Privacy Policy
TrustHuman Ltd ("TrustHuman", "we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, why we collect it, and how we use and protect it. It applies to everyone who visits trusthuman.co.uk or uses our assessment service.
1. Who we are
TrustHuman Ltd is the data controller for personal data collected through this website and service. If you have any questions about how we handle your data, contact us at hello@trusthuman.co.uk.
2. What personal data we collect
When you create an account
- Email address — used to create and authenticate your TrustHuman account via Netlify Identity, and to email you your results when a report is saved (you can turn these emails off in your account). We do not store passwords; authentication is managed by Netlify Identity, which handles credential storage securely on our behalf.
- Your AI inventory — the name you give each AI, its domain name (e.g.
chat.yourcompany.com, never the full address or a key), its type and industry, and, for Tailored, your 3 answers about it. If it signs in with a client ID and secret, we also keep how to call it: the sign-in address and the action and field names, never the secret. We use it to group your reports by AI and to fill in your answers next time. It is deleted with your account. - When you last used your account — recorded when you open your account page or save an assessment, so we can apply the retention policy in section 4.
- Sign-in codes — when you sign in we email you a one-time code; we keep only a scrambled copy, which stops working after 10 minutes (it's replaced by your next code and deleted with your account). If you choose to remember a device, it stays signed in for up to 30 days.
- Which assessments are enabled for your account (for example, whether you can run a Tailored Assessment), your assessment limit, how many Tailored reports you have left and until when, and how many checks and connection tests you've run today (to apply the daily limit; replaced each day).
- For full reports, a verification code printed on the PDF. Anyone you give the code to can check the report is genuine at trusthuman.co.uk/verify, which shows only the report number, date, the AI tested, score, rating and assessment type — never the findings, the AI's answers or the fixes. The code is deleted with the report.
When you run an assessment
- Your AI endpoint and credentials — the endpoint address and any API key or token you enter are used only to send our synthetic test probes to your AI tool during the assessment. We never store your full endpoint address or your credentials; we keep only the domain name (e.g.
api.yourcompany.com). The one exception is Heartbeat, below. - Your assessment record — when an assessment completes we store, against your account: your account email and user ID, your endpoint's domain name, your industry category and optional assessment label, your TrustHuman Score™ and pillar and probe scores, the synthetic probe message sent for each probe, and your AI tool's response to each probe. We keep the probe messages and responses because they appear in your report, so you can see exactly what was tested and what your AI said.
- If you run a Tailored Assessment, the answers you give about your AI tool — what it does, who it affects, the categories of data it handles, the risks you select and how serious they are, the controls you have in place, and two optional short descriptions. We use these only to choose which extra checks to run and to show in your report what was tested and why. They are stored with that report. Please don't include personal data in the optional descriptions.
If you switch on Heartbeat
- Your AI's full address and a test-only key (or, if it signs in that way, its client ID and secret) — so we can run the same assessment every month. They are stored locked (encrypted with a key kept only on our server), are never shown back to you (only the last 4 characters of the key or secret), are never logged, and are used only for these monthly checks. We delete them when you stop Heartbeat, when your Heartbeat year ends without being renewed, or when you delete your account.
- Your Heartbeat settings and history — the AI's domain name, its label, industry and type, for a Tailored Assessment the answers it repeats, the day each month it runs, and for each check the date, score, rating and report reference. The monthly reports are saved and emailed like any other report.
- Your Heartbeat plan — when it was paid, how many checks are left and when it ends.
When you register interest
- Your name (if given) and email address, and which page you registered interest from — used to contact you about the feature you asked about.
When you contact us
- Name, email address, and the content of your message — used to respond to your enquiry.
Technical data
- If you accept analytics cookies, Google Analytics collects information about how you use the site (pages visited, device and browser type, approximate location). See section 7.
- If an assessment fails to reach your endpoint, we log the error with your endpoint's domain name only — never the full address or credentials.
3. Lawful basis for processing
- Contract — we process your email address to create and maintain your account, and we store your assessment records against your account (including any Tailored Assessment answers and which assessments are enabled for you), and if you switch on Heartbeat we store your AI's address and test-only key to run the monthly checks you asked for, all of which are necessary to provide the assessment service.
- Legitimate interests — we use assessment records for quality assurance and service improvement while your account exists, we keep error logs to keep the service working, we keep interest sign-ups to tell you about the feature you asked about, and we keep contact form messages to deal with your enquiry.
- Consent — we only use Google Analytics if you accept analytics cookies. You can change your choice at any time.
- Legal obligation — when we delete your account we keep a minimal record (an anonymised reference and the date, with no email address or other personal data) so we can show we honoured your request.
4. How long we keep your data
- Account and assessment records — kept while your account is in use, so you can see your report history. You can delete your account and all associated data at any time from your account page; deletion is immediate. Reports are also deleted when you delete a report, that AI, or your Other reports, in your AI inventory; this is immediate too. You can also email hello@trusthuman.co.uk, and we will act within 30 days.
- Tailored Assessment answers — kept with the report they belong to and deleted with it: when you delete your account, when you ask us to, or under the inactive-account rule below.
- Heartbeat address and test-only key — deleted when you stop Heartbeat, when your Heartbeat year ends without being renewed, or when you delete your account. Your Heartbeat history is kept with your reports and deleted with your account.
- Inactive accounts — if you don't use your account for 23 months we email you to say it will be deleted. If you still haven't signed in a month later, your account and all its records are deleted.
- Interest sign-ups — deleted 12 months after you register.
- Contact form messages — deleted 12 months after you contact us.
- Error logs — deleted after 90 days.
- Deletion records — the anonymised reference and date described in section 3 are kept as evidence that we deleted your data. They contain no personal data.
These periods are applied automatically by a daily process, and we review the data we hold every month.
5. Who we share your data with
We do not sell your personal data. We share it only with the following sub-processors, who help us deliver the service under their data processing terms:
- Netlify, Inc. — hosts the website and our data storage, provides account sign-in (Netlify Identity), and stores contact form messages.
- Resend, Inc. — sends our emails, such as your report results, account deletion confirmations and inactivity warnings.
- Google LLC — provides Google Analytics, only if you accept analytics cookies.
Your AI tool's responses are scored by fixed, human-written rules within TrustHuman's own assessment service. They are not sent to any AI provider.
We may also disclose personal data where required by law or to protect the rights, property, or safety of TrustHuman, our users, or others.
6. Your rights
Under UK GDPR and the Data Protection Act 2018 you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your personal data (subject to legal obligations).
- Restriction — ask us to limit how we use your data while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
To exercise any of these rights, email us at hello@trusthuman.co.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the ICO (the Information Commission, formerly the Information Commissioner's Office) at ico.org.uk.
7. Cookies and local storage
We ask before setting any analytics cookies. If you accept, Google Analytics sets cookies to measure how the site is used; if you decline, no analytics cookies are set. We do not use advertising cookies.
We also use your browser's local storage, which stays on your device, to remember your cookie choice and to keep you signed in. Signing out or deleting your account clears your sign-in data.
8. Data security
We use industry-standard measures to protect your personal data, including encrypted connections (HTTPS), access controls, and secure infrastructure provided by Netlify. No method of transmission or storage is completely secure; in the event of a data breach that affects your rights and freedoms we will notify you and the ICO as required by law.
9. International transfers
Netlify, Resend and Google are based in the United States, so your data may be processed there. Transfers are made under appropriate safeguards, including the UK International Data Transfer Addendum or standard contractual clauses, or the UK–US data bridge where the provider is certified.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top will reflect the most recent change. Continued use of the service after changes are posted constitutes acceptance of the updated policy.
11. Contact
For any privacy-related questions: hello@trusthuman.co.uk
TrustHuman Ltd · trusthuman.co.uk