HUMNLABS Privacy Policy

HUMNLABS ("we", "us", or "our") is an experimental research initiative exploring privacy-preserving trust signals and confidence in human presence. This initiative is operated by Smyrna Digitale, a trade name of Smyrna Bouw, registered in the Netherlands. For the website and waitlist processing described in this policy, Smyrna Bouw, operating under the trade name Smyrna Digitale, acts as the Data Controller under European data protection laws (including the General Data Protection Regulation / GDPR).

Privacy & Data Protection Contact: privacy@smyrnadigitale.com

We maintain strict separation between three distinct data operations on this website:

• Human Presence Experiment (Browser-Only): When you interact with the experiment at humnlabs.io/experiment/, your browser evaluates behavioral signals (reaction latency, pointer movement entropy, and typing intervals) entirely in volatile client-side memory (RAM). These signals are never transmitted to our servers, saved to disk, or linked to personal identity.
• Voluntary Report Waitlist: When you voluntarily register for early access to the Human Presence & Trust Report 2026 on our landing page, your submitted email address is ingested via our third-party form processor (Formspree) solely to send you a one-time release notification.
• Standard Web Hosting Operations: Web hosting infrastructure automatically logs basic technical request metadata (such as IP addresses, user-agent strings, and request timestamps) to securely deliver pages and protect against DDoS or malicious traffic.

• Voluntary Waitlist Email: If you choose to subscribe to report notifications, we collect only the single email address you enter in the form. Providing an email is optional and is not required to browse the website or run the experiment.
• Technical Request Metadata: When submitting the form, technical transport headers (such as IP address and browser user-agent) are processed by our form processor for delivery verification, security, and spam prevention.
• Zero Ingestion of Experiment Signals: The waitlist form does not collect, attach, or transmit any data or scores from the Human Presence Experiment.
• No Biometrics or Identity Credentials: We do not collect names, phone numbers, physical addresses, national identity identifiers, or persistent biometric facial/voice templates.

• Waitlist Email Processing: Processed solely to notify you when the Human Presence & Trust Report 2026 is published. The legal basis for this processing is your explicit consent under GDPR Article 6(1)(a), provided when you enter your email and submit the registration form. You may withdraw your consent at any time.
• No Marketing or Profiling: We will not use your email for unrelated commercial marketing, advertising campaigns, user tracking, or automated profiling. We do not sell or rent email addresses to third parties.
• Infrastructure Security: Technical request logs are processed under our legitimate interest (GDPR Article 6(1)(f)) to ensure network security, maintain server availability, and prevent fraudulent abuse.

We use Formspree, Inc. as an external service provider and data processor to securely handle waitlist form submissions.

• Processing & Storage: Submissions are transmitted to Formspree, stored in the enabled Formspree Submission Archive, and forwarded to the HUMNLABS administrative mailbox.
• Infrastructure & Security: Formspree hosts infrastructure using Amazon Web Services (AWS) in the United States. Formspree states that it encrypts stored databases at rest using AES-256 and protects data in transit using at least TLS 1.2.
• International Data Transfers: For transfers of personal data from the EEA/UK to the United States, Formspree states that it relies on Standard Contractual Clauses (SCCs) as a data processor.

For more details on Formspree's data handling and security practices, please review the Formspree Privacy Policy and Formspree Security Documentation.

• Report Waitlist Emails: Active copies of your email address stored in the Formspree Submission Archive and HUMNLABS administrative mailbox are retained until the report-release notification is sent. All active copies will be permanently deleted no later than 30 days after the report notification is dispatched.
• Earlier Deletion: If you request withdrawal or erasure before publication, your email address will be deleted from active storage promptly upon receipt of your request.
• Experimental Signals: 100% session-only retention in volatile RAM. Discarded immediately when the browser tab or window is closed or refreshed.
• Web Server Logs: Retained temporarily by hosting infrastructure for operational integrity and security auditing in accordance with standard infrastructure lifecycle practices.

Formspree's Formshield filter automatically screens incoming submissions to detect automated spam and prevent abuse. No automated decision-making or profiling producing legal effects or similarly significant effects is conducted.

The educational signal summary generated in the browser experiment is evaluated entirely client-side, separated from the waitlist form, and never associated with or stored alongside your email address.

Under applicable data protection laws (including the GDPR), you hold the following rights regarding your personal data:

• Right of Access: Request confirmation and copies of personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your email address from our active records.
• Right to Restriction of Processing: Request temporary restriction of processing under certain legal circumstances.
• Right to Data Portability: Receive your personal data in a structured, commonly used format.
• Right to Object: Object to processing carried out under legitimate interest grounds.
• Right to Withdraw Consent: Withdraw your consent for waitlist notification at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please email our privacy desk at privacy@smyrnadigitale.com. We will respond promptly in accordance with statutory timelines.

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of an alleged infringement. In the Netherlands, the competent supervisory authority is the Autoriteit Persoonsgegevens (AP) (https://www.autoriteitpersoonsgegevens.nl/).

We do not use advertising cookies, marketing pixels, or third-party web analytics platforms (such as Google Analytics or Meta Pixel). No persistent tracking identifiers are placed on your device by HUMNLABS.

Our website and experiment are not directed to individuals under 16 years of age, and we do not knowingly collect personal data from children.

We may update this Privacy Policy periodically to reflect research developments, operational changes, or legal requirements. The "Effective Date" at the top indicates when the latest revisions took effect.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact:

Smyrna Digitale (HUMNLABS)
Trade name of Smyrna Bouw, Netherlands
KVK: 72332050
VAT ID: NL002480877B28
Email: privacy@smyrnadigitale.com
Website: https://humnlabs.io