Privacy Policy

Last updated: October 2026

1. Who We Are

HumanKey (“we”, “us”) provides AI traffic intelligence services. This policy explains how we collect, use, and protect personal data in compliance with the GDPR and ePrivacy Directive.

Data Controller: Robert Pałka ChainGuard, Zawiercie, Poland · Tax ID (NIP) 6492230699 · contact@humankey.io
HumanKey is the name of the service.
Contact: Contact Form (Privacy Inquiries)

2. Data We Collect

Account Data

• Email address; name (optional — if you create the account with Google, the name from your Google account is entered; you can change it in Dashboard → Settings)
• Google account identifier — only if you use Google sign-in (see section 2A)
• Hashed password (industry-standard algorithm) — only if using email/password authentication
• Account metadata: plan tier (Free, Pro, Business, or Enterprise), role (user/admin), registration timestamp, email verification status
• The new email address you ask to change to — kept until you confirm it; if you do not confirm it, we normally delete it within 48 hours (the confirmation link is valid for 24 hours; unconfirmed addresses are removed by a daily clean-up)
• Stripe customer ID (created when you start checkout for a paid plan, even if you do not complete it)

New accounts receive a 14-day Pro trial. No payment information is required during the trial period.

Who else sees your name and e-mail address. If you use team features, the owner of a team sees the name and e-mail address of its members and the e-mail addresses of the people invited; members see the name and e-mail address of the owner, and invited people see the owner's name if one is set. A message you send from the product to a person whose address you enter — a team invitation, or set-up instructions for a technical contact — carries your name if you have set one. If a person you sent such a message to asks us who sent it, and the request comes from the address the message went to, we tell them your name or, if you have not set one, your account's e-mail address, as far as our records still show it.

Account health score. Once a day we compute an internal score for each customer account from its plan and how the service is used: whether the tracking code on your sites sends data, recent activity in the account, and whether a subscription is active. It is not shown in your dashboard; our team uses it to decide which customers to contact, for example to offer help. It does not change your account or your plan by itself. The legal basis is our legitimate interest in looking after our customers (Art. 6(1)(f) GDPR). The daily scores are kept until the account is deleted and are deleted with it.

Traffic Analysis Data

• IP addresses: In stored traffic data kept only in pseudonymised form (a keyed hash) — never as a raw address
• User-Agent strings: Truncated to 200 characters for bot classification only
• Page URLs and referrer URLs (for traffic analysis)
• Visit timestamps and duration
• Bot classification results (human/bot, confidence score)
• Country-level geographic data: Derived from IP address via a geolocation database (stored as country code only — no city or precise location data)
• Session Pattern Analysis: Aggregated session patterns processed by our proprietary analysis engine. Stored in our EU database. Used exclusively for identifying coordinated bot activity — no individual profiling.
• Network operator: looked up locally in the IP database from the IP address; no data is sent to the database provider.
• Interaction metrics: Aggregate measures of how the page is used (pointer, keyboard, scroll and click activity), linked to the visit
• Heatmap data (where the feature is active): Click and scroll coordinates, movement samples and viewport dimensions for the pages visited, stored linked to the visit that produced them and deleted together with it

Device and Browser Signals (read during the visit, not stored)

To classify a request as human or automated, our detection script reads the following categories of information from the visitor’s browser and device. These signals are evaluated for that single decision and are not written to our database:

• Display characteristics (such as screen properties)
• Browser and platform characteristics (such as platform, language preferences and hardware the browser reports)
• Graphics characteristics that your browser reports
• Indicators that the browser is remote-controlled or scripted

Only the outcome of that evaluation — the human/bot classification and its confidence score — is stored, as listed above. Reading information from a visitor’s terminal equipment is governed by Art. 5(3) of Directive 2002/58/EC, implemented in Poland by art. 399 of the Prawo komunikacji elektronicznej. On this website that reading takes place only after you consent through our banner. On our customers’ websites the customer is the controller and is responsible for the lawfulness of that access.

When you use our website or dashboard, our hosting and network providers process the IP address and User-Agent of each request and keep them in their platform logs for a limited period under their retention policies (see the list of sub-processors).

2A. Sign in with Google — data we receive from Google

This section applies when you create an account or sign in with Google.

• Google sends. For the three permissions we request (openid, email, profile), Google's answer can include: an identifier of your Google account, your e-mail address, whether Google has verified that address, your name and further profile details such as the address of your profile picture. Not all of them are always present.
• We read. Four of them: the identifier, the e-mail address, the verification flag and the name. We use the flag to decide whether the address may be used to find or create an account. We obtain these data with one request that carries an access token issued by Google; we do not store that token.
• We keep. The identifier, so that we recognise your Google sign-in next time; and, if the sign-in creates a new account, the e-mail address and the name, which become that account's e-mail address and name, together with the information that the address is verified. If the sign-in is linked to an account that already exists, that account's e-mail address and name stay as they are.

We use these data to create your HumanKey account and to sign you in; when the sign-in creates the account, the e-mail address and the name become your account's e-mail address and name and are handled as this policy describes for account data (sections 2, 3 and 5) — for example, it is the address to which we send the account's e-mails, and the name is shown in your dashboard. We keep them in our account database; its provider and location are listed in section 9. They are passed to the service providers listed in section 9 to the extent each of them handles account data, and your name and e-mail address are visible to other people in the cases described under “Account Data” in section 2. How we protect them is described in section 10. How long account data is kept is described in section 7; section 8 describes how to delete the account, what is then deleted and what the law requires us to keep; your rights concerning these data are set out in section 5. You can remove HumanKey's access in the settings of your Google Account. Removing the access there does not delete your HumanKey account or the data listed above; to delete them, delete the account as described in section 8.

2B. People without a HumanKey account

This section is for you if you do not have a HumanKey account and we received your e-mail address because a HumanKey user invited you to a team, a HumanKey user sent you set-up instructions as the technical contact for a website, or you wrote to us.

• What we hold and where it comes from. If you were invited to a team: your e-mail address, entered by the user who invited you, and records of the invitation; for a short time after an invitation we also keep a pseudonymised form of your address to prevent abuse of invitations. If you received set-up instructions: we use your address to send the message the user asked us to send; we do not keep it in our own systems. If you wrote to us: your address, your message with its attachments, any other details you gave in a contact form (such as your name or company), and our replies.
• Why. To deliver the message our user asked us to send and, for an invitation, to keep a record of it for the user who sent it; if you wrote to us, to answer you. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in running the service our users ask for and in answering the messages we receive; for a message sent through one of our contact forms, it is the consent you gave in the form (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• How long. An invitation is deleted after it expires (it is valid for 7 days) or when it is accepted, declined or withdrawn. Records of the invitation (when it was sent, sent again, withdrawn or declined), with your address, stay in the inviting user's activity log for up to 5 years. Our e-mail providers keep the messages we send, including their content, and delivery logs under their own retention policies (see our list of sub-processors). Messages you sent us and our replies are kept for as long as needed to deal with your matter, and then for as long as they may be needed to establish, exercise or defend legal claims; if you withdraw your consent or ask us to delete them, we delete them unless they are still needed for that purpose. When our team opens, archives, restores or answers your message, a note of that, with your address and the message's subject (for a message sent through our contact form, the subject is made from details you gave, such as your name or company), stays in our internal activity log for up to 5 years from that step.
• Who sees it. The user who invited you sees your address in their team, in their activity log and in the e-mail we send them if you decline. A user who sent you set-up instructions entered your address themselves. If you wrote to us, our team reads your message. Our e-mail providers process your address to deliver messages (see our list of sub-processors).
• Your rights. You can ask us what we hold about you, ask us to correct, delete or restrict it, or object to its use, at humankey.io/contact#privacy. We answer within the time the GDPR sets (one month, which it allows to be extended in the cases it names). You can also complain to a supervisory authority; in Poland it is the President of the Personal Data Protection Office (UODO).

3. Legal Basis (GDPR Art. 6)

• Contract performance: Processing account data to provide our service
• Legitimate interest: Bot detection and traffic classification to protect website owners
• Consent: Optional first-party analytics on this website, including the reading of information from your browser and device that it requires (via the consent banner)

You accept our Terms of Service, and confirm that you have read this Privacy Policy, either (a) via an explicit checkbox during email registration, or (b) on a dedicated acceptance screen shown after OAuth sign-in (Google). That acceptance forms the contract under which we process your account data (Art. 6(1)(b)) — it is not consent, and it is separate from the legitimate interest basis for bot detection (Art. 6(1)(f)). Providing account data is a contractual requirement: without it we cannot create or operate your account (Art. 13(2)(e)). The only processing we base on your consent (Art. 6(1)(a)) is the optional first-party analytics on this website — including the reading of information from your browser and device that it requires — and enquiries you choose to send us through our contact forms.

Automated Processing (Art. 22 GDPR)

Our bot detection uses automated classification of web traffic requests through a proprietary multi-layered analysis methodology. The classification runs on our EU infrastructure — visitor data is not sent to external services for it (the network providers listed below only route and protect requests). This automated processing does not produce legal effects or similarly significantly affect your website visitors — it classifies network requests, not individuals. Visitors whose requests are classified as non-human traffic are not individually profiled or subjected to consequential automated decisions. Additionally, a proprietary analysis pipeline is used to identify coordinated bot farm activity — this is an informational technique and does not result in automated blocking of any individual visitor.

We also use an AI language model to periodically analyze aggregated platform metrics (detection counts, confidence distributions, bot volume trends) and generate advisory recommendations for detection system improvement. This analysis works on statistical summaries; to identify unknown automated clients it also receives User-Agent strings of individual visits classified as automated and, when an administrator reviews detection results, numeric interaction features of individual sessions — always without an IP address, IP hash or session identifier. All of these recommendations require manual administrator review. Customer-initiated AI features (such as crawler recommendations) send your site's domain, its public robots.txt, your crawler allow/block settings and aggregate per-site and per-crawler visit counts; their results are advisory and are shown to you directly.

We may send you periodic email notifications about your site's bot traffic (daily reports, weekly AI-generated insights, new crawler alerts, quota warnings). You can control each notification type independently in Dashboard → Settings → Email Notifications. Both the weekly AI insight emails and the optional AI insight included in the daily report use aggregated metrics of your site (the daily report sentence also includes your site's domain name) — for these two features no visitor-level data is sent to the AI model.

AI Assistant Chatbot: HumanKey provides an AI-powered chatbot assistant on our website and dashboard. Conversations are processed by an AI language model to generate responses. Only the text of your chat messages, a system prompt we assemble and — if you are signed in — coarse account context (such as your plan, the number of sites, which features are in use and a traffic-volume band) are sent to the AI model; no email address, name, IP address or session identifier is transmitted. Your messages contain personal data only if you type it. All conversations are ephemeral: they are held in server memory only while the conversation is in use and are removed about 30 minutes after your last message; they are never stored in any database. Conversations cannot be recovered after the session ends. The AI assistant provides advisory information only and cannot make binding decisions. In compliance with EU AI Act Article 50, the assistant is clearly marked as AI-powered and a link to human support is always available.

In addition to automated classification, HumanKey reviews the quality of classification results, including review by HumanKey staff; in addition, certain automated checks may also confirm a classification. These verification labels are informational only, do not constitute automated decision-making under Art. 22 GDPR, and do not produce legal or similarly significant effects on website visitors. Each label is stored with a hashed identifier — a hashed administrator identifier for manual reviews, or a hashed IP address for automated signals — solely for audit and detection-quality purposes; no additional personal data is collected and no data is transmitted outside HumanKey.

Aggregated Trend Analysis: HumanKey periodically aggregates historical traffic patterns into anonymized daily statistics (visitor counts by category: human, bot, unknown, blocked). This aggregated data contains no personal information and cannot be used to identify individual visitors. Processing basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Data Minimisation

We follow the principle of data minimisation. In stored traffic data, IP addresses are kept only as a keyed hash, User-Agent strings are truncated, and we only retain data necessary for traffic analysis.

5. Your Rights

Under the GDPR, you have the right to:

• Access: Export your account, site, and traffic data (JSON) from Dashboard → Settings → Export Data
• Erasure: Delete your account from Dashboard → Settings → Delete Account. Records the law requires us to keep (for example refund records for tax purposes) are kept only as long as the law requires, then deleted; section 8 sets out what is deleted and what we keep.
• Portability: Download your data in JSON format
• Rectification: Update your profile information in Dashboard → Settings
• Restriction (Art. 18): ask us through our contact form to restrict the processing of your data in the cases the GDPR sets out.
• Object (Art. 21): where we rely on our legitimate interest (Art. 6(1)(f)), for example for bot detection or the account health score, you can object at any time on grounds relating to your particular situation, through our contact form.
• Withdraw consent (Art. 7(3)): Where we rely on your consent, you can withdraw it at any time, as easily as it was given — withdrawal does not affect the lawfulness of processing carried out before you withdrew. For analytics cookies, use the preferences tool on our Cookie Policy page. For an enquiry you sent us through a contact form, use our contact form (Privacy & GDPR). Your account data is not processed on consent — it is processed to perform our contract with you (Art. 6(1)(b)), so this right does not apply to it; see Erasure above.

6. Cookies

• Essential: Authentication tokens (httpOnly, secure) — required for login
• Optional: Analytics cookies — only set with your consent

7. Data Retention

Visit data retention depends on your plan:

• Free plan: 7 days
• Pro plan: 30 days
• Business plan: 90 days
• Enterprise plan: 365 days

Data beyond these periods is automatically and permanently deleted. Account data is retained until you delete your account. After a plan downgrade — including the end of a trial or a subscription cancellation that keeps your account active — a 7-day grace period applies during which you retain access to your previous plan's features; after it ends, data older than the new plan's retention period is deleted as described above. (Deleting your account is different — it cancels any active subscription immediately; see our Terms of Service.)

8. Account Deletion & Data Portability

Deletion

You may delete your account at any time from Settings > Account > Delete Account. When you delete your account, your sites, visit data, API keys and analytics are deleted from the service; copies in backups expire on the database provider's backup cycle. Records the law requires us to keep (for example refund records for tax purposes) are kept only as long as the law requires, then deleted. We also keep one record of which versions of the Terms of Service were accepted on the account and when. It is linked only to a keyed hash of the account's e-mail address (no IP address, no browser data) and kept for 5 years from the deletion to establish, exercise or defend legal claims about the contract (legitimate interest, Art. 6(1)(f) GDPR; exemption under Art. 17(3)(e) GDPR), then deleted by the same retention job. Audit log entries created by other organizations that interacted with you as a team invitee have your email address scrubbed (replaced with a redacted marker) while preserving the third-party's audit-trail continuity.

Data Portability

GDPR data portability (your personal data) is available on all plans. Analytics data export (CSV) is available on Business plans and above.

9. Sub-Processors & Third-Party Services (GDPR Art. 28)

We use the following vendors to deliver our service. Where a vendor processes personal data on our behalf, a Data Processing Agreement meeting GDPR requirements is in place. Some entries below transfer no personal data at all — we only download a public file they publish — and so are listed for transparency rather than as processors. See our full Sub-Processors list with data locations and DPA links.

Right to Object: If you object to data transfers outside the EU, contact us via our contact form. Note that some services (billing, sign-in with Google) involve companies that also process data in the United States — not using them may limit functionality.

10. Security

We implement industry-standard encryption in transit and at rest, password hashing, token-based authentication, rate limiting, and access controls to protect your data.

Account isolation: Each dashboard session is fully isolated from other sessions in the same browser. Logging out triggers a full client-state purge (session storage, query cache, per-user settings) and a hard page reload, so no account ever inherits another account's data — consistent with GDPR Article 32 (security of processing).

Browser security headers: HumanKey enforces industry-standard browser security policies including Content Security Policy, cross-origin resource protection, and referrer policy. These headers prevent unauthorized script injection, resource theft, and data leakage across origins. Our Content Security Policy is strict by design — we do not permit dynamic code evaluation, and we never embed third-party scripts that we cannot audit. If your browser reports console warnings from installed extensions while visiting a HumanKey-enabled site, those warnings come from the extension, not from our service. See our troubleshooting guide for common browser warnings and their causes.

11. Data Protection Impact Assessment

Our systematic bot monitoring processing has been assessed under GDPR Article 35. View the summary of the Data Protection Impact Assessment (DPIA) for details on risk assessment, safeguards, and compliance measures.

11A. Embeddable Verified Badge

Customers on Pro+ plans may opt in to embed our HumanKey Verified Badge on their websites. When a visitor loads a page containing the badge, the visitor's browser fetches an SVG image from api.humankey.io. This HTTP request includes the visitor's IP address and User-Agent and, optionally, a Referer header. Our application does not store the visitor's IP address or User-Agent from a badge request in its traffic data; badge requests are rate-limited. The recommended embed snippet includes Referrer-Policy: no-referrer to suppress the Referer header. Legal basis: GDPR Art. 6(1)(f) legitimate interest — trust signaling for our customers and visitor transparency about AI traffic monitoring. The Legitimate Interest Assessment (LIA) is documented in our DPIA.

12. Children's Data

HumanKey is a business-to-business (B2B) service intended for website owners and operators. We do not knowingly collect data from individuals under 18 years of age. If you become aware of a minor using the Service, please contact us via our contact form.

13. Contact

For privacy-related inquiries, contact us via our contact form. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). In Poland this is the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.