Privacy notice

What we collect

• (a) When you apply for an invitation: your name, email, organisation, what you do, and your choices on the two tick boxes.
• (b) When you have an account: your name and email.  Your password is held only in scrambled (hashed) form by our database provider; nobody at Humphreys Law can see it.
• (c) When you sign in and use it: sign-in times, the device and browser used, and a record of security events such as failed sign-ins and changes to your account.
• (d) What you enter on a deal. During the beta this must be sample information only.  Deal information is never used for marketing or reports.

Why, and on what basis

• (a) To run the beta and your account, because it is needed to provide the service you asked for.
• (b) To keep the service secure and keep an audit record, because we have a legitimate interest in protecting it and its users.
• (c) To send you occasional news about H6YS Studio and Humphreys Law, only if you ticked the box.  You can withdraw at any time, using the link in any news email or by writing to hedz@humphreys.law.

Who handles it for us

We use four service providers, each bound to act only on our instructions: Supabase (database and sign-in, hosted in London), Vercel (hosting the site), Resend (sending emails) and Cloudflare Turnstile (checking that sign-ins come from a person, not a bot).  Vercel and Resend are based in the United States, so some information is transferred there.  For Vercel, the transfer is covered by the UK International Data Transfer Addendum to the EU standard contractual clauses, which forms part of Vercel’s data processing addendum.  For Resend, it is covered by the same safeguard in Resend’s data processing addendum; Resend is also certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge).  Supabase keeps the database in London, but some support, backups and logs may be handled outside the UK, under the standard contractual clauses in its data processing terms.  You can ask us for a copy of any of these safeguards.

How long we keep it

• (a) Applications that are declined: 2 years, in case the person applies again or asks about it.
• (b) Accounts: while the account is open, and 6 years after it closes, the usual period for legal claims.
• (c) Security and audit records: 6 years, to match the account records they relate to.
• (d) News permission: until you withdraw it.

Cookies

We use only the cookies needed to keep you signed in and secure.  There are no analytics, advertising or tracking cookies.

Your rights

You can ask for a copy of your information, and ask us to correct it, delete it, restrict its use or stop using it.  Write to hedz@humphreys.law.  If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office (ico.org.uk).

Changes

If we change this notice we will give it a new version number and date, and ask you to accept it the next time you sign in.