Who we are
Humatone (“Humatone”, “we”, “us”) is operated by Glowar Ltd, a company registered in England and Wales (company number 14099798), registered office Henge Barn, Pury Hill Business Park, Alderton Road, Towcester, Northamptonshire NN12 7LS, United Kingdom.
Humatone is a platform that gives businesses’ personas (AI characters that hold conversations on a business’s behalf) a face, a voice, phone numbers and channels such as web calls, typed chat and text messages. You can reach us about anything in this policy at [email protected].
When we decide, and when our customer does
Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles it on a controller’s instructions. We are each, in different places:
| Context | Our role |
|---|---|
| Visiting this website, or asking about early access | Controller |
| Signing up for and using the Humatone console (your account, your team, your business details) | Controller |
| Conversations between a persona and the people it talks to (callers, learners, candidates, customers) | Processor, for the business that runs the persona |
| Keeping the platform safe: abuse reports, fraud prevention, telecoms compliance | Controller |
Where we act as a processor, the business that runs the persona is the controller, and its own privacy notice explains how it uses your data. Our handling of that data is governed by our agreement with that business, including a data processing agreement.
If you talk to a persona
If you call, chat with, or text a persona running on Humatone, you are talking to an AI operated by a business, not by us. A Humatone persona will not deny being an AI if you sincerely ask. The business decides what the persona knows and says, and what happens as a result of the conversation.
- What is processed: what you say or type, your voice as audio while the conversation is live, your phone number if you call or text, and anything the business tells the persona about you.
- Recordings: a call is recorded only if you are told it is being recorded.
- Payment details: where the business has switched it on (it is on by default), card and bank numbers are removed from transcripts, recordings and summaries.
- Your rights: contact the business that runs the persona first. If you can’t identify them, or need our help, write to [email protected] and we will pass your request to them.
- Misuse: if a persona behaved in a way that worried you, tell us at [email protected].
What we collect
When you visit this website
Our hosting provider processes technical data needed to deliver the site and keep it secure, such as your IP address, browser and device type, and the pages you request. Our analytics count page views in aggregate without cookies (see Cookies and analytics).
When you ask about early access
Your name, work email, company and, if you give them, your website, what your persona is for, and anything you write to us.
When you use the console
- Account details: your name, email address, password (stored only as a secure hash), two-step verification settings, and, if you sign in with Microsoft or Google, the identifier they give us.
- Business details: your organisation’s name, address, registration and contact details. Telecoms regulators require these before a phone number can be issued in your name.
- Team and activity: who is in your workspace, their roles, and a record of significant actions, such as changes made during a support session.
- Billing: your plan, usage and invoices, and, once payments are taken, payment details held by our payment provider, not by us.
When you take part in a recording programme
If you agree to record your voice for us, the notice and terms you are given when you record explain what we do with your recording, and how to withdraw.
How we use it, and why
| What we do | Lawful basis |
|---|---|
| Run this website and keep it secure | Legitimate interests |
| Reply to your early-access enquiry and talk to you about it | Steps at your request before a contract; legitimate interests |
| Send you product news you have asked for | Consent, which you can withdraw at any time |
| Provide the console and the platform to your organisation | Contract |
| Register phone numbers in your organisation’s name | Contract; legal obligation |
| Investigate abuse, prevent fraud, and protect the people personas talk to | Legitimate interests |
| Keep financial records and answer lawful requests | Legal obligation |
We do not sell personal data, and we do not share it with advertisers. We do not use the conversations our customers’ personas hold to train AI models without that customer’s agreement. We make no automated decisions about you that have legal or similarly significant effects; where a persona is involved in a decision, the decision is the business’s.
Who we share it with
We use a small number of suppliers (sub-processors) to run Humatone, each under a contract that requires them to keep data confidential and use it only on our instructions. By category, they provide:
| Category | What they do |
|---|---|
| Hosting | The servers and databases Humatone runs on, and delivery of this website |
| Speech recognition | Turns what a caller says into text, live |
| Voice generation | Speaks a persona’s replies in its designed voice |
| Image generation | Designs a persona’s face (receives no caller data) |
| Language models | Power the hosted brain, for customers who use it |
| Telecoms | Phone numbers, calls and text messages |
| Sign-in, invitation and notification emails, and early-access enquiries |
Some of this processing runs on hardware we operate ourselves. Our current list of named sub-processors and where each one processes data is available to customers and on request from [email protected]. We tell customers before we add or replace one. We may also disclose data where the law requires it, or to protect someone’s safety.
International transfers
Humatone is hosted in the European Economic Area, which the UK recognises as providing adequate protection. Some of our suppliers process data in the United States. Where data leaves the UK or EEA we rely on an adequacy decision (such as the UK–US data bridge, for certified companies) or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with encryption in transit and at rest.
How long we keep it
- Early-access enquiries: until you ask us to delete them, or 24 months after our last contact, whichever comes first.
- Account and business details: while your organisation has an account, then for the deletion period set out in your agreement.
- Conversations: for the period the business that runs the persona chooses. When it ends, transcripts are deleted, along with anywhere they were quoted.
- Server logs: a short period, for security and troubleshooting.
- Financial records: as long as the law requires, usually six years.
Security
Data is encrypted in transit and at rest. Console sign-in supports two-step verification and single sign-on, and roles control who can hear recordings or export data. Our staff can enter a customer’s workspace only when its owner approves, for a limited time, and what they open is logged. No system is perfectly secure; if a breach affects your data we will tell you, and the regulator, as the law requires.
Your rights
Under UK and EU data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, subject to what we must keep by law;
- restrict or object to how we use it, including for direct marketing;
- receive data you gave us in a portable form;
- withdraw consent, where consent is our basis.
Write to [email protected]. We reply within one month. Where we process your data for one of our customers, we will pass your request to them and help them answer it.
Cookies and analytics
This website sets no cookies. We count visits with Cloudflare Web Analytics, which stores nothing on your device, does not fingerprint you, and reports only totals, such as pages viewed and country. Because nothing about you is stored, there is nothing to consent to and no banner.
The Humatone console uses strictly necessary cookies to keep you signed in. They are not used for tracking.
Children
This website and the console are for businesses, and we do not knowingly collect personal data from children through them. Some businesses use personas with audiences that include children, such as learners; the business is responsible for having a lawful basis and suitable safeguards, and Humatone applies additional rules to personas whose audience includes children.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your data, we will tell you directly where we can.
Contact and complaints
- Email: [email protected]
- Post: Glowar Ltd, Henge Barn, Pury Hill Business Park, Alderton Road, Towcester, Northamptonshire NN12 7LS, United Kingdom
If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.