Privacy Policy

1. Introduction

HumanBacked Inc. (“HumanBacked,” “we,” “our,” or “us”) operates the platform available at humanbacked.com and any related applications or services (collectively, the “Platform”). We are committed to protecting your personal information and being transparent about how we collect, use, and share it.

This Privacy Policy applies to all users of the Platform worldwide, including individuals who create profiles, undergo identity verification, send or receive Backing (peer-to-peer financial support), participate in our grant program, apply for enterprise certification, or participate in the HumanBacked Ambassador Program.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

2. Who We Are (Data Controller)

HumanBacked Inc. is the data controller for personal information collected through the Platform. This means we determine the purposes and means of processing your personal information.

Our third-party identity verification provider, Persona Identities Inc. (“Persona”), and our payment processor, Stripe, Inc. (“Stripe”), act as data processors on our behalf for the specific functions described below.

For privacy inquiries, contact us at: [email protected]

3. Information We Collect

3.1 Information You Provide Directly

• Account Information: When you create an account via Google Sign-In, we receive your name, email address, profile picture, and Google account identifier from Google LLC.
• Profile Information: Any additional information you choose to add to your HumanBacked profile, such as a bio, links, or display name.
• Enterprise Certification Applications: If you apply for HumanBacked Enterprise Certification on behalf of an organization, we collect your name, business email, company name, company size, and details about your team submitted through the certification intake form.
• Ambassador Program Applications: If you apply to become a HumanBacked Ambassador, we collect your name, contact information, and any information you provide about your community or audience.
• Communications: If you contact us directly (e.g., by email or through support channels), we collect the content of those communications and your contact details.

3.2 Identity Verification Information (Sensitive)

To verify your identity and establish your “Backed” status on the Platform, we use Persona, a third-party identity verification (IDV) provider. During verification, you may be asked to provide:

• Government-issued identification documents (such as a driver's licence or passport)
• A selfie or live facial image for liveness detection and document matching

How this works: Persona collects, processes, and stores your identity documents and biometric facial data on our behalf. HumanBacked does not store raw identity document images or raw biometric data on our own servers. However, we receive and store derived identity data from Persona, which may include your full legal name, date of birth, address, document type, country of issuance, and a Persona inquiry reference ID tied to your account.

Biometric data:The facial image capture and comparison performed during verification may constitute “biometric information” under applicable laws, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and similar laws in other jurisdictions. Persona's processing of this data is governed by Persona's own Privacy Policy and their compliance with applicable biometric privacy laws. By submitting to identity verification, you provide your explicit, informed consent to the collection and processing of your biometric data for the purpose of verifying your identity. You may withdraw this consent at any time by contacting us, though doing so may affect your ability to use certain Platform features.

We have entered into a Data Processing Agreement (DPA) with Persona that governs how they process personal information on our behalf.

3.3 Payment Information

When you subscribe to access Backing features (currently $9.99 CAD/month) or send Backing to another user, payment processing is handled by Stripe, Inc. We do not collect or store your full payment card numbers, bank account numbers, or other sensitive financial account details. We receive transaction confirmation data from Stripe, including transaction IDs, amounts, timestamps, and the last four digits of your payment method for display purposes.

Stripe may collect and process additional information pursuant to their own Privacy Policy and Terms of Service. Stripe's collection and processing of payment information is subject to Stripe's Connected Account Agreement and applicable financial regulations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements. Stripe, not HumanBacked, is responsible for compliance with KYC/AML obligations in connection with payment processing.

You must be at least 18 years of age to subscribe to paid features or send or receive Backing.

3.4 Information Collected Automatically

When you use the Platform, we may automatically collect:

• Usage Data: Pages visited, features accessed, time spent on the Platform, referral URLs, and interaction data.
• Device and Technical Information: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Cookies and Similar Technologies: We use cookies, local storage, and similar tracking technologies to maintain your session, remember your preferences, and analyze Platform performance. See Section 9 (Cookies) for more detail.
• Log Data: Server logs that record your access to and use of the Platform.

3.5 Information from Third Parties

• Google:When you sign in with Google, we receive information from Google as described in Section 3.1. This is governed by Google's Privacy Policy.
• Persona: Derived identity verification results as described in Section 3.2.
• Stripe: Transaction and payout data as described in Section 3.3.

4. How We Use Your Information

We use personal information for the following purposes:

To provide and operate the Platform:

• Create and maintain your account
• Process and display your identity verification status
• Facilitate Backing transactions between users
• Display user profiles and community features

To deliver specific programs and features:

• Issue and maintain Enterprise Certification credentials and badges
• Manage the Ambassador Program

To process payments:

• Facilitate subscription billing for paid features
• Facilitate peer-to-peer Backing payments via Stripe
• Maintain transaction records

To communicate with you:

• Send transactional emails (account confirmations, receipts, security alerts)
• Send service announcements and important policy updates
• With your consent, send marketing communications about new features, programs, or opportunities (you may opt out at any time)

To improve the Platform:

• Analyze usage patterns and user behavior in aggregate
• Conduct research and testing
• Debug and fix technical issues

To protect safety and enforce our policies:

• Detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service
• Comply with legal obligations
• Respond to law enforcement requests

To fulfill legal obligations:

• Comply with applicable Canadian law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and its successor legislation
• Comply with applicable international law where required

5. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal information under the following legal bases as applicable under the General Data Protection Regulation (GDPR):

• Performance of a contract: To provide you with the Platform, process transactions, and fulfill our obligations to you.
• Legitimate interests: To improve the Platform, prevent fraud, ensure security, and analyze usage — where these interests are not overridden by your rights.
• Consent: For biometric data processing during identity verification; for optional marketing communications; and for marketing or advertising cookies and expanded Meta Pixel or Conversions API identifiers where consent is required. You may withdraw consent at any time.
• Legal obligation: Where we are required to process data to comply with applicable law.

6. How We Share Your Information

We do not sell your personal information. We share your information only as follows:

Service Providers (Data Processors):

We share information with trusted third-party vendors who process data on our behalf, including:

• Persona — identity verification
• Stripe — payment processing
• Google — authentication services
• Email service providers for transactional and marketing communications
• Analytics providers (data shared in aggregate or pseudonymized form where possible)
• Meta/Facebook/Instagram — advertising measurement, attribution, optimization, and audience matching
• Cloud hosting and infrastructure providers

All service providers are contractually required to protect your information and use it only for the services they provide to us.

Other Users:

Your verified status, display name, profile picture, and any profile content you choose to make public will be visible to other Platform users. Backing activity may be visible depending on your privacy settings.

Enterprise Certification:

If you or your organization obtains Enterprise Certification, your organization's name and HumanBacked certification status may be publicly displayed as part of the certification program.

Legal Requirements:

We may disclose your information if required by law, court order, or governmental authority, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers:

If HumanBacked is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform before your information becomes subject to a materially different privacy policy.

7. International Data Transfers

HumanBacked is based in Canada. If you access the Platform from outside Canada, your information will be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection for personal data transferred from the EEA under PIPEDA.

Where we transfer your data to third-party processors located in jurisdictions that may not have equivalent data protection laws (including the United States, where Persona and Stripe are based), we rely on appropriate safeguards such as standard contractual clauses (SCCs) approved by the European Commission and Data Processing Agreements to protect your information.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specifically:

• Account data: Retained for the duration of your account, plus up to 3 years after account deletion, for legal and dispute resolution purposes.
• Identity verification data (derived): Retained while your account is active and for up to 3 years after deletion to comply with legal obligations and fraud prevention requirements. Raw biometric and document data is retained by Persona according to Persona's retention schedule.
• Payment records: Retained for 7 years to comply with financial recordkeeping requirements.
• Communications: Retained for up to 2 years from the date of your last communication with us.

You may request deletion of your data at any time (see Section 10), subject to our legal retention obligations.

9. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly Necessary Cookies: Required for the Platform to function (e.g., session management, authentication). These cannot be disabled.
• Functional Cookies: Remember your preferences and settings to enhance your experience.
• Analytics Cookies: Help us understand how users interact with the Platform so we can improve it. These may be set by third-party analytics providers.
• Marketing Cookies: Used to deliver relevant content and track the effectiveness of our communications. These are only deployed with your consent where required by law.

You can control cookies through your browser settings. Disabling certain cookies may affect your ability to use some features of the Platform. Where required by applicable law, we will request your consent before placing non-essential cookies.

9.1 Meta Pixel and Conversions API

Where permitted by law, we may use Meta Pixel and Meta Conversions API technologies to measure advertising performance, attribute conversions, optimize campaigns, retarget advertising, and build marketing audiences. We will not send expanded advertising identifiers to Meta unless you affirmatively grant marketing consent through our consent controls. The information that may be shared with Meta/Facebook/Instagram after that consent includes hashed email address, IP address, as well as browser and click identifiers.

These tools are used for ad measurement, attribution, campaign optimization, retargeting, and audience matching. This means Meta may use the information to match events from our Platform to Meta accounts, measure whether ads led to activity on the Platform, and help us show or optimize advertising on Meta services. We do not use these tools to send more data than is necessary for those purposes, and we may restrict or stop sending this information if you withdraw consent or if applicable law requires us to do so.

You can grant marketing consent by choosing “Accept all” in our consent controls, or decline and withdraw it by choosing “Only required” from the consent controls or persistent manage-consent option. If consent is not provided, or if you withdraw it, we will not send the expanded Meta Pixel or Conversions API identifiers described above for future events. Withdrawing consent does not limit your access to Platform features, but advertising may be less relevant or less accurately measured. We may still send limited operational event data as permitted by law and our legitimate business needs. You may also use Meta's own advertising settings and applicable browser privacy controls to manage targeted advertising preferences.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

All users:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention obligations.
• Withdrawal of consent: Where processing is based on your consent (including biometric data), withdraw that consent at any time.

EEA, UK, and Switzerland users (GDPR/UK GDPR):

• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request a copy of data you have provided to us in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Complaint: Lodge a complaint with your local supervisory authority.

California users (CCPA):

• Know: Request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, and the purposes for collection.
• Delete: Request deletion of personal information, subject to exceptions.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.
• Opt-out of sale: We do not sell personal information.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by applicable law (generally 30 days, or 45 days for complex requests). We may need to verify your identity before fulfilling your request.

11. Security

We implement and maintain reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include encryption of data in transit, access controls, and use of SOC 2-compliant service providers where available.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and relevant authorities as required by applicable law.

12. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us at [email protected].

13. Third-Party Links and Services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through the Platform.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the “Last Updated” date at the top of this page. For material changes that significantly affect your rights or how we use your data, we will provide more prominent notice (such as an email notification or in-app alert) at least 30 days before the changes take effect, where required by applicable law. Your continued use of the Platform after the effective date constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

HumanBacked Inc.

Email: [email protected]

Website: humanbacked.com

If you are located in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

This Privacy Policy was last updated on June 2, 2026.