Privacy policy

1. Scope and contact

This policy covers humansourcer.com, HumanSourcer Prep and our hosted tools and contact forms. Bradley Fehler, trading as HumanSourcer, is an individual operator established in the United Kingdom and the controller responsible for the processing described here. Contact privacy@humansourcer.com for privacy questions and requests.

Listed providers and websites you visit through outbound links have their own policies. We do not control their hiring decisions or how they handle your application. Where a separate agreement governs a customer dataset, that agreement identifies our role and instructions; this policy does not authorize reuse of that dataset.

2. Information we collect

• Contact and subscription details. Newsletter and Prep waitlist forms collect your email address and source page. Waitlist records also include the signup order, email permission, wording/version, time and form used. Older signups retain their actual capture method; we do not record a checkbox acceptance that never happened.
• Requests and correspondence. Research-access forms can include your institution and intended use. Provider forms include the provider name, request type, an optional feed/API URL and message. We receive what you write to our contact address. A submitted feed URL is reviewed by a person, not fetched automatically.
• Apply-link records. Our redirect records the provider, role, destination URL, referring URL, source page, time and browser user-agent, with a bot classification. This click table does not store an IP address or account ID. Individual URLs or user-agents can nevertheless contain identifying information; raw records are not the same thing as anonymous aggregate counts.
• Page and performance information. Vercel Web Analytics counts page use without analytics cookies. Vercel Speed Insights measures page performance and related route/URL, browser/device, network and country-level information. These tools are not used to build advertising profiles and do not load on practice account or graded-session pages. Hosting and security providers also process request information, which can include an IP address, browser, URL, timestamp and errors, to deliver and protect the service. A first-party request address does not mean no service provider processes the request.

Local tools. Free samples and the private annotator process answers and files in your browser. Depending on the tool, progress stays in page memory or browser-local storage. These tools do not upload your work to us. Exporting a file does not submit it to HumanSourcer. Closing a page can clear memory; clearing site storage removes locally saved progress. The page itself still has the technical collection described above. A future connected tool must explain its upload and model-provider choices before use.

Hosted practice accounts. We store your email, account identifier, access/entitlement and waitlist information, items served, answers, preferences/ratings, confidence when requested, justifications, highlighted evidence, flags, submission times and active-page duration. Some exercises record the number of pasted characters. Results are derived from stored answers and versioned scoring rules; they are not a hiring decision or proof of AI authorship. Supabase Auth records sign-ins, including the IP address and browser it came from, for authentication and security. We do not receive a password through our magic-link/code sign-in form. At practice sign-in we also check your declaration that you are aged 18 or over. The form does not request your date of birth or identity documents; the declaration is not an independent age-verification check.

We currently collect no payment-card details. Do not submit identity documents, credentials, confidential employer material or another person's private information. We do not request sensitive personal information such as a learner's health history, biometric identity or precise location. Free text can contain it if you supply it; contact us if it needs removal.

Provider and role information also comes from publicly available provider pages, job boards and authorized feeds. Those sources can identify people as well as companies. We use this information to maintain the directory and evidence links; contact us about a correction or privacy concern involving a named individual.

3. Purposes and lawful bases

Where EU or UK data-protection law applies, we use these bases for the specified purposes:

• Consent (Article 6(1)(a)). Delivering the digest you request and the separately selected Prep beta/launch emails. Joining one list does not join the other. Any future optional contribution uses its own purpose-specific permission; newsletter consent and acceptance of terms do not cover it.
• Requested service or contract (Article 6(1)(b)).Providing the practice you request, managing access, saving answers, deriving results and responding to a request to enter an agreement, where that processing is necessary.
• Legitimate interests (Article 6(1)(f)). Responding to general/provider inquiries, maintaining contact records and the public directory, measuring useful pages and redirects, diagnosing performance, preventing abuse, protecting accounts and establishing or defending claims. We use the information needed for these interests and consider the effect on individuals. You may object as described below.
• Legal obligations (Article 6(1)(c)). Responding to lawful requests, exercising privacy rights and retaining records where the law requires.

You can browse free resources without giving an email address. An address is necessary for requested emails and hosted sign-in; declining optional contributions does not reduce course access, scores or founding-member benefits. We may use genuinely anonymous statistics to understand and improve the service. Removing a name alone does not make a record anonymous, and this paragraph does not permit model training on ordinary answers.

4. Optional data contributions

The contribution program is not currently available.Ordinary hosted answers are never sold or shared for another organization's own purposes and are never used as training data for any model. Our providers process them only to deliver the service. This policy introduces no training, licensing or publication permission by itself.

If we offer contributions, participation will be for adults aged 18 or over, optional and separate from ordinary practice and marketing choices. Before collecting permission we will describe the submissions covered, data categories, purposes, recipients, retention and withdrawal process. Choices will initially be unchecked and will distinguish:

• Developing, evaluating and training HumanSourcer's AI models and products, including commercial products.
• Sharing or commercially licensing selected contributions to identified external organizations for specified research, evaluation or model-training uses.
• Publishing selected contributions in a public dataset or research material, with a clear explanation of what becomes public.

We will record the choice, wording/version, time and submissions it covers. Work collected under earlier no-training or no-sale promises stays excluded unless you separately authorize specified past work. A materially different purpose requires a new notice and permission where required; there is no blanket authorization for any future purpose. Permission for your contribution cannot override rights in an underlying photograph, dataset or another person's data.

You will be able to withdraw as easily as you opted in. Withdrawal ends future processing based on that consent; it does not make earlier lawful processing unlawful. We will assess deletion and restriction requests and inform recipients when required. Deleting a source record does not automatically remove its influence from an already trained model, and public copies may be difficult to recover. Those limits are not a waiver of your legal rights or an exemption from required deletion, mitigation or other action.

5. Cookies and browser storage

Hosted practice uses sign-in cookies needed to maintain your session, set when you sign in. We use no advertising cookies, cross-site advertising pixels or analytics cookies. Local practice storage holds your own work to provide the tool you request. Cookie/storage choices and any additional consent required for new nonessential technologies will be explained before those technologies are enabled. Browser privacy settings may affect sign-in or local saving.

6. Recipients and disclosures

• Vercel: hosting, request/security handling, Web Analytics and Speed Insights.
• Supabase: database storage and, when accounts are enabled, authentication and practice records.
• Kit: email address and relevant segment for digest, Prep or research-access correspondence. Provider-contact forms are not sent to Kit.
• Resend: waitlist confirmations and hosted sign-in messages; the email delivery system processes the recipient and message.
• HubSpot: email address and signup-source label from newsletter, waitlist, research-access and provider-contact forms, for contact management.

Kit and HubSpot do not receive your free-text request or practice answers through these form integrations. Inclusion in a contact system is not permission for unrelated marketing. We do not send your email address or ordinary practice answers to listed providers for recruitment.

We may disclose information to comply with a valid legal obligation, protect people or the service, or establish or defend a claim, subject to applicable law. In a financing, merger or transfer of the business, relevant information may be reviewed or transferred subject to confidentiality and applicable law. A successor must respect the commitments and permissions under which the information was collected; a business transfer does not expand training rights.

No contribution recipients are currently authorized. A future external contribution program must identify the recipients and purposes before permission and disclosure. Email addresses are not sold, rented or provided to another organization for its own marketing.

7. International processing

The Supabase production database is hosted in Northern Virginia, United States (us-east-1). Vercel functions are configured for US East (iad1); its distributed network serves the site. These and our other providers can process information in the United States and other countries, including outside the UK/EEA. Where restricted international-transfer rules apply, an appropriate mechanism is required, such as an applicable adequacy decision or standard contractual clauses and any necessary UK instrument and additional safeguards. Optional contribution consent is not a substitute for those requirements. Contact us for information about processing locations and the safeguards applicable to your information, including how to obtain a copy.

8. Retention and deletion

Your account and answers are kept while you maintain the account. Successful self-service deletion removes the account, attempts and practice access from the active practice database. It does not unsubscribe a separate newsletter/waitlist record. Provider security logs and backups may persist under their retention arrangements; deletion from every backup is not instantaneous. Remaining copies must not be used for ordinary practice or new training.

Contact/subscription records are kept while the requested contact or subscription continues. Request correspondence is kept for handling the request and any related dispute. Raw click and technical records are kept for reporting, security investigations and troubleshooting; the relevant reporting period and any unresolved investigation determine the need for retention. Genuinely anonymous aggregate statistics can be retained longer.

When you unsubscribe or request erasure, we stop the relevant emails and remove information no longer needed, including from our contact providers as appropriate. A minimal suppression or permission record may be kept to respect your choice, demonstrate compliance or handle a legal claim, for as long as that purpose requires. Retained records are restricted to that purpose. Any future contribution notice must specify its retention before you opt in.

9. Your rights and requests

Email privacy@humansourcer.com to request access, correction, a copy, deletion or information about a use of your data. You do not need an account to contact us. We may ask for proportionate information to confirm your identity or an agent's authority before disclosing or deleting records; we do not require unnecessary identity documents. We may redact other people's information and explain any lawful exception.

UK/EEA. Where applicable, you have rights to access, rectify, erase, restrict processing, portability, withdraw consent and object to processing based on legitimate interests. Rights depend on the circumstances and legal basis. We respond without undue delay, normally within one month; a permitted extension will be explained within that month. You can complain to your local supervisory authority, including the UK Information Commissioner's Office.

United States. Depending on your state and whether its law applies, you may have rights to know/access, correct, delete, obtain a portable copy, opt out of sale, targeted advertising or certain profiling, and limit sensitive-data use. California residents may also use authorized agents. Applicable California access/correction/ deletion requests are acknowledged within 10 business days and answered within 45 calendar days, subject to a permitted extension. Other requests follow the applicable deadline. If a request is denied, you can reply to appeal; we will explain the decision and any applicable complaint or appeal route. We do not unlawfully discriminate for exercising privacy rights.

Sale, sharing and privacy signals. We currently do not sell personal information or share it for cross-context behavioral advertising. Commercial licensing of identifiable or pseudonymous contributions could be a sale under state law; calling it research or obtaining an opt-in does not remove opt-out obligations. Before enabling such a use, we will provide the required notices, methods and recognition of applicable universal opt-out signals, including Global Privacy Control. We do not use cross-site tracking in response to a Do Not Track setting or otherwise; Do Not Track is distinct from GPC.

Practice feedback compares answers with published human references using stated scoring rules. It does not decide employment, credit or insurance eligibility. Contact us to report a scoring error or request review; automated feedback does not remove your applicable rights.

10. Children and sensitive submissions

HumanSourcer Prep, including lessons, practice and any future data-contribution program, is intended only for adults aged 18 or over. We do not offer learner accounts to anyone under 18. If you believe a child has submitted information, contact us so we can investigate and take the action required by law, including deletion where appropriate. An age statement is not parental consent.

11. Security

We use HTTPS and database/account access controls and limit access to service purposes. No system is completely secure. Protect access to your email account and sign-in codes, and report a suspected incident to our contact address. We will provide any breach notices required by applicable law. Neither these terms nor our service providers' terms waive our legal duties.

12. Changes and prior commitments

We update this policy when practices change and show the date above. Material changes are brought to affected users' attention through an appropriate direct or prominent service notice, before a new use where required. Continued browsing or silence is not consent to model training, licensing or publication. Earlier commitments remain applicable to previously collected work unless you give a valid, separate permission covering it. You can keep ordinary practice access while declining optional contributions.

HumanSourcer is independent of listed providers. Read how we make money and our terms of use. Privacy requests and corrections: privacy@humansourcer.com.