H U M A N I X

Humanix Privacy Policy

Version 2.6
Effective 30 September 2026
Humanix Ltd, registered in Cyprus, HE 496907
Version reference: privacy-2.6-2026-09-30

This policy replaces the Humanix Privacy Policy dated 10 September 2026, Version 2.1, in full, and takes effect on 30 September 2026. Version 2.2, published on 14 September 2026 to take effect on 15 October 2026, Version 2.3, published on 19 September 2026 to take effect on 26 October 2026, Version 2.4, published on 21 September 2026 to take effect on 26 October 2026, and Version 2.5, which was to take effect on 5 October 2026, are all withdrawn and never take effect. This version says everything Version 2.4 said, with the correction Version 2.5 made to sections 3.2, 5 and 8. So it changes four things from Version 2.1. Sections 3.2, 5 and 8 now say what we do with the interaction signals recorded while you write: they are kept as a record and decide which contributions a person looks at first, and they do not decide whether we accept a contribution or what it is worth. Section 5 also says that a person may read a contribution before any payment reaches it, and that one they reject earns nothing. Section 3.3 now says that some of the optional profile questions touch on sensitive things, that none of them asks for anything that identifies you, and that the answers you give can be attached to your contributions and included in the data we license. Section 3.4 is new: it says we assess what you write for traits, and that those traits are attached to your contributions and licensed too. Sections 4 and 6 say the same.

1. What this policy is for

This policy tells you what we do with information about you. It covers everyone who uses humanix.me, whether you are contributing, browsing or in touch with us about something else.

If anything in it is unclear, write to privacy@humanix.me and we will explain it.

2. Who we are

Humanix Ltd, a company registered in the Republic of Cyprus with registration number HE 496907, whose registered office is at Omonoias, 52, Troodos Court, 1st floor, Flat/Office 3, 3052, Limassol, Cyprus, is the controller of your personal information.

Being the controller means we decide what is collected and why, and we are answerable for it.

Our data protection lead is reachable at privacy@humanix.me, or by post at the registered office above.

3. What we collect

3.1 What you give us

When you register: your email address, a password, and confirmation that you are over 18.

When you complete your profile: information about who you are, which may include your age band, country of residence, first language, education, occupation, industry, and areas of expertise. Every one of these is self-reported and optional. Nothing about your location is inferred from your IP address, your phone number or your device settings.

When you evidence a credential: whatever document or reference you choose to send us.

When you contribute: the text of your answers, the ratings and labels you apply, the questions you propose, and anything else you type into the platform.

When we pay you: the account details you give to our payment provider, and the identity documents that provider asks for.

When you contact us: whatever you put in the message.

3.2 What we record while you use the platform

Technical information about your session: IP address, browser, operating system, device type, timestamps, the pages you visit, and attributes of your browser and device.

Interaction signals. While you are writing a contribution, the platform records how the writing happened. We set them out in detail so you can see what we record.

We record when you first interacted with the answer box and when you sent it; how many keys you pressed; the average gap between your keystrokes and how much those gaps varied, together with your fastest and slowest typical gaps and how many gaps were shorter than a quarter of a second; how many times you pasted and how many characters each paste contained; how many times the answer box lost focus and how long in total it was out of focus; how many times you pressed backspace or delete, and how many times you typed or pasted over text you had selected; and how long your finished answer was. We also record how much of your writing session each of these figures covers, so that saving a draft repeatedly does not count the same writing twice.

When text arrives in the answer box by pasting, dropping, dictation, an input method, or a spellchecker or an autocorrect replacing a word, or whenever more than one character arrives at once, we record how it arrived, how many characters it brought, when it arrived and how many keys you had pressed before it. Each time the answer box loses focus or gets it back, we record when, and how many keys you had pressed before it. We keep the first 200 of these each time your answer is saved, and a count of any beyond that. For a paste we also record the kinds of content your clipboard said it was carrying, such as plain text or formatted text, and the length of any formatting that came with it. The formatting itself is not sent to us. We also record the time our server first saw you start an answer, and the length of the answer each time it is saved.

We keep these signals as a record of how each contribution was written, and we use them to decide which contributions a person looks at first. They do not decide whether we accept a contribution, whether we hold it for a person to review, or what it is worth. You can paste, and an answer that arrives pasted, or with no signals at all, is valued in the same way as any other.

We also look across your most recent contributions that carry these signals, ten at present. If none of them shows a paste or any time away from the page, and the typing in every one is more even than a hand produces, or if three in a row show typing faster than a person can type or key presses spaced as evenly as a machine's, we flag your account for a person at Humanix to look at. A flag does not change what you are paid, and it does not stop you contributing.

The answer box does not record pointer movement or scrolling.

We keep the raw signals for the period set out in section 8. After that we keep the derived score, with a summary of how the answer arrived: how many times text came by each route and how many characters it brought, the kinds of content the clipboard reported and how much formatting came with it, and how fast the answer grew between saves. A flag also keeps the figures from the contributions it was based on. We do not match your signals against a stored profile of how you personally type, and we do not use them to infer anything about your emotional or psychological state.

3.3 Sensitive information, and what we do not collect

Some of the optional profile questions touch on sensitive things: your health, your ethnic origin, your religion or beliefs, your political views, and your sex life or sexual orientation. The law calls some of this special category data.

A profile question may ask about anything that describes you, sensitive or not, but no profile question asks for anything that identifies you: not your name, your date of birth, your address, your phone number, your employer, or anything else that points to you rather than describing you. Every answer is a choice from a list, a range or a point on a scale.

You never have to answer these questions. Each profile tier raises what your answers earn once every question in it is answered, and the later tiers include these questions, so leaving them unanswered can keep you on a lower tier. Answers attached to a contribution can also add to what it is worth, as our Terms of Service explain. Leaving a question unanswered never reduces an amount we have already recorded as owed to you.

We ask them because artificial intelligence only becomes aligned with people if it learns how different kinds of people think. A model cannot learn how, say, people of a particular faith or a particular sexual orientation approach a question unless the data says which answers came from them. That is why these answers matter, and why we license them.

Accepting this policy, when you sign up or when we ask you to accept a new version, is your explicit consent to be asked these questions and, for any you choose to answer, to our attaching your answers to the contributions you make, next to your other background answers, and to our including them in the data we license, as section 6 describes. We do not ask for a separate consent. What we license never identifies you: an answer goes out as a category, never with your name, your email address or your account identifier, and never for a group of fewer than 20 people.

You can withdraw your consent at any time by writing to privacy@humanix.me. We then delete those answers, and from then on they are attached to nothing and included in nothing we license. Data already licensed before you withdraw cannot be called back from the customer who holds it. We keep a record of which version of this policy you accepted, the words beside the box you ticked, and when.

Apart from those profile questions, we do not ask for special category data, including your trade union membership, and no other question on the platform asks for any. Do not put any of it into a contribution. If you tell us that a contribution contains it, or we find that one does, we will remove the contribution and tell you.

We do not ask for information about anyone other than you, except where a question specifically calls for it or where you choose to send us a reference to evidence a credential. Do not name other people in a contribution otherwise.

We do not knowingly collect information about anyone under 18.

3.4 Traits we infer from what you write

We assess what you write for traits: characteristics of how you reason, what you value and how you approach a question. The assessment is automated. It reads the words of your contributions and nothing else: not your interaction signals, not your profile answers, and not anything from outside the platform.

Each trait is given a score, attached to the contribution it came from, and included in the data we license, labelled as inferred from the contributor's own words rather than stated by them. A trait goes out the same way a profile answer does: as a score or a band, never with your name, your email address or your account identifier, and never for a group of fewer than 20 people.

Traits attached to a contribution can add to what it is worth, as our Terms of Service explain. A trait never reduces an amount we have already recorded as owed to you.

Some traits may touch on the sensitive things listed in section 3.3. Accepting this policy is your explicit consent to that assessment too, and you withdraw it the same way: write to privacy@humanix.me and we delete the traits inferred from your contributions, and from then on we attach and license none.

4. Why we use it, and what allows us to

Where we rely on a legitimate interest, we have done a balancing assessment and you can ask us for it.

If we ever want to use your information for something not on this list, we will tell you first.

5. Automated decision-making

An automated system decides whether we accept a contribution and the amount we fix for it. No person reviews it before that decision is taken. A person at Humanix may read a contribution afterwards, before any payment can reach it. If they accept it, it counts in full, at the amount fixed when you sent it. If they reject it, it earns nothing. A person rejects a contribution only because it does not attempt the question, contradicts itself, your profile or an earlier answer, repeats an answer already accepted, used help you did not declare, or is not your own work. This section is what Article 22 of the General Data Protection Regulation requires us to tell you about the automated decision.

We rely on Article 22(2)(a): the processing is necessary to perform our contract with you. It is the mechanism by which we decide what to buy from you and at what price, and the platform cannot operate at the volume it needs without it.

The main things the score responds to are the subject of the question and how much material we already hold on it, the depth and specificity of your answer, the expertise you have evidenced, the quality band the contribution reaches, and the profile answers and traits attached to it under sections 3.3 and 3.4. The interaction signals described in section 3.2 are not among them. Those factors do not carry equal weight, and the subject and the depth of the answer carry most.

Two answers to the same question, of the same length, in a subject where we hold little material, will be valued differently if one gives specific detail from direct experience and the other restates general knowledge. The first will be worth more. A contribution that arrives with no interaction signals is valued in the same way as any other.

The consequence of a decision is financial. A rejected contribution earns nothing, is not licensed and is not used in a dataset. An accepted one carries a fixed amount which does not change afterwards, unless a person rejects it on review before any payment reaches it, as this section says above.

You can ask us to look at any of these decisions again, put your own point of view, and challenge the outcome. Write to review@humanix.me. We aim to answer within fourteen days. Where the law of your country gives you a right to have a person review a decision of this kind, you have that right and we will give it to you; ask and we will say how. Where we change a decision, we correct the record and the amount.

Apart from the reading described above, the platform is automated by design, and we would rather say so than imply a person checks each decision. Where the law requires a person rather than a system to take a particular decision, a person takes it.

6. Who we share it with

We do not sell your personal information, and we never will.

We share it with these categories of recipient:

Artificial intelligence providers. Your contributions are processed by third-party language model providers so that we can generate follow-up questions, present material, and score contributions. The providers we use are OpenAI, Amazon Web Services (through Amazon Bedrock) and OpenRouter. Which one handles a given piece of work depends on the task. These providers act as our processors and are not permitted to use your material to train their own models. Anything you type may go to them, so do not type anything into a contribution that you would not want processed in this way.

Payment and identity providers. Stripe verifies identity and processes payments. They receive your name, your identity documents and your payment details, and they act as controllers of that information in their own right for their regulatory purposes.

Infrastructure providers. Amazon Web Services hosts the platform, the database and the file storage, in the United States.

Email and communication providers. Resend sends the emails we send you, and the messages are delivered through Amazon Simple Email Service.

Customers who license data. Contributions we have accepted go into datasets which we license to organisations building artificial intelligence systems. Those datasets are pseudonymised. They carry no name, no email address and no account identifier. They can include the profile answers you have chosen to give, the sensitive ones in section 3.3 among them, and the traits in section 3.4. Each is included as a category, a band or a score, such as an age band, a country or a trait score, and never as anything that identifies you. No dataset describes a group of fewer than 20 people: any part of a dataset that would is left out of it. Each contribution carries a reference we can trace back to you, so that we can pay you and answer a request from you, and no customer can resolve that reference. Our contracts with customers forbid any attempt to identify a contributor.

Professional advisers, auditors and insurers, where they need it.

Authorities, where the law requires it or where we need to establish or defend a legal claim.

A buyer, if the business is sold or reorganised. We would tell you.

7. Where your information goes

We are in Cyprus. Our infrastructure and several of our providers are in the United States.

Where we transfer personal information outside the European Economic Area, we rely on one of these: an adequacy decision by the European Commission, the EU-US Data Privacy Framework where the recipient is certified under it, or the European Commission's standard contractual clauses together with an assessment of the laws of the destination country. For transfers out of the United Kingdom we use the UK addendum to those clauses.

You can ask us which mechanism applies to a particular provider.

8. How long we keep it

9. Your rights

You can ask us to:

• give you a copy of the personal information we hold about you;
• correct anything that is wrong;
• delete information we no longer have a reason to keep;
• restrict what we do with it while a dispute is resolved;
• send it to you, or to someone else, in a portable form;
• stop processing it where we rely on a legitimate interest and you object;
• stop sending you marketing, which you can also do from any marketing email;
• exercise whatever right your own law gives you over an automated decision, as section 5 explains.

Write to privacy@humanix.me. We will answer within one month. If a request is complex we may take up to two further months, and we will tell you if so.

Deleting your account does not delete contributions we have accepted. We bought them, they are in datasets we have licensed, and we cannot recall them. What we do instead is take your identifying information off the account: your name, and anything else that names you rather than describing what you contributed.

Deleting your account does not cancel money we owe you, and it cannot, because a debt is not ours to delete. We keep the record of what we owe, and we keep the minimum we need in order to pay it: a contact address and the payment details you gave us. Once you have been paid in full we remove those. The payment and tax records in section 8 are separate, and we hold them for the seven years accounting and tax law requires. If you would rather we stopped trying to reach you, tell us, and we will treat what we owe you as unclaimed under section 10 of the Terms of Service.

If you are unhappy with how we have handled your information, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, at Iasonos 1, 1082 Nicosia, or to the supervisory authority in the country where you live. If you are in the United Kingdom, that is the Information Commissioner's Office. We would rather you came to us first.

10. How we protect it

Information is encrypted in transit and at rest, internal access is limited to the people who need it, and administrative access is logged. Where you sign in with a password we require a second factor as well. If there is a breach that is likely to put you at risk, we will tell you and we will tell the supervisory authority within the time the law allows.

No system is perfectly secure.

11. Cookies

Our Cookie Policy explains what we store on your device.

12. Marketing

We will send you marketing emails only if you have agreed to receive them. Every one carries an unsubscribe link, and unsubscribing takes effect immediately.

Emails about your account, your contributions and what we owe you are not marketing, and you receive those for as long as you have an account.

13. Links to other sites

Where we link to somebody else's site, their privacy policy applies once you get there, not ours.

14. Children

The platform is for adults. If you are under 18, do not use it. If we discover an account belongs to someone under 18, we close it and delete the information, other than the minimum record we need to keep to show why we closed it and, where we owe money for contributions already accepted, what we need in order to pay it. We will pay what we owe, to the person or to a parent or guardian where the law requires it.

15. Changes to this policy

We will publish a new version here when this one changes, with a new version number and a new effective date. Where a change is significant we will email you at least thirty days before it takes effect.

Every version we have published is kept and available on request, so you can see what applied when.

16. Contact us

privacy@humanix.me for anything about your information. review@humanix.me to ask us to look again at an automated decision.

Humanix Ltd, a company registered in the Republic of Cyprus with registration number HE 496907, whose registered office is at Omonoias, 52, Troodos Court, 1st floor, Flat/Office 3, 3052, Limassol, Cyprus.