Privacy Policy
Effective September 18, 2026 · Last updated
In short: we collect what we need to run your surveys and bill for them, we don't sell your data or use your surveys to train AI models, and you can ask us to access or delete your data at any time.
1. Who we are
HumanPanel (“HumanPanel,” “we,” “us”) provides the HumanPanel service at humanpanel.ai. We are the controller of the personal data described in this policy. When we process personal data that you include in your surveys on your behalf, we act as your processor under our Data Processing Addendum.
Contact us about privacy at any time: contact@humanpanel.ai.
2. Data we collect
| Category | What it includes |
|---|---|
| Account | Your email address, when your account was created and when you last signed in. |
| Sign-in and security | One-time sign-in codes (stored only as keyed hashes), session tokens (stored only as hashes), and the IP address and browser user agent used when you request a code or sign in. |
| Survey content | Surveys you create: titles, descriptions, target population descriptions and questions. |
| Results | Data generated for your runs: worlds, simulated respondent profiles, answers, statistics and summaries, plus run activity such as progress and token usage. |
| Billing | Wallet transactions (top-ups, run charges, refunds) and, from our payment provider, order identifiers, amounts, currency, and the email and customer identifier used at checkout. We do not receive full card details. |
| Communications | Messages you send us and the emails we send you, such as sign-in codes and run notifications. |
| Usage analytics | Pages you visit, how you navigate, device and browser type, approximate location derived from your IP address, clicks, scrolls and mouse movement, and, when you are signed in, your pseudonymous account ID (never your email address). Collected with Google Analytics and Microsoft Clarity, subject to your cookie choice. Clarity records how pages are used as session replays, with text you type into form fields masked. |
| Technical | Server logs with IP address, request details and errors, used to operate and secure the Service. |
Please do not include personal data about other people, or sensitive data such as health information, in your surveys unless you have a lawful basis to do so.
3. How we use data and our legal bases
- Providing the Service: creating your account, signing you in, running your surveys, showing and emailing results. Legal basis: performance of our contract with you.
- Billing: managing your wallet, charging completed runs and handling refunds. Legal basis: contract and our legal obligations, such as tax and accounting.
- Security and abuse prevention: rate limiting sign-in attempts, detecting misuse and keeping the Service reliable. Legal basis: our legitimate interest in protecting the Service and its users.
- Support and service communications: answering your messages and telling you about important changes. Legal basis: contract and legitimate interests.
- Improving the Service: understanding which pages and features are used and where people get stuck, measured with Google Analytics and Microsoft Clarity. Legal basis: your consent where required (for example in the EEA, UK and Switzerland), otherwise our legitimate interest in improving the Service.
- Legal compliance: responding to lawful requests and enforcing our Terms. Legal basis: legal obligation and legitimate interests.
4. AI models, training and selling data
To run your survey, we send your survey content and the population description, along with generated worlds and respondent profiles, to AI model providers through their business APIs. We use these providers only to generate your Results.
- We do not use your surveys or Results to train AI models.
- We use provider API offerings that do not use API inputs or outputs to train their models by default.
- We do not sell your personal data or share it for cross-context behavioral advertising.
5. Who we share data with
We share personal data only with service providers that help us run the Service, under contracts that protect it:
| Provider | Purpose | Data |
|---|---|---|
| AI model providers (OpenAI and/or Anthropic) | Generating worlds, respondents, answers and summaries | Survey content and generated run data |
| Polar | Checkout, payments, taxes and refunds (merchant of record) | Email, customer identifier, order and payment data |
| Google (Gmail API) | Sending sign-in codes and run notifications | Email address and message content |
| Google (Google Analytics) | Measuring how the website and app are used | Usage data, device data, IP-derived approximate location, pseudonymous account ID |
| Microsoft (Clarity) | Understanding how the website and app are used through heatmaps and session replays | Usage data including clicks, scrolls and page content, device data, IP-derived approximate location, pseudonymous account ID |
| Cloud hosting and database providers | Hosting the application and storing data | All data described in this policy |
Polar processes payment data as an independent controller under its own privacy policy. We may also disclose data if required by law, to protect rights and safety, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.
6. Cookies and local storage
- Session cookie (necessary): a secure, HTTP-only cookie that keeps you signed in for up to 30 days.
- Preferences (necessary): your light or dark mode choice and your cookie choice, stored in your browser's local storage.
- Analytics cookies (optional): Google Analytics cookies (
_ga,_ga_*) and Microsoft Clarity cookies (_clck,_clsk) that help us understand usage, kept for up to 2 years. In the EEA, UK and Switzerland they are set only after you accept; elsewhere you can decline. Change your choice at any time with “Cookie settings” in the site footer.
We do not use advertising cookies, and advertising features in Google Analytics are turned off. Google's use of analytics data is described at policies.google.com/technologies/partner-sites, and Microsoft's in the Microsoft Privacy Statement.
7. How long we keep data
- Account, surveys and Results: while your account is active, and deleted within 30 days after you ask us to delete your account.
- Sign-in codes expire after 10 minutes; sessions expire after 30 days or when you sign out.
- Billing records: as long as required by tax, accounting and other legal obligations.
- Server logs and backups: for a limited period needed for security and recovery, after which they are deleted or overwritten.
8. Security
We protect data with encryption in transit (HTTPS), access controls, hashing of sign-in codes and session tokens, signature verification of payment webhooks and least-privilege access for our team. No method of transmission or storage is completely secure, but we work to protect your data and will notify you of breaches as required by law.
9. International transfers
Our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent mechanisms for the United Kingdom and Switzerland.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data or delete your data;
- object to or restrict certain processing, and receive your data in a portable format;
- withdraw consent where we rely on it;
- not be discriminated against for exercising privacy rights (for example under California law);
- complain to your local data protection authority.
To exercise any right, email contact@humanpanel.ai from the address on your account. We may need to verify your identity and will respond within the time required by applicable law, generally within 30 days.
11. Children
The Service is not directed to children and is only for people aged 18 or older. If you believe a child has given us personal data, contact contact@humanpanel.ai and we will delete it.
12. Changes to this policy
We may update this policy. We will change the “last updated” date and, for material changes, notify you by email or in the Service before the changes take effect.
13. Contact
Privacy questions and requests: contact@humanpanel.ai.