Privacy Policy

The short version

You do not create a public customer profile. A purchase opens one private upload session and the finished report is reached through a private link.

The service still has to process personal information while it creates that report. An uploaded conversation, recording, name, voice or image may identify you or another person. It would therefore be misleading to say that Human Response Lab never holds personal data.

Who is responsible

Human Response Lab is responsible for the personal information used to operate this website, administer payments, protect the service and produce requested reports. Privacy enquiries can be sent through the contact page.

A customer who uploads information about another person may also have legal responsibilities of their own. You must make sure you have a lawful reason and any consent or permission required before submitting that material.

Information we process

• Uploaded video, audio, screenshots, WhatsApp exports, email files and other supported text records.
• The main review question, optional follow-up questions, supporting background and references you choose to provide.
• Generated transcripts, extracted message text, timestamps, speaker or sender labels, measurements and report findings.
• A private session identifier, access-token hash, processing state and technical records needed to operate the report.
• Stripe checkout references, payment status, amount, currency and selected report type. Human Response Lab does not receive or store your complete card number.
• IP address, request and security events, malware-scan results and fault records used to protect and troubleshoot the service.
• For eligible public page visits: the requested public route, encrypted IP address, referrer hostname and source category, plus an approximate country code derived locally from the IP address when country lookup is enabled. Query strings, report links and form contents are excluded.
• Your name, email address, selected enquiry topic, optional payment or session reference, and message when you use the contact form.
• Questions you ask LabBot, its answers, the public page where the conversation occurred, and limited usage totals. LabBot does not ask for your name or email address.

Sensitive and third-party information

Private conversations can reveal relationship history, health, sexual life, beliefs, allegations or other highly sensitive matters. Only include what is necessary for the question you are asking.

Where an upload contains special-category information or information about another person, you are responsible for confirming that an appropriate legal condition applies. Do not upload secretly obtained account data, intimate images, passwords, unlawful recordings or material taken from a device you had no right to access.

Why we use the information

• To take payment, accept the selected evidence and provide the report you requested. This is generally necessary to perform the service contract with you.
• To scan files, control access, investigate faults and prevent fraud or misuse. These activities support our legitimate interests in operating a secure and reliable service.
• To understand which public pages and search or referral sources bring visitors to the service, using a short-lived private visitor log without an analytics cookie or cross-site tracking.
• To maintain transaction and accounting records or respond to lawful requests where a legal obligation applies.
• To review a message you send through the private contact inbox and take appropriate steps before or after a report purchase.
• To answer questions about the website through LabBot, review whether its guidance is useful, apply abuse limits and improve the approved answer library.

LabBot site guidance

LabBot is a customer-support guide for this website. It checks an approved answer library first. If the limited AI fallback is enabled and no suitable answer is found, the question and approved site information may be sent to OpenAI to prepare a short answer. LabBot has no tools, cannot browse, and cannot open uploads, reports, payments, private links or Admin records.

Do not enter evidence, passwords, card information, a private report link or sensitive personal details into LabBot. Conversations are encrypted in private server storage and can be read by the site administrator for support, safety and answer-quality review.

Automated processing and AI

The report workflow uses automated file preparation, transcription, message extraction, measurement and AI-assisted interpretation. The output is intended to support your own review; it does not make a legal, employment, medical or safeguarding decision about a person.

Automated systems can misread a speaker, miss context or produce an incorrect interpretation. Reports therefore include confidence and limitation information and must be checked by a person.

Service providers and transfers

Information may be handled by hosting and infrastructure providers, OpenAI for enabled transcription, report analysis or limited LabBot answers, Stripe for checkout and payment security, and Google reCAPTCHA for abuse protection. Local server tools may also inspect files for malware and prepare media.

Some providers may process information outside the United Kingdom. Where this occurs, the provider and any transfer safeguards are governed by the applicable service agreement and data-protection terms. Do not use the service for material you are not permitted to send to these processors.

OpenAI Privacy Policy Stripe Privacy Center Google Privacy Policy

How long information is kept

Uploaded evidence, generated analysis files and the private report are scheduled for automatic deletion 24 hours after upload. Download the PDF before the stated deadline. The report page also provides a permanent deletion control after a download has been recorded.

The report-data deletion process covers the uploaded evidence, generated media, extracted text, measurements, session record and report artifacts associated with that private report. Backup, payment, fraud-prevention, security and audit records may follow different retention periods where they are needed for legal obligations, transaction records or investigation of misuse.

A payment-recovery cookie can remain in your browser for up to 30 days, although the underlying report may already have expired. Encrypted contact messages are scheduled for deletion after 30 days, encrypted LabBot conversations after 30 days, and encrypted visitor details after 30 days. These private records can be deleted earlier from the Admin area.

Security and private links

The site uses HTTPS in production, private server storage, encrypted contact, LabBot and visitor records, upload validation, malware scanning, server-side payment checks and access tokens that are stored as hashes. Report, contact, LabBot and visitor data are not intended to be publicly browsable.

A private link is still a key to the report. Anyone who receives the complete link may be able to open it until the report expires or is deleted. Keep it out of shared chats, public posts and untrusted devices. No internet service can promise absolute security.

Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to ask for access, correction, deletion, restriction, portability or an objection to processing. Where processing relies on consent, consent can be withdrawn for future processing.

Use the contact page and provide enough information to identify the relevant transaction or private session without sending the evidence again. Some rights may be limited where information has already been automatically deleted or where records must be retained by law.

Cookies, complaints and changes

The website uses necessary session, security and payment-recovery technologies. It does not currently use advertising or audience-analytics cookies. Read the Cookie Policy for details.

You can raise a privacy concern through the contact page. You also have the right to complain to the UK Information Commissioner at ico.org.uk if you are unhappy with how personal information has been handled.

This policy may be updated when the service, providers or law changes. The date at the top shows the latest published revision.

UK Information Commissioner