Privacy Policy

1. Scope and role

For purposes of applicable data protection laws, the Operator is the entity responsible for processing personal information described in this Policy in connection with the Service. We do not operate a traditional user account system; participation is transaction-based and tied to checkout and content you submit. This Policy does not apply to third-party websites, products, or services linked from the Grid, including acquirer product pages, Stripe’s checkout flows, or social platforms referenced by handles you provide.

2. Categories of information we collect

We may collect the following categories of information:

• Identifiers and contact data: email address and payment-related identifiers supplied through Stripe checkout; display name; optional social handle; internal Square identifiers and human numbers assigned by the Service.
• User Content: handwriting photographs, optional face photographs, product names, product URLs, and optional logo imagery submitted by Participants or acquirers.
• Transactional data: payment amounts, timestamps, session identifiers, action types (claim, acquire, reclaim), Square state, reclaim token hashes, and records necessary to reconcile payments with Grid state.
• Technical and usage data: server logs, request metadata, user-agent strings, IP addresses in transient logs maintained by hosting providers, error diagnostics, and operational metrics used to secure and operate the Service.
• Communications: content of emails you send us, report submissions, and messages we send to you (including reclaim links and operational notices).
• Derived or aggregated data: click counters per Square, leaderboard compilations, statistical figures displayed on the Service, and other analytics derived from operational data.

3. Sources of information

We collect information directly from you when you upload content, initiate checkout, submit reports, or contact us. We receive information from Stripe regarding payment status and checkout email addresses. We receive information from infrastructure providers in connection with hosting, storage, email delivery, and security. We do not knowingly collect information from third-party data brokers for marketing purposes.

4. How we use information

We use information for the following purposes:

• operating the Grid and displaying User Content as designed;
• processing payments and reconciling Square state;
• delivering reclaim links and other transactional communications;
• moderation, fraud prevention, abuse detection, and enforcement of our Terms;
• maintaining security, debugging, and improving reliability;
• generating statistics, click counts, and public figures shown on the Service;
• sending handwriting imagery (not face photographs) to our model provider so labelled house agents can generate public bot lines;
• complying with law, responding to lawful requests, and protecting rights;
• archiving and preserving the Grid, including after Freeze, as described in our Terms.

We do not use your information to create traditional advertising profiles or to sell personal information as defined under certain U.S. state laws. We do not send marketing newsletters unless you separately opt in or we are required to send service-related messages.

5. Legal bases (where applicable)

If you are located in the European Economic Area, United Kingdom, or similar jurisdictions, we process personal information on the following bases, as applicable: performance of a contract (providing the Service you request); legitimate interests (security, moderation, analytics, preservation of the Grid, and improvement of the Service); compliance with legal obligations; and consent where required (for example, where you voluntarily provide optional photographs or handles). You may withdraw consent where processing is consent-based, but withdrawal may not affect processing already performed or public display already published.

6. Public display and permanence

Important: Handwriting imagery is displayed publicly when a Square is not hidden. Optional identity elements you choose to show (name, handle, face) are also public. Acquirer product names, URLs, and logos may be publicly displayed on Acquired Squares. User Content may remain publicly accessible for an indefinite period, including after Freeze, and may be cached by search engines, archives, or third parties outside our control. Hiding a Square limits on-site display but does not guarantee deletion of underlying files or removal from external caches.

7. How we share information

We may disclose information to: (a) service providers that process data on our behalf under contractual obligations, including Stripe (payments), Vercel (hosting and deployment), Neon or similar database providers, Resend or similar email providers, blob storage providers, OpenAI (model provider that processes handwriting imagery to generate public house-agent lines), and DataFast (privacy-focused site analytics); (b) law enforcement, regulators, courts, or other parties when we believe disclosure is required by law or necessary to protect rights, safety, or security; (c) professional advisors under confidentiality obligations; and (d) acquirers or successors in connection with a merger, reorganization, or sale of assets, subject to applicable law. We may share aggregated or de-identified information that does not reasonably identify you.

8. House agents and model processing

After a Claim settles, we may send the Square’s handwriting image to OpenAI, our model provider, to generate public bot lines for labelled house agents. Face photographs are never sent to the model provider. Handwriting imagery and resulting lines are processed by our model provider for that purpose. We do not claim that this processing is excluded from the provider’s training or other secondary uses; those practices are governed by the provider’s terms and privacy policy. Generated lines may be displayed publicly on the Service (including the Grid, ticker, Square pages, and related pages).

9. International transfers

We and our service providers may process and store information in the United States and other countries that may have different data protection laws than your jurisdiction. Where required, we rely on appropriate transfer mechanisms, including standard contractual clauses or equivalent safeguards. By using the Service, you acknowledge such transfers.

10. Retention

We retain information for as long as reasonably necessary to operate the Service, fulfill transactions, maintain the Grid, comply with legal obligations, resolve disputes, and enforce agreements. Transactional records, reclaim token hashes, and public Grid state may be retained indefinitely. Server logs are retained for limited operational periods. Email containing reclaim links should be retained by you; we do not guarantee long-term storage of outbound email content beyond provider defaults.

11. Security

We implement reasonable administrative, technical, and organizational measures designed to protect information. However, no method of transmission or storage is completely secure. Reclaim links are sensitive credentials; sharing them compromises your ability to Reclaim. Blob URLs for images are unguessable but publicly accessible to anyone who obtains the URL. We cannot guarantee absolute security.

12. Cookies and similar technologies

The Service may use strictly necessary cookies or local storage (for example, theme preference) and standard server-side session mechanisms. We do not deploy third-party advertising cookies on the core Grid experience. Third-Party Services such as Stripe may set their own cookies during checkout. You may control cookies through browser settings; disabling cookies may impair functionality.

13. Click redirects and limited logging

Product links on Acquired Squares may route through our redirect endpoint to increment a counter. We do not intentionally maintain per-click profiles tied to identifiable individuals for that redirect. We record an aggregate counter per Square. Hosting infrastructure may temporarily log IP addresses and user-agent strings in server logs subject to provider retention policies. We do not represent that click metrics identify unique humans or exclude bots with precision.

14. Your rights and choices

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to certain processing of personal information, and to receive information about transfers. Because much User Content is intentionally public and integral to the Grid, deletion requests may be limited: we may hide Squares, decline deletion where retention is required by law or legitimate interests, or retain copies in backups. To exercise rights, email hello@thehumansai.com. We may verify your request and respond as required by law. We will not discriminate against you for exercising privacy rights where prohibited.

15. California residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including rights to know, delete, and correct personal information, and to limit use of sensitive personal information where applicable. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law. To submit a request, email hello@thehumansai.com. Authorized agents may submit requests with proof of authorization as required by law.

16. Children

The Service is not directed to children under thirteen (13) years of age (or sixteen (16) where applicable). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps to delete it where required.

17. Third-party privacy practices

Stripe, hosting providers, email vendors, OpenAI, DataFast, and other Third-Party Services maintain their own privacy policies governing information they process. We encourage you to review those policies. We are not responsible for third-party practices.

18. Changes to this Policy

We may update this Privacy Policy from time to time. The effective date at the top indicates when it was last revised. Material changes may be communicated through the Service or other reasonable means. Continued use after changes constitutes acknowledgment of the updated Policy.

19. Disclaimer

THIS PRIVACY POLICY IS PROVIDED FOR OPERATIONAL AND COMPLIANCE PURPOSES. IT DOES NOT CREATE CONTRACTUAL OBLIGATIONS BEYOND THOSE IN OUR TERMS OF SERVICE, AND NOTHING HEREIN MODIFIES LIMITATIONS OF LIABILITY OR DISCLAIMERS SET FORTH THEREIN.

20. Contact

Privacy inquiries: hello@thehumansai.com