This Privacy Policy explains how HumanBeam Technologies Inc. ("HumanBeam," "we," "us") collects, uses and discloses personal information in connection with our websites, the HumanBeam Platform (including Persona Builder, Video Wizard and LiveCall), HumanBeam Kiosks, and our marketing and support activities (together, the "Services"). We are headquartered in Vancouver, British Columbia, and our practices are anchored in Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act, with additional provisions below for customers and individuals in the European Economic Area/UK, California and other US states, and Quebec.
Two Roles: Our Data and Our Customers’ Data
When we are responsible (controller).
We are responsible for personal information about our website visitors, prospective customers, and customer account users (the people at your organization who administer the Platform).
When our customers are responsible.
When a business deploys a HumanBeam Kiosk or Avatar, that business — not HumanBeam — decides why and how End-User information (visitors, guests, patients, students) is collected. We process that information on the customer’s instructions as a service provider/processor, under our agreements with the customer. If you interacted with a Kiosk at a business and have questions about your information, please contact that business first; we will assist them in responding.
Information We Collect
Account and business contact information: name, work email, organization and role. Payment and billing information is collected and processed directly by our payment processor, Stripe, under Stripe’s own terms and privacy policy; HumanBeam does not collect or store payment card or billing details. Customer Content: scripts, prompts, persona settings and knowledge-base materials entered into our editor tools. For the standard online offering, Avatars are selected from HumanBeam’s stock character library — stock characters may be based on real actors and models engaged by HumanBeam under its own consent and release agreements — and no photo from the customer is required or collected for Avatar creation; photos of real individuals are collected only where a customer requests a custom replica, and are stored only after the customer confirms at upload that the required consent from the depicted person has been obtained. We do not currently collect voice samples; if voice-sample features are introduced, this Policy will be updated before launch. Kiosk interaction data (processed for our customers): audio captured by the Kiosk microphones and, where the deploying organization has enabled the camera, video during interactions, plus transcripts, session metadata and, where enabled, LiveCall audiovisual streams — organizations may request that the camera and computer-vision features be disabled by feature flag (contact hello@humanbeam.io). Technical data: device and browser information, IP address, logs, cookies and similar technologies, and Kiosk telemetry (uptime, errors, software version). Support and communications: messages you send us and records of support interactions.
A note on likenesses and biometric-type data.
This applies to the custom replica service only. Where a customer requests a custom replica, the uploaded photo is used to generate a digital likeness, and the customer must obtain documented consent from the depicted individual before upload, including any explicit biometric consent required by applicable law. We process such content only to provide the requested replica and as instructed by the customer. Stock Avatars in the standard offering involve no likeness of the customer’s personnel or end users.
How We Use Information
We use personal information to: provide, operate and secure the Services, including generating Avatars, videos and conversational interactions; convert, ship, activate and support Kiosks; process payments and manage subscriptions; provide customer support; monitor performance and prevent fraud, abuse and security incidents; comply with law; and, for our own customers and prospects, send service communications and (with consent where required, including under Canada’s Anti-Spam Legislation) marketing you can opt out of at any time. Content submitted to our editor tools may be used to develop and improve HumanBeam products and services; photos or media of real, identifiable individuals are included in such use only where the depicted person’s documented consent expressly covers it, and End-User interaction data processed on behalf of customers is excluded and used only to provide the Services; improvement uses rely on de-identified or aggregated data wherever practicable. We do not use End-User interaction data processed on behalf of customers to train generalized AI models, and we do not sell personal information. Customers are responsible for the knowledge-base content, prompts and other data they enter into our editor tools, including any personal information they choose to include.
Enterprise advertising feature.
HumanBeam offers an intent-based advertising feature to Enterprise customers under a separate Enterprise Order, which may use Kiosk interaction signals to select and display ads and to calculate ad-revenue sharing with the deploying business. [FLAG FOR LEGAL/PRODUCT REVIEW BEFORE ENABLING FOR ANY CUSTOMER: if this feature uses personal information to select or target advertising, it may constitute a "sale" or "sharing" of personal information under CCPA/CPRA and similar state laws — which would require this Policy to be updated with a specific notice and opt-out mechanism, and the statement in Section 9 that HumanBeam does not sell or share personal information would need to be revised, before the feature is enabled for any customer.] Where enabled, the applicable Enterprise Order will specify what interaction data is used and how it is shared.
How We Share Information
We do not sell personal information, and no subprocessor may use personal information for its own purposes. Personal information is disclosed only: (a) to service providers and subprocessors, and only to the extent necessary to deliver the Services — for example, in the standard online offering, Avatar creation uses HumanBeam’s stock library and involves no transmission of customer photos to AI providers; where a custom replica is requested, the consented photo is transmitted to our AI media generation provider solely to produce the replica; and Kiosk conversational session data is processed only to the extent necessary to operate live Avatar interactions, and payment data flows directly to Stripe rather than through HumanBeam — in each case under written contracts imposing confidentiality, security and use restrictions; a description of subprocessor categories appears here, and a current named list is available to customers upon written request, subject to reasonable confidentiality obligations; (b) to our corporate affiliates for the purposes above; (c) to professional advisors; (d) to authorities where required by law, with notice to affected customers where lawful; and (e) to a successor entity in connection with a merger, financing, acquisition or similar transaction, under confidentiality protections.
Cookies
Our websites use cookies and similar technologies for essential operation, preferences, analytics and, where enabled, marketing. Where required by law, we request consent through a cookie banner, and you can adjust preferences at any time through the banner or your browser settings.
Retention
We retain personal information only as long as needed for the purposes described above: account data for the life of the account plus a limited period for legal and audit purposes; Customer Content and Avatars for the subscription term and a short export window after termination; Kiosk interaction data per the retention settings and instructions of the responsible customer; and telemetry and logs on rolling schedules. We then delete or de-identify the information.
International Transfers
We are a Canadian company and use service providers in Canada, the United States and other jurisdictions. Where personal information is transferred internationally, we use appropriate safeguards, including contractual protections and, for transfers of European personal data, Standard Contractual Clauses. Information processed outside your jurisdiction may be accessible to authorities there under local law.
Security
We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, logging and vendor security reviews. No system is perfectly secure; we will notify affected customers and authorities of breaches as required by applicable law.
Your Rights
Canada (PIPEDA / BC PIPA).
You may request access to and correction of your personal information, withdraw consent (subject to legal and contractual limits), and complain to our Privacy Officer and to the Office of the Privacy Commissioner of Canada or the BC OIPC.
EEA / UK (GDPR).
Where GDPR applies, you have rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority. Our legal bases are contract performance, legitimate interests, consent and legal obligation. For End-User data we act as processor; requests should be directed to the deploying business (controller), and we will assist.
California and other US states.
Where state privacy laws apply, you have rights to know, access, correct and delete personal information, and to opt out of "sale" or "sharing" (we do not sell or share personal information as those terms are defined). We do not discriminate for exercising rights. Authorized agents may submit requests with proof of authority.
Quebec (Law 25).
Quebec residents have rights of access, rectification and, in certain cases, data portability, and may address complaints to the Commission d’accès à l’information. Our Privacy Officer’s contact appears below.
To exercise rights, contact privacy@humanbeam.io. We may verify your identity before responding and will respond within the timelines required by applicable law.
Children
The Services are for business use and are not directed to children. We do not knowingly collect personal information from children for our own purposes. Customers deploying Kiosks in venues serving minors (such as schools) are responsible for the lawful basis, consents and notices required for those environments.
AI Transparency
Kiosk personas and generated videos are AI-generated. Kiosks display an AI disclosure, and customers are contractually required to maintain it and to post venue signage about camera/microphone use. The Kiosk camera and the Avatar’s computer-vision features can be disabled per organization by feature flag on request to hello@humanbeam.io. During LiveCall sessions, a real human is present and identified as such.
Changes and Contact
We may update this Policy from time to time; material changes will be posted with a new effective date and, where required, notified or re-consented. Privacy Officer, HumanBeam Technologies Inc., 321 Water Street, Suite 501, Vancouver BC, V6B 1B8 Canada , hello@humanbeam.io.
