Which personal data do we collect from you?
- When you book a meeting with us, our scheduling service (Cal.com) collects your name, email address, and any additional information you provide in the booking form. Cal.com operates this form as an embedded third-party service on our website; please also refer to Cal.com's Privacy Policy.
- When you contact us by email, we receive your email address, name, and the content of your correspondence.
- Data we collect through cookies and similar technologies. For more information, please read our Cookies Policy.
- Anonymous usage data. We collect anonymous analytics data about how visitors use our website (pages visited, buttons clicked, general engagement patterns). Before you accept cookies, this runs cookielessly with no IP collection at all. Once you accept Analytics cookies, we derive your approximate location (country, region, city, and coarse coordinates) from your IP address for analytics purposes — we do not store your IP address, and we never collect your name, email address, or phone number through our website analytics. For details, see "Analytics and tracking" below.
Who controls and processes your personal data?
- The Data Controller for your data is the company "AI AND ME IDIOTIKI KEFALAIOUCHIKI ETAIREIA P.C." (trading as Humanbound), with registered address Karaoli and Dimitriou 11, 45221, Ioannina, Greece (Tax ID: 801775352, GEMI: 163102829000).
- Our website frontend is hosted by Vercel Inc. (United States). Vercel serves content via its global edge network and has certified under the EU-U.S. Data Privacy Framework; international data transfers are additionally covered by Standard Contractual Clauses.
- Our website content is managed through Sanity AS (Norway), which processes content data within the European Economic Area.
- If you contact us via email, Microsoft Corporation processes your data as our email service provider.
- Our analytics are processed by PostHog Inc. through their EU Cloud service (hosted in Frankfurt, Germany). PostHog acts as our data processor under a Data Processing Agreement.
- With your consent, the Reddit Pixel (provided by Reddit, Inc., United States) processes advertising attribution data. International data transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
- Cal.com Inc. processes booking data you provide through the embedded scheduling widget on our website. Cal.com acts as an independent data controller for data collected through their service and has certified under the EU-U.S. Data Privacy Framework.
All the above-mentioned parties are bound by confidentiality obligations and, where applicable, data processing agreements.
Why and on which legal basis do we process your personal data?
- To schedule and manage meetings you request, based on the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR).
- To respond to your enquiries when you contact us, based on our legitimate interests in communicating with prospective and existing clients (Art. 6(1)(f) GDPR).
- To keep our website secure and functioning, based on our legitimate interests (Art. 6(1)(f) GDPR).
- To understand how visitors use our website through anonymous, cookieless analytics (before consent), based on our legitimate interests in improving our website (Art. 6(1)(f) GDPR). No personal data is stored on your device in this mode.
- To analyse website usage through cookie-based analytics (after you accept cookies), based on your consent (Art. 6(1)(a) GDPR).
- To measure the effectiveness of our advertising through the Reddit Pixel (after you accept marketing cookies), based on your consent (Art. 6(1)(a) GDPR).
Analytics and tracking
We use the following services to understand how visitors interact with our website:
PostHog (EU Cloud — eu.posthog.com): Our primary analytics tool. Before you make a consent choice, PostHog runs in cookieless mode — it collects anonymous page view and engagement events without storing anything on your device and without collecting your IP address. If you accept Analytics cookies, PostHog stores a persistent anonymous identifier in your browser's local storage to recognise returning visits, and derives your approximate location (country, region, city, and coarse coordinates) from your IP address for analytics purposes. We do not store your IP address, and we never collect your name, email address, or phone number through PostHog on our website. Autocapture, session recordings, heatmaps, and surveys are all disabled.
Reddit Pixel: Loads only if you accept marketing cookies. It records that you visited our site and, if a conversion event occurs, that a lead event took place. It collects standard advertising signals (browser and device information, screen size, and a Reddit click identifier). The pixel does not load and sends nothing unless you accept marketing cookies. See our Cookies Policy for more detail.
In all cases, we do not collect or send to our analytics providers on this website your name, email address, or phone number. The only IP-derived data our website analytics process is the approximate location (country, region, city, and coarse coordinates) described above, and only after you accept Analytics cookies — your IP address itself is never stored.
How long do we keep your data for?
- If you contact us, we will retain the communication and its metadata until you ask us to delete it, unless it needs to be retained for a longer period for a legitimate reason or for our compliance with a legal obligation.
- Booking data received through Cal.com is retained for as long as necessary to manage the business relationship and any follow-up, and is deleted upon request.
- Analytics data in PostHog is retained for 1 year.
- For cookies and local storage retention periods, please refer to our Cookies Policy.
Which rights do you have?
Under the General Data Protection Regulation (GDPR), you may ask us:
- To provide you with a copy of the personal data we keep about you (right of access).
- To correct any data that is inaccurate or incomplete (right of rectification).
- To erase your data (right of erasure), subject to any legal retention obligations.
- To stop processing your data or limit its processing to certain uses (right to restriction / right to object).
- To receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller (right to data portability).
- To withdraw your consent at any time where processing is based on consent (e.g. for the use of cookies). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
How can you exercise your data rights?
If, at any time, you would like to exercise your rights or ask any question regarding your personal data, please contact us at:
legal@humanbound.ai
We will respond to you within 30 days from the reception of your request.
If you feel that the protection of your personal data has been violated, you may file a complaint with the Hellenic Data Protection Authority (Archi Prostasias Dedomenon Prosopikou Charaktira) — www.dpa.gr.
Changes to this notice
We may update this Privacy Notice from time to time. The most recent version will always be available at this page, and the "Last updated" date at the top will reflect the date of the most recent revision.
