last updated 21 October 2026 · Human Forward LTD · hello@humanforward.io · Netherlands
Privacy
This policy explains what personal data Human Forward LTD collects, why, who we share it with and what your rights are. It covers our website, our sessions, our Shopify apps, our AI tools and our community platform.
Who we are and how to contact us
Human Forward LTD is the controller for the personal data described in this policy, except where we say we act as a processor. We are a company registered in England and Wales under number 17452304. Our registered office is 66 Paul Street, London EC2A 4NA. We trade as Human Forward.
Contact us about anything in this policy at hello@humanforward.io or by post at the address above. We are registered with the Information Commissioner's Office, registration reference ZC279404. Data protection questions go to hello@humanforward.io, marked for the attention of the data protection lead.
What this policy covers
This policy covers personal data we handle through:
- Our website at humanforward.io, including enquiry forms, newsletter sign up, session bookings and the free findability score
- Sessions and consulting work, including intro calls, paid working sessions and client engagements
- Our Shopify apps, including the Findability app, and any subscription services sold through them
- Our AI tools, whether used on the website, in an app or as part of a service
- Our community platform, including white label apps we run for brands
We act as a controller when we decide why and how personal data is used. That covers our website visitors, our clients and the merchants who install our apps.
We act as a processor when we handle personal data on a client's instructions. That covers your customers' data if you give one of our apps or services access to it, and the members of a community we host for a brand. In those cases the client or brand is the controller, their privacy notice applies, and our Data Processing Agreement governs what we do. Contact the brand or merchant first if you want to exercise your rights over that data. We will help them respond.
The data we collect
| Where | What we collect | Where it comes from |
|---|---|---|
| Website visits | Pages viewed, approximate location, device and browser type, referring site, bot checks | Automatically, through our hosting and the Cloudflare Turnstile captcha. See our Cookie Policy |
| Enquiry and interest forms | Name, email, company, website, what you want help with | You |
| Newsletter | Email, name, how you signed up, which emails you open and click | You, and our email tool |
| Session bookings | Name, email, company, time zone, the session booked, anything you add to the booking, NDA details, meeting notes and recordings where you agree to them | You, and our booking tool |
| Free findability score | The store or website domain you submit, your email if you ask for the results, the score and report we generate | You, and public content on the domain |
| Client work and invoicing | Contact details, contract and billing details, correspondence, work product | You |
| Shopify apps | Store name and domain, store owner name and email, app settings, usage, scores and reports, subscription status. Only if you grant it and the app needs it: order and customer data | Shopify when you install, and your use of the app |
| AI tools | The inputs you submit, the outputs we generate, usage logs | You, and the AI providers we use |
| Community platform (brands) | Brand admin names, emails, roles, billing contact, Stripe account connection | The brand |
| Community platform (members) | Profile, email, posts and messages, event bookings and payments, approximate location if you turn on nearby features, connected accounts such as Strava if you link them | Members, processed on the brand's behalf |
We do not deliberately collect special category data, such as health or religion. If you include it in a message, a session or a community post we hold it only as part of that content.
How we use your data and our legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Answer enquiries and run sessions | Contact details, booking details, notes | Contract, or steps before one |
| Deliver our apps, AI tools and subscriptions | Store data, inputs, outputs, usage, billing status | Contract |
| Bill and collect payment | Billing details, subscription status | Contract, legal obligation |
| Send our newsletter and updates | Email, name, engagement | Consent. For existing clients, our legitimate interest in telling you about similar services, with an opt out in every email |
| Run, secure and improve the services | Usage logs, device data, bot checks, aggregated results | Our legitimate interest in a service that works and is not abused |
| Enforce our terms and Acceptable Use Policy | Usage logs, account data | Legitimate interest, legal obligation |
| Keep records and meet legal duties | Contracts, invoices, correspondence | Legal obligation |
We do not make automated decisions about you that have legal or similarly significant effects. Our AI tools produce recommendations. People decide what to do with them.
AI processing
Our AI tools send what you submit, and relevant content from your store or site, to third party AI providers to generate a result. Depending on the tool this includes Anthropic, OpenAI, Google, Perplexity, xAI, DeepSeek and any other engine named in the app you are using. We use these providers under their business API terms. Under those terms they do not use your inputs or outputs to train their models, and they keep data only for a limited period for abuse monitoring.
We do not train our own models on your data. We keep inputs, outputs and scores to provide the service, show you your history, investigate abuse and improve the tools. We may use aggregated and anonymised results, such as average scores across all stores, in our research and marketing. That data cannot identify you or your store.
Do not put personal data about other people into our AI tools unless you have a lawful basis to share it with us. You are responsible for what you submit.
Our Shopify apps
When you install one of our apps Shopify sends us your store's domain, the store owner's name and email, and the permissions you grant. Each app asks only for the access it needs. The Findability app reads public store content such as products, collections, pages and theme settings, and does not request access to your customers' personal data. If a future app or service needs order or customer data we will say so at install, and our Data Processing Agreement will apply to it.
Billing for Shopify store plans runs through Shopify. Billing for web plans, paid sessions and Human Forward Plus runs through Stripe. In both cases we see your subscription or payment status but not your payment card or other payment details.
When you uninstall an app Shopify tells us. We delete your store data within 30 days of uninstall unless we need to keep it for billing records or a legal reason. We also honour Shopify's data request and deletion webhooks for customer data.
The community platform
Brands use our platform to run their own communities, including white label apps published in the brand's name. The brand decides who can join, what the community is for and how members' data is used, so the brand is the controller for members' data and the brand's privacy notice is the one that applies to members. We process members' data on the brand's instructions under our Data Processing Agreement.
We are a controller for a small amount of member data where we have our own relationship with you, for example if you contact our support directly, or where we must keep records for security or legal reasons.
Payments for memberships and events go through the brand's own Stripe account using Stripe Connect. Stripe handles card details under its own privacy policy. We receive confirmation of payment, not card numbers. If you link a third party account such as Strava, we only receive what that service shares with the permissions you grant, and you can disconnect it at any time.
Nearby and location features are off unless you turn them on. When on, we use your approximate location to show you people, groups and events near you. You can turn it off in your settings.
Who we share data with
We share personal data with the providers below, who act as our processors unless stated. We do not sell personal data.
| Provider | What for | Location |
|---|---|---|
| Shopify | App hosting in your store, billing, install and uninstall data | Canada, US |
| Vercel | Website hosting and analytics | US, with edge servers worldwide |
| Railway | App hosting and databases | US |
| Cloudflare | Turnstile bot protection and network security | US, with servers worldwide |
| Resend | Transactional email, including the sign in codes for the web app | US |
| Klaviyo | Email, newsletter and forms | US |
| Cal.com | Session bookings | US |
| Stripe | Payments, and Stripe Connect for community platform payments. Stripe is an independent controller for card processing | US, Ireland |
| AI providers: Anthropic, OpenAI, Google, Perplexity, xAI | Generating scores, reports and other AI outputs | US |
| DeepSeek | Checking how your store appears in its answers. We send it public store content only, never account or customer data | China |
| Our email, document and accounting tools | Running the business | UK, EU, US |
We may also share data with professional advisers, insurers, a buyer if we sell the business, and courts, regulators or law enforcement where the law requires it. Where a PR partner or an on the ground community partner works on your engagement we will tell you, and they will be bound by confidentiality.
International transfers
We are based in the UK. Most of our providers are in the US and some are elsewhere. When we send personal data outside the UK or the European Economic Area we rely on one of the following:
- An adequacy decision, including the UK Extension to the EU to US Data Privacy Framework for certified US providers
- The International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
- The EU Standard Contractual Clauses for transfers from the EEA
You can ask us for a copy of the safeguards we rely on for a specific provider. Where we process personal data on a customer's behalf, our Data Processing Agreement at humanforward.io/dpa sets out the transfer mechanisms in detail.
How long we keep data
| Data | Kept for |
|---|---|
| Enquiries that do not become clients | 12 months from the last contact |
| Newsletter data | Until you unsubscribe, then a suppression record so we do not email you again |
| Booking and session records | 3 years from the session, longer if part of a client contract |
| Client contracts, invoices and correspondence | 6 years after the engagement ends, for tax and legal records |
| Free findability score submissions | 12 months |
| Shopify app store data | While the app is installed, then deleted within 30 days of uninstall |
| AI inputs and outputs | While your account is active and up to 90 days after, unless kept for an abuse investigation |
| Community platform member data | As instructed by the brand, and deleted or returned when the brand's contract ends |
| Security and access logs | 12 months |
We delete or anonymise data when it is no longer needed. Backups may hold copies for a short period after deletion.
Security
We protect data with encryption in transit and at rest, access controls, two factor authentication on our accounts, and providers that hold recognised security certifications. Our apps use Shopify's authentication and request only the permissions they need. Nobody can guarantee security, so if you think your data has been compromised tell us straight away at hello@humanforward.io. Where a breach is likely to put people at risk we will tell you and the relevant regulator as the law requires.
Your rights
Under UK and EU data protection law you can ask us to:
- Give you a copy of your personal data
- Correct anything inaccurate
- Delete your data, where we have no overriding reason to keep it
- Restrict or object to how we use it, including any use based on legitimate interests
- Give you your data in a portable format
- Stop using your data where we relied on your consent. Withdrawing consent does not affect what we did before
Email hello@humanforward.io. We will respond within one month, or tell you if we need longer. We may ask you to prove your identity. There is no charge unless a request is clearly unfounded or excessive.
If you are in the United States, state laws such as the California Consumer Privacy Act give you similar rights to access, delete and correct your data and to opt out of sale or sharing. We do not sell or share personal data for targeted advertising. If you are in Australia, the Privacy Act 1988 gives you rights to access and correct your data and to complain to the OAIC. Wherever you are, the contact above is the way to exercise your rights.
If we act as a processor, contact the brand or merchant who controls the data. We will help them respond.
Marketing
We only send marketing email if you sign up, or if you are an existing client and we are telling you about similar services. Every email has an unsubscribe link. You can also email hello@humanforward.io to opt out. We do not send marketing on behalf of other companies and we do not pass your details to anyone for their marketing.
Children
Our website, apps and services are for adults running or working in a business. We do not knowingly collect personal data from anyone under 18. Brands that run communities on our platform set their own minimum age, must comply with the law on children's data if they allow anyone under 18 to join, and must tell us before they do.
Cookies, changes and complaints
Our Cookie Policy explains the cookies we use and how to control them.
We may update this policy. The date at the top shows the current version. If a change matters to you we will tell you by email or a notice on the site before it takes effect.
If you are unhappy with how we handle your data, contact us first and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority if you are in the EU.
Market terms: Netherlands
These terms apply in addition to the document above when you are in the Netherlands, and prevail where they differ.
1. Who we are and which law applies
Human Forward LTD is a company registered in England and Wales, with no establishment in the European Union. Our relationship with you is governed by the law of England and Wales. That choice does not remove any protection given by a mandatory provision of Dutch or EU law, in particular the GDPR (in Dutch, the AVG), the Dutch GDPR Implementation Act (Uitvoeringswet AVG), the Telecommunications Act (Telecommunicatiewet) and, if you are a consumer within the meaning of article 6:230g of the Dutch Civil Code (Burgerlijk Wetboek, BW), the consumer law in Books 6 and 7 of the Civil Code (article 6(2) of Regulation (EC) No 593/2008, Rome I). That includes the rules on standard terms and conditions (algemene voorwaarden), with their black and grey lists (articles 6:236 and 6:237 BW). Those provisions prevail.
Provider details (article 3:15d BW). Provider: Human Forward LTD, a company incorporated under English law, registered at Companies House for England and Wales under number 17452304. Address: 66 Paul Street, London EC2A 4NA, United Kingdom. Contact: hello@humanforward.io. Represented by: the directors of the company, as entered in the public register of Companies House for England and Wales under number 17452304: find-and-update.company-information.service.gov.uk/company/17452304/officers. VAT identification number: we sell mostly to businesses, which account for VAT themselves under the reverse charge (verleggingsregeling). On sales to consumers, our payment providers (Stripe or Shopify) calculate, collect and remit the tax due in the customer's country at checkout on our behalf. No local VAT number is therefore shown here.
Representative in the Union (article 27 GDPR). Human Forward LTD is not established in the Union and is subject to the UK GDPR, which the European Commission has found to provide an adequate level of protection (adequacy decision, renewed in December 2025). We have assessed article 27(2) GDPR. Our processing of personal data of people in the EU is only occasional, is limited to business contact details, account data and publicly available website content, includes no special categories of personal data and no data relating to criminal convictions, and is unlikely to result in a risk to the rights and freedoms of natural persons. We therefore rely on the exemption in article 27(2) and have not designated a representative. We review this assessment as our customer base in the EU grows, and will designate a representative, named here, as soon as the exemption no longer applies. Until then you can exercise any right directly with us at hello@humanforward.io, and our data protection lead responds within the time limits of the GDPR.
2. Personal data in the Netherlands
Supervisory authority. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl. You can complain to it at any time.
Legal bases. The table in the Privacy Policy follows article 6 GDPR: contract (article 6(1)(b)), legal obligation (6(1)(c)), legitimate interest (6(1)(f)) and consent (6(1)(a)) for the newsletter. We send marketing by email only with your prior consent or, if you are already a customer, about our own similar services, provided you were given the chance to object when your details were collected (article 11.7(1) and (4) of the Telecommunications Act). You can unsubscribe free of charge in every message.
Cookies (article 11.7a of the Telecommunications Act). The website uses no cookies or similar technologies that require consent. We measure visits without cookies and without individual identifiers, and Cloudflare Turnstile is strictly necessary to keep the forms secure. If you choose a market yourself, with the market picker or in answer to the prompt asking whether you are in a particular country, we set one first party functional cookie, hf_market. It remembers your choice for a year so we do not ask you again. This cookie is strictly necessary to provide what you asked for (article 11.7a(3)(b)) and does not track you. The suggestion of which market suits you comes from a request to our own server, which reads the country of your IP address; no cookie is set for it. That is why there is no cookie banner. If this changes, we will ask for your consent first.
Transfers. Your data is processed in the United Kingdom, which is covered by an adequacy decision of the European Commission renewed in December 2025 until 2031. Transfers to providers in the United States rely on the EU to US Data Privacy Framework for certified providers, and otherwise on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
Retention and rights. The retention periods in the Privacy Policy apply in full. You have the right of access, rectification, erasure, restriction, objection and portability. Write to hello@humanforward.io. We respond within one month, which can be extended by two months for complex requests.
3. Payments, prices, VAT and right of withdrawal
On the Dutch pages, prices are shown in euros. Web plans are paid through Stripe, using the payment methods Stripe offers for your purchase: credit or debit card, Apple Pay, Google Pay, PayPal, Klarna, iDEAL | Wero, SEPA Direct Debit, Bancontact, Revolut Pay or Amazon Pay. Paid sessions are paid by card through Stripe only. Plans for a Shopify store are paid through Shopify Billing, in the currency Shopify shows. Consulting, Agents and the community platform are invoiced in the currency of your proposal and paid by bank transfer.
Prices exclude VAT. If you are a business in the Netherlands, VAT is reverse charged to you (article 12(2) and (3) of the VAT Act 1968, Wet op de omzetbelasting 1968); give us your VAT identification number. If you are a consumer, Dutch VAT is added at checkout and you see the total price including VAT (article 3:15d(2) and article 6:230m(1)(e) BW). Stripe or Shopify calculate, collect and remit that VAT at checkout on our behalf; no registration of our own under the One Stop Shop (OSS) is therefore shown here.
Right of withdrawal. If you are a consumer, you can withdraw from the contract within fourteen days of its conclusion without giving a reason (article 6:230o BW). You do this with a clear statement to hello@humanforward.io or with the model withdrawal form in Annex I, Part B, of Directive 2011/83/EU. The right is lost for a service we have fully performed with your express prior consent, where you have acknowledged that you give up your right of withdrawal once we have performed the contract (article 6:230p(d) BW). It is also lost for digital content not supplied on a tangible medium whose supply has begun with your express prior consent, where you have acknowledged that you thereby give up your right of withdrawal and we have confirmed this (article 6:230p(g) BW). If you buy a plan and start an analysis before the withdrawal period ends, you expressly ask us to start straight away and acknowledge that your right of withdrawal is lost to that extent. If you withdraw after that, you pay in proportion for what we have already provided (article 6:230s(4) BW). Separately, our Purchases and Refunds policy gives you, under conditions, a refund of the first month of a web plan if you ask within fourteen days. Businesses have no right of withdrawal. Consumers have the statutory conformity rights for digital content and digital services (articles 7:50aa and following BW). A consumer subscription can be cancelled online in your account, in the same way you took it out, or by a message to hello@humanforward.io (article 6:236(o) BW).
Disputes. If you are a consumer, you can also bring a dispute before the Dutch court for the place where you live (article 18(1) of Regulation (EU) No 1215/2012, Brussels I recast). The choice of the English courts in our terms does not change that (article 19 of that Regulation and article 6:236(n) BW). We are not affiliated with any consumer disputes body, are not obliged to be, and do not take part in alternative dispute resolution (article 6:230m(1)(t) BW). The European Commission's online dispute resolution platform was discontinued on 20 July 2025, so no link is given.
4. Language
English governs, except for information the law requires consumers to receive in Dutch; to that extent the Dutch version of this page governs.
5. Contact for the Netherlands
hello@humanforward.io. We respond within a reasonable time and within any period the applicable law sets. Human Forward LTD, 66 Paul Street, London EC2A 4NA, United Kingdom.
Local law review: pending. Say if you spot something we have got wrong at hello@humanforward.io.