This Privacy Policy explains how HumanBeam Technologies Inc. ("HumanBeam," "we," "us") collects, uses and discloses personal information in connection with our websites at humanbeam.io, the HumanBeam Platform at humanbeam.ai (including Persona Builder, Video Wizard and LiveCall), HumanBeam Kiosks, and our marketing and support activities (together, the "Services").
We are headquartered in Vancouver, British Columbia. Our practices are anchored in Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act, with additional provisions below for individuals in the European Economic Area and United Kingdom, California and other US states, and Quebec.
What this Policy does not cover. The TalkToMeAI mobile application is governed by a separate privacy policy, available at https://humanbeam.io/talktomeai/privacy. If you use the app, that policy applies to your use of it.
Two Roles: Our Data and Our Customers’ Data
When we are responsible (controller).
We are responsible for personal information about our website visitors, prospective customers, and the individuals who register for and administer accounts on the HumanBeam Platform — including individuals who register through our self-serve sign-up and use free trial entitlements, and individuals who interact with HumanBeam’s own sales and demonstration Avatars on our websites and platform.
When our customers are responsible (processor).
When a business deploys a HumanBeam Kiosk or Avatar, or invites guest users into its own account, that business — not HumanBeam — decides why and how End-User information (visitors, guests, patients, students, employees) is collected. We process that information on the customer’s instructions as a service provider or processor, under our agreements with the customer. If you interacted with a Kiosk or Avatar deployed by a business and have questions about your information, please contact that business first; we will assist them in responding.
Information We Collect
Account and business contact information.
Name, work email, organization, organization identifier and role. We use one-time-passcode email authentication and single sign-on; we do not collect or store account passwords.
Payment and billing information.
Payments are collected and processed directly by our payment processor, Stripe, under Stripe’s own terms and privacy policy. HumanBeam does not collect or store payment card numbers. We receive transaction records, subscription status and limited billing details (such as billing name, country and tax registration information) for invoicing, tax and accounting purposes.
Usage and entitlement data.
Records of Platform activity used to operate and meter your plan, including avatar call counts and minutes, video generation minutes, avatar builds, concurrent session usage, guest account usage, feature access and audit logs.
Customer Content.
Scripts, prompts, persona settings, knowledge-base materials and generated media created in our editor tools. Customers are responsible for the content they enter, including any personal information they choose to include.
Avatar appearance, likeness and voice.
Avatars may be selected from HumanBeam’s stock character library. Stock characters may be based on real actors and models engaged by HumanBeam under its own consent and release agreements; no photo or recording from the customer is required to use them.
Where a customer requests a custom Avatar, digital replica or custom voice, we collect the photographs, video or voice recordings the customer supplies for that purpose. This material is collected only through a consent-gated flow: before any likeness or voice material can be uploaded or recorded, the customer must identify the depicted individual and confirm that documented consent from that individual has been obtained for the creation and use of the digital likeness or synthetic voice, including any separate, explicit biometric consent required by applicable law. Material submitted without completing this step is not processed.
Kiosk interaction data (processed for our customers).
Audio captured by Kiosk microphones during interactions, transcripts, session metadata, and — only where the deploying organization has expressly enabled it — camera video and computer-vision features, and LiveCall audiovisual streams. The Kiosk camera and all computer-vision features have the ability to be disabled by default. See Section 11.
Technical data.
Device and browser information, IP address, server and application logs, cookies and similar technologies, and Kiosk telemetry (uptime, errors, software version, connectivity status).
Referral and campaign data.
Where you reach our websites through a partner, reseller or marketing campaign link, we record campaign parameters (such as referral source and medium) and may associate them with your subsequent registration on the Platform, in order to attribute the referral and report on campaign performance. See Section 5.
Support and communications.
Messages you send us, waitlist and demo requests, and records of support interactions.
How We Use Information
We use personal information to:
provide, operate and secure the Services, including generating Avatars, videos and conversational interactions;
register accounts, provision entitlements, meter usage against plan limits and manage concurrency;
configure, ship, activate and support Kiosks and related hardware;
process payments, manage subscriptions and one-time purchases, and meet tax and accounting obligations;
provide customer support and respond to enquiries;
monitor performance and prevent fraud, abuse and security incidents;
attribute partner and campaign referrals and measure marketing effectiveness;
comply with legal obligations; and
send service communications and, with consent where required (including under Canada’s Anti-Spam Legislation), marketing communications you can opt out of at any time.
Product improvement.
Content submitted to our editor tools may be used to develop and improve HumanBeam products and services. Photographs, voice recordings or other media of real, identifiable individuals are included in such use only where the depicted individual’s documented consent expressly covers it. End-User interaction data processed on behalf of customers is excluded and is used only to provide the Services. Improvement uses rely on de-identified or aggregated data wherever practicable.
We do not use End-User interaction data processed on behalf of customers to train generalized AI models, and we do not sell personal information.
How We Share Information
We do not sell personal information, and no subprocessor may use personal information for its own purposes. Personal information is disclosed only:
(a) To service providers and subprocessors, and only to the extent necessary to deliver the Services, in each case under written contracts imposing confidentiality, security and use restrictions. The categories we engage are:
cloud hosting and infrastructure;
conversational AI and real-time avatar session providers;
AI media generation providers, used to produce custom Avatars, replicas and synthetic voices from consented material;
payment processing (Stripe), to which payment data flows directly rather than through HumanBeam;
email delivery, customer relationship management and marketing communications;
product analytics, error monitoring and logging;
hardware fulfilment, logistics and installation partners; and
professional services, including accounting and legal.
Where a customer uses only stock Avatars, no customer-supplied photograph or recording is transmitted to an AI media generation provider. A current named list of subprocessors is available to customers on written request, subject to reasonable confidentiality obligations, and we will notify customers of material changes as provided in their agreement.
(b) To our corporate affiliates, for the purposes described in this Policy.
(c) To referral and channel partners, limited to confirmation that a referral resulted in a registration or purchase, together with the account name and registration date, where you reached us through that partner’s link.
(d) To professional advisors, under duties of confidentiality.
(e) To authorities, where required by law, with notice to affected customers where lawful.
(f) To a successor entity, in connection with a merger, financing, acquisition or similar transaction, under confidentiality protections.
Cookies, Analytics and Referral Attribution
Our websites use cookies and similar technologies — including browser local storage — for essential operation, preferences, analytics and, where enabled, marketing.
Where you arrive through a partner or campaign link, campaign parameters may be stored in your browser and carried across from humanbeam.io to humanbeam.ai, so that a registration can be attributed to the referring partner or campaign. We use Google Analytics and tag management for website and registration analytics.
Analytics, attribution and marketing technologies are not strictly necessary to operate our websites. Where required by law, including in the EEA, the UK and Quebec, we request your consent through our cookie banner before these technologies are used, and you can change or withdraw your preferences at any time through the banner or your browser settings.
Retention
We retain personal information only as long as needed for the purposes described above:
account and usage data, for the life of the account plus a limited period for legal, tax and audit purposes;
Customer Content, Avatars and generated media, for the subscription term and a short export window after termination;
likeness and voice material submitted for a custom Avatar, for as long as the resulting Avatar is in use; where consent is withdrawn, we delete the source material and disable the derived Avatar or voice within [30] days, subject to legal retention obligations;
Kiosk interaction data, including audio, transcripts and any enabled camera or LiveCall streams, for [default retention period] unless a different period is agreed with the responsible customer in writing;
referral and campaign parameters, for [12] months from registration; and
telemetry and logs, on rolling schedules of up to [90] days.
We then delete or de-identify the information.
International Transfers
We are a Canadian company and use service providers in Canada, the United States and other jurisdictions. Where personal information is transferred internationally, we use appropriate safeguards, including contractual protections and, for transfers of European personal data, Standard Contractual Clauses together with a transfer assessment. Information processed outside your jurisdiction may be accessible to authorities there under local law.
Security
We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, logging and vendor security reviews. No system is perfectly secure. We will notify affected customers and authorities of breaches as required by applicable law, and we maintain a register of confidentiality incidents as required under Quebec law.
Your Rights
Canada (PIPEDA / BC PIPA).
You may request access to and correction of your personal information, withdraw consent (subject to legal and contractual limits), and complain to our Privacy Officer and to the Office of the Privacy Commissioner of Canada or the BC Office of the Information and Privacy Commissioner.
EEA / UK (GDPR).
Where the GDPR applies, you have rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority. Our legal bases are performance of a contract, legitimate interests, consent and legal obligation. Where we rely on consent — including for the creation of a digital likeness or synthetic voice, and for non-essential cookies — you may withdraw it at any time, without affecting processing carried out before withdrawal. For End-User data we act as processor; requests should be directed to the deploying business as controller, and we will assist.
California and other US states.
Where state privacy laws apply, you have rights to know, access, correct and delete personal information, and to opt out of "sale" or "sharing" (we do not sell or share personal information as those terms are defined). We do not discriminate against you for exercising these rights. Authorized agents may submit requests with proof of authority.
Illinois, Texas, Washington and other states with biometric or health-data laws.
Where a customer uses a custom likeness or voice, or expressly enables Kiosk camera and computer-vision features, that customer is responsible for obtaining the written consent and providing the notices required in the applicable jurisdiction. We process such material only on the customer’s documented instructions and do not use it for any independent purpose.
Quebec (Law 25).
Quebec residents have rights of access, rectification and, in certain cases, data portability, and may address complaints to the Commission d’accès à l’information. We do not use personal information to render decisions based exclusively on automated processing. Our Privacy Officer’s contact appears below.
To exercise rights, contact hello@humanbeam.io. We may verify your identity before responding and will respond within the timelines required by applicable law.
Children
The websites, Platform and Kiosks are intended for business use and are not directed to children. We do not knowingly collect personal information from children for our own purposes. Customers deploying Kiosks or guest access in venues serving minors, such as schools, are responsible for the lawful basis, consents and notices required in those environments. The TalkToMeAI mobile application is governed by its own privacy policy and its own age requirements.
AI Transparency
Avatars, personas and generated videos are artificial intelligence systems and AI-generated content. Kiosks and Platform Avatars display an AI disclosure, and customers are contractually required to maintain it. Where required by applicable law, including Article 50 of the EU AI Act, AI-generated media produced through our tools carries machine-readable provenance markings.
Camera and computer vision are off by default.
HumanBeam Kiosks ship with the camera and all computer-vision features that can be disabled by feature flag. They are active unless the deploying organization expressly disable them, and an organization may request that they be removed or re-disabled at any time by contacting hello@humanbeam.io. Where an organization enables them, that organization is responsible for venue signage and for the notices and consents required in its jurisdiction, and we process the resulting data solely on its instructions.
LiveCall.
During LiveCall sessions a real human is present and is identified as such.
Changes and Contact
We may update this Policy from time to time. Material changes will be posted with a new effective date and, where required, notified to you or made subject to renewed consent.
Privacy Officer
HumanBeam Technologies Inc.
321 Water Street, Suite 501
Vancouver, BC V6B 1B8, Canada
hello@humanbeam.io
