Privacy Policy

1. Who we are (data controller)

The data controller for the Human Sender service is Blustrix OÜ, a private limited company registered in Estonia (registry code 16864889), with registered address at Ahtri tn 12, Tallinn, 15551, Estonia.

For all privacy-related requests, contact us at legal@humansender.com.

2. What data we collect and why

Account data

When you register, we collect your email address and, if you complete SMS verification, your phone number. We use this to authenticate you and send you service notifications. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Profile data

You may optionally provide a display name, profile photo, and LinkedIn profile URL. This data is publicly visible on your Human Sender profile page and on verification pages shown to recipients of your signed messages. Legal basis: consent (Article 6(1)(a) GDPR). You can update or remove this data at any time.

Verification codes and message data

When you sign a message, we store the code, a timestamp, an optional recipient hint (email address), an optional message preview (subject line and recipient first name, where provided), and optionally a hash of the message body. We do not store the full message body. Codes expire after 30 days. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Chrome extension data

When you use the Human Sender Chrome extension, it reads the contents of your active email compose window — specifically the recipient email addresses, subject line, and message body. The message body is processed locally in your browser: only a SHA-256 hash of the body is transmitted to our servers, never the raw text. The subject line and recipient's first name are transmitted to our servers to populate the message preview shown on the verification page. The extension stores your authentication session token in Chrome's local extension storage to keep you signed in. We do not read, store, or transmit any email content beyond the fields described above. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Identity verification data

Level 1 verification requires a real-time selfie and passive liveness check (micro-movement and pulse detection via camera). Level 2 additionally requires a government-issued identity document and an ID-to-face match. These processes are handled by our third-party provider Didit (didit.me). We receive a verification result and confidence score; we do not store raw identity document images or raw biometric data ourselves. Legal basis: consent (Article 6(1)(a) GDPR).

Technical and usage data

Our infrastructure (Vercel and Supabase) automatically logs IP addresses, browser type, timestamps, and pages visited as part of normal server operation. We also use Vercel Analytics, which collects anonymised, aggregated usage data (page views, device type, country) to help us understand how the Service is used. No personally identifiable data is shared with Vercel Analytics. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

3. Data sharing and processors

We do not sell your personal data. We share it only with the following sub-processors:

All processors operate under data processing agreements that require them to handle data in compliance with GDPR.

4. International transfers

We store all personal data in EU regions (Frankfurt). We do not transfer personal data to countries outside the European Economic Area (EEA) except where covered by an adequacy decision or Standard Contractual Clauses.

5. How long we keep your data

We retain data for the following periods:

• Account data: for the lifetime of your account, then deleted within 30 days of account deletion.
• Message codes: 30 days from creation. Expired codes are purged automatically.
• Live call codes: 2 minutes from creation. Expired codes are purged automatically.
• Profile data: retained until you update or delete it, or delete your account.
• Server logs: up to 90 days, as retained by our infrastructure providers.
• Identity verification records: we retain only the resulting verification level and the date it was completed. Raw document images and biometric data are retained per Didit's data retention policy.
• Extension session tokens: stored locally in your browser's Chrome extension storage and cleared when you sign out of the extension.

6. Your rights under GDPR

As a data subject under GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate data (most profile data you can update directly in your dashboard).
• Erasure: request deletion of your personal data ("right to be forgotten").
• Portability: receive your data in a structured, machine-readable format.
• Restriction: request that we limit processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at legal@humansender.com. We will respond within 30 days.

7. Cookies and local storage

Human Sender uses only strictly necessary session cookies set by Supabase for authentication. Vercel Analytics uses anonymised, cookieless measurement techniques and does not set advertising or tracking cookies. We do not use advertising cookies, tracking pixels, or third-party analytics cookies that require consent under the ePrivacy Directive.

If we introduce non-essential cookies in the future, we will update this policy and obtain your consent first.

8. Children

The Service is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The "last updated" date at the top of this page will always reflect the current version.

10. Complaints

If you have a concern about how we handle your personal data, please contact us first at legal@humansender.com.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the supervisory authority for data protection in Estonia:

www.aki.ee · info@aki.ee · +372 627 4135

EU residents may also contact the supervisory authority in their country of residence.

11. Contact

For any privacy question or request:

legal@humansender.com
Blustrix OÜ · Registry code 16864889
Ahtri tn 12, Tallinn, 15551, Estonia