last updated 21 October 2026 · Human Forward LTD · hello@humanforward.io
Privacy policy
This policy explains what personal data Human Forward LTD collects, why, who we share it with and what your rights are. It covers our website, our sessions, our Shopify apps, our AI tools and our community platform.
Who we are and how to contact us
Human Forward LTD is the controller for the personal data described in this policy, except where we say we act as a processor. We are a company registered in England and Wales under number 17452304. Our registered office is 66 Paul Street, London EC2A 4NA. We trade as Human Forward.
Contact us about anything in this policy at hello@humanforward.io or by post at the address above. We are registered with the Information Commissioner's Office.
What this policy covers
This policy covers personal data we handle through:
- Our website at humanforward.io, including enquiry forms, newsletter sign up, session bookings and the free findability score
- Sessions and consulting work, including intro calls, paid working sessions and client engagements
- Our Shopify apps, including the Findability app, and any subscription services sold through them
- Our AI tools, whether used on the website, in an app or as part of a service
- Our community platform, including white label apps we run for brands
We act as a controller when we decide why and how personal data is used. That covers our website visitors, our clients and the merchants who install our apps.
We act as a processor when we handle personal data on a client's instructions. That covers your customers' data if you give one of our apps or services access to it, and the members of a community we host for a brand. In those cases the client or brand is the controller, their privacy notice applies, and our Data Processing Agreement governs what we do. Contact the brand or merchant first if you want to exercise your rights over that data. We will help them respond.
The data we collect
| Where | What we collect | Where it comes from |
|---|---|---|
| Website visits | Pages viewed, approximate location, device and browser type, referring site, bot checks | Automatically, through our hosting and the Cloudflare Turnstile captcha. See our Cookie Policy |
| Enquiry and interest forms | Name, email, company, website, what you want help with | You |
| Newsletter | Email, name, how you signed up, which emails you open and click | You, and our email tool |
| Session bookings | Name, email, company, time zone, the session booked, anything you add to the booking, NDA details, meeting notes and recordings where you agree to them | You, and our booking tool |
| Free findability score | The store or website domain you submit, your email if you ask for the results, the score and report we generate | You, and public content on the domain |
| Client work and invoicing | Contact details, contract and billing details, correspondence, work product | You |
| Shopify apps | Store name and domain, store owner name and email, app settings, usage, scores and reports, subscription status. Only if you grant it and the app needs it: order and customer data | Shopify when you install, and your use of the app |
| AI tools | The inputs you submit, the outputs we generate, usage logs | You, and the AI providers we use |
| Community platform (brands) | Brand admin names, emails, roles, billing contact, Stripe account connection | The brand |
| Community platform (members) | Profile, email, posts and messages, event bookings and payments, approximate location if you turn on nearby features, connected accounts such as Strava if you link them | Members, processed on the brand's behalf |
We do not deliberately collect special category data, such as health or religion. If you include it in a message, a session or a community post we hold it only as part of that content.
How we use your data and our legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Answer enquiries and run sessions | Contact details, booking details, notes | Contract, or steps before one |
| Deliver our apps, AI tools and subscriptions | Store data, inputs, outputs, usage, billing status | Contract |
| Bill and collect payment | Billing details, subscription status | Contract, legal obligation |
| Send our newsletter and updates | Email, name, engagement | Consent. For existing clients, our legitimate interest in telling you about similar services, with an opt out in every email |
| Run, secure and improve the services | Usage logs, device data, bot checks, aggregated results | Our legitimate interest in a service that works and is not abused |
| Enforce our terms and Acceptable Use Policy | Usage logs, account data | Legitimate interest, legal obligation |
| Keep records and meet legal duties | Contracts, invoices, correspondence | Legal obligation |
We do not make automated decisions about you that have legal or similarly significant effects. Our AI tools produce recommendations. People decide what to do with them.
AI processing
Our AI tools send what you submit, and relevant content from your store or site, to third party AI providers to generate a result. Depending on the tool this includes Anthropic, OpenAI, Google, Perplexity, xAI, DeepSeek and any other engine named in the app you are using. We use these providers under their business API terms. Under those terms they do not use your inputs or outputs to train their models, and they keep data only for a limited period for abuse monitoring.
We do not train our own models on your data. We keep inputs, outputs and scores to provide the service, show you your history, investigate abuse and improve the tools. We may use aggregated and anonymised results, such as average scores across all stores, in our research and marketing. That data cannot identify you or your store.
Do not put personal data about other people into our AI tools unless you have a lawful basis to share it with us. You are responsible for what you submit.
Our Shopify apps
When you install one of our apps Shopify sends us your store's domain, the store owner's name and email, and the permissions you grant. Each app asks only for the access it needs. The Findability app reads public store content such as products, collections, pages and theme settings, and does not request access to your customers' personal data. If a future app or service needs order or customer data we will say so at install, and our Data Processing Agreement will apply to it.
Billing for our apps runs through Shopify. We see your subscription status but not your payment card details.
When you uninstall an app Shopify tells us. We delete your store data within 30 days of uninstall unless we need to keep it for billing records or a legal reason. We also honour Shopify's data request and deletion webhooks for customer data.
The community platform
Brands use our platform to run their own communities, including white label apps published in the brand's name. The brand decides who can join, what the community is for and how members' data is used, so the brand is the controller for members' data and the brand's privacy notice is the one that applies to members. We process members' data on the brand's instructions under our Data Processing Agreement.
We are a controller for a small amount of member data where we have our own relationship with you, for example if you contact our support directly, or where we must keep records for security or legal reasons.
Payments for memberships and events go through the brand's own Stripe account using Stripe Connect. Stripe handles card details under its own privacy policy. We receive confirmation of payment, not card numbers. If you link a third party account such as Strava, we only receive what that service shares with the permissions you grant, and you can disconnect it at any time.
Nearby and location features are off unless you turn them on. When on, we use your approximate location to show you people, groups and events near you. You can turn it off in your settings.
Who we share data with
We share personal data with the providers below, who act as our processors unless stated. We do not sell personal data.
| Provider | What for | Location |
|---|---|---|
| Shopify | App hosting in your store, billing, install and uninstall data | Canada, US |
| Vercel | Website hosting and analytics | US, with edge servers worldwide |
| Railway | App hosting and databases | US |
| Cloudflare | Turnstile bot protection and network security | US, with servers worldwide |
| Resend | Transactional email, including the sign in codes for the web app | US |
| Klaviyo | Email, newsletter and forms | US |
| Cal.com | Session bookings | US |
| Stripe | Payments, and Stripe Connect for community platform payments. Stripe is an independent controller for card processing | US, Ireland |
| AI providers: Anthropic, OpenAI, Google, Perplexity, xAI | Generating scores, reports and other AI outputs | US |
| DeepSeek | Checking how your store appears in its answers. We send it public store content only, never account or customer data | China |
| Our email, document and accounting tools | Running the business | UK, EU, US |
We may also share data with professional advisers, insurers, a buyer if we sell the business, and courts, regulators or law enforcement where the law requires it. Where a PR partner or an on the ground community partner works on your engagement we will tell you, and they will be bound by confidentiality.
International transfers
We are based in the UK. Most of our providers are in the US and some are elsewhere. When we send personal data outside the UK or the European Economic Area we rely on one of the following:
- An adequacy decision, including the UK Extension to the EU to US Data Privacy Framework for certified US providers
- The International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
- The EU Standard Contractual Clauses for transfers from the EEA
You can ask us for a copy of the safeguards we rely on for a specific provider. Where we process personal data on a customer's behalf, our Data Processing Agreement at humanforward.io/dpa sets out the transfer mechanisms in detail.
How long we keep data
| Data | Kept for |
|---|---|
| Enquiries that do not become clients | 12 months from the last contact |
| Newsletter data | Until you unsubscribe, then a suppression record so we do not email you again |
| Booking and session records | 3 years from the session, longer if part of a client contract |
| Client contracts, invoices and correspondence | 6 years after the engagement ends, for tax and legal records |
| Free findability score submissions | 12 months |
| Shopify app store data | While the app is installed, then deleted within 30 days of uninstall |
| AI inputs and outputs | While your account is active and up to 90 days after, unless kept for an abuse investigation |
| Community platform member data | As instructed by the brand, and deleted or returned when the brand's contract ends |
| Security and access logs | 12 months |
We delete or anonymise data when it is no longer needed. Backups may hold copies for a short period after deletion.
Security
We protect data with encryption in transit and at rest, access controls, two factor authentication on our accounts, and providers that hold recognised security certifications. Our apps use Shopify's authentication and request only the permissions they need. Nobody can guarantee security, so if you think your data has been compromised tell us straight away at hello@humanforward.io. Where a breach is likely to put people at risk we will tell you and the relevant regulator as the law requires.
Your rights
Under UK and EU data protection law you can ask us to:
- Give you a copy of your personal data
- Correct anything inaccurate
- Delete your data, where we have no overriding reason to keep it
- Restrict or object to how we use it, including any use based on legitimate interests
- Give you your data in a portable format
- Stop using your data where we relied on your consent. Withdrawing consent does not affect what we did before
Email hello@humanforward.io. We will respond within one month, or tell you if we need longer. We may ask you to prove your identity. There is no charge unless a request is clearly unfounded or excessive.
If you are in the United States, state laws such as the California Consumer Privacy Act give you similar rights to access, delete and correct your data and to opt out of sale or sharing. We do not sell or share personal data for targeted advertising. If you are in Australia, the Privacy Act 1988 gives you rights to access and correct your data and to complain to the OAIC. Wherever you are, the contact above is the way to exercise your rights.
If we act as a processor, contact the brand or merchant who controls the data. We will help them respond.
Marketing
We only send marketing email if you sign up, or if you are an existing client and we are telling you about similar services. Every email has an unsubscribe link. You can also email hello@humanforward.io to opt out. We do not send marketing on behalf of other companies and we do not pass your details to anyone for their marketing.
Children
Our website, apps and services are for adults running or working in a business. We do not knowingly collect personal data from anyone under 18. Brands that run communities on our platform set their own minimum age, must comply with the law on children's data if they allow anyone under 18 to join, and must tell us before they do.
Cookies, changes and complaints
Our Cookie Policy explains the cookies we use and how to control them.
We may update this policy. The date at the top shows the current version. If a change matters to you we will tell you by email or a notice on the site before it takes effect.
If you are unhappy with how we handle your data, contact us first and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority if you are in the EU.