registered in England and Wales and has no establishment or licence in the United Arab Emirates. Our relationship with you is governed by the law of England and Wales. That choice does not remove any protection given by a mandatory provision of UAE law, in particular Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, Federal Decree Law No. 14 of 2023 on Trading by Modern Technological Means and, if you are a consumer, Federal Law No. 15 of 2020 on Consumer Protection and its Executive Regulations (Cabinet Decision No. 66 of 2023). Those provisions prevail.
Provider details. Human Forward LTD, registered at Companies House for England and Wales under number 17452304, 66 Paul Street, London EC2A 4NA, United Kingdom, hello@humanforward.io. Authorised representatives: the directors, per the public register: find-and-update.company-information.service.gov.uk/company/17452304/officers. Tax registration: we sell mostly to businesses that account for VAT under the reverse charge; on consumer sales, Stripe or Shopify collect and remit the tax on our behalf at checkout, so no local tax number is shown here.
Financial free zones. Decree Law No. 45 of 2021 does not apply in the Dubai International Financial Centre or Abu Dhabi Global Market, which have their own laws: DIFC Law No. 5 of 2020 on Data Protection and the ADGM Data Protection Regulations 2021. If your business is established in one of them, that regime governs its data, to the same standards as the Privacy Policy.
2. Personal data in the United Arab Emirates
Regulator. The UAE Data Office, established by Federal Decree Law No. 44 of 2021. At the date of these terms the Executive Regulations to Decree Law No. 45 of 2021 have not been issued, and in June 2026 the State announced a Federal Authority for Artificial Intelligence and Data to absorb the Data Office. We will update this section when either changes.
Legal bases. Where the Privacy Policy relies on contract or legitimate interest, in the UAE we rely on the Article 4 cases that permit processing without consent, including performance of a contract with you, and otherwise on your consent, which you may withdraw at any time. We send marketing only with your express consent, with an unsubscribe facility in every message, and use no cookies that require consent.
Transfers outside the State. Your data is processed in the United Kingdom, which has a comprehensive data protection law, and by the providers named in the Privacy Policy in the United States and European Union. No Article 22 adequacy list has yet been published. Until it is, we rely on Article 23: the transfer is necessary to perform our contract with you, and our provider contracts impose protection no lower than the Decree Law's.
Retention, breaches and rights. The Privacy Policy's retention periods and security measures apply in full. We notify the regulator and you of a breach that threatens your privacy as the Decree Law requires. You have the right to access and copy your data, to correction, erasure, restriction, objection, including to automated decisions, and portability. Write to hello@humanforward.io; we respond within one month. You may complain to the State's data protection authority.
3. Payments, prices, taxes and consumer rights
Billing methods and currencies follow the Purchases and Refunds policy. Prices exclude VAT. Businesses registered with the Federal Tax Authority account for 5 percent VAT on imported services under the reverse charge; give us your tax registration number. For consumers, VAT at 5 percent is added at checkout and collected and remitted by Stripe or Shopify on our behalf.
Consumer rights. Our services are for businesses. If the law treats you as a consumer, your rights under Federal Law No. 15 of 2020 and Federal Decree Law No. 14 of 2023, including accurate information, a dated invoice and exchange or return where the law provides them, apply on top of the Purchases and Refunds policy, which also grants, under conditions, a first month refund of a web plan within 14 days. We do not require arbitration of a dispute under USD 50,000. You may complain to the State's consumer protection authorities.
4. Language
English governs, except for information the law requires consumers to receive in Arabic; to that extent the Arabic version of this page governs.
5. Contact for the United Arab Emirates
hello@humanforward.io. We respond within a reasonable time and within any period the applicable law sets. Human Forward LTD, 66 Paul Street, London EC2A 4NA, United Kingdom.
Local law review: pending. Say if you spot something we have got wrong at hello@humanforward.io.