HumanLayer procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Lodge a Complaint : You also may have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, if you consider that the collection and use of your personal information violates this Privacy Policy or applicable law.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Due to the fact that Company’s business is international, your personal information and other Collected Information may be transferred to, stored in, and processed in any country where our or our suppliers’ servers, databases, or facilities are located or operated. By accessing, receiving, or using the Services or by providing consent to us (where consent is required by applicable law), you specifically acknowledge and agree that information will be transferred outside of the country from which you access the Services (including, for example, to the United States) and that such countries’ data protection and related laws, regulations, and rules may be different than, and may not be as protective as, those of the jurisdiction from where you access the Services. Your use of or access to the Services constitutes your consent to such transfers. Additionally, where required by applicable law, we ensure that your personal information included in such transfers is adequately protected through contractual safeguards, such as the EU Standard Contractual Clauses (SCCs) (as approved by the European Commission, see the standard form here ) and, where applicable, the UK International Data Transfer Addendum. Subject to applicable law, you have the right to obtain details about the mechanism under which your personal information is transferred cross-border. For more information, please contact us as set out in the "Contact Us" section below.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. We will respond to your request within the applicable timeframe required under applicable law. If we deny your request, you can appeal such denial by emailing us at privacy@humanlayer.dev.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are a Canadian resident, in addition to those rights set forth in the “Your Choices and Access” section of the Privacy Policy above, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada and/or the applicable Canadian provincial regulatory body if you believe that the collection and use of your personal information violates this Privacy Policy or applicable law.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If this Privacy Policy expressly stated above that you have certain rights or applicable law grants you certain rights as it relates to this Privacy Policy and Collected Information, you may submit a verifiable request to us by” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Only you or a registered agent (if and only as permitted under applicable law) that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. If you have a registered agent act on your behalf, we have the right to authenticate such agent’s authority to act. Without limiting the foregoing, the verifiable consumer request must: Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ This section of the Privacy Policy applies to residents of countries or jurisdictions located in the EEA, including, without limitation, the European Union and the United Kingdom. Rights. To the extent the European Union’s General Data Protection Regulation or other law granting particular rights to data subjects applies to you (including, without limitation, those located in the United Kingdom) and subject to all applicable exceptions and exemptions granted under such applicable laws, you may have the following rights with regard to our processing of your personal information in addition to those rights set forth in the “Your Choices and Access” section of the Privacy Policy above: Right to Restrict Personal Information Use and Right to Object : You may have the right to restrict our use of your personal information where (i) you contest the accuracy of the personal information; (ii) the use is unlawful but you do not want us to erase the personal information; (iii) we no longer need the personal information for the relevant purposes, but you require it for the establishment, exercise or defense of legal claims; or (iv) you have objected to our personal information use justified on our legitimate interests pending verification as to whether HumanLayer has compelling interests to continue the relevant personal information use.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We will retain your personal information for as long as it’s needed to fulfill the purposes outlined in this Privacy Policy and our Terms unless a longer retention period is required or permitted by law (e.g., tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it; if that is not possible (e.g., because your personal information has been stored in back-up archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The Services also may allow (where the option is made available to you) you to sign up and register through third party accounts using your third-party account login. If you choose to sign up and/or sign in via a third party account, your login information may be used by the third party company. This Privacy Policy does not apply to such third party's independent use of your information. We encourage you to read such third party privacy policies. Phone Numbers . If you provide a mobile or other telephone number to us, you consent to receiving telephone calls and/or text messages from us, if and as applicable, as described below, but only to the extent permitted by applicable law. You can opt out of SMS messaging at any time by replying STOP ; message/data rates may apply. Payment Information. Payments submitted in connection with the Services (including ticket purchases, Software subscription fees, and hardware fees) must be made via the Services by credit card, debit card, ACH transfer, or through alternate payment methods (such as Stripe, PayPal, etc.) where such alternate payment methods are made available as an option. Please note that alternate payment methods may be provided by third parties (e.g., Stripe), subject to that third party's privacy policy. This privacy policy does not apply to such third party's collection and use of your information. Please review the applicable third party's privacy policy. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “With regard to credit card and debit card payment, all credit card and debit card information is provided directly to our third-party payment processor. Company does not directly access, handle, or store your credit card or debit card information. To submit payment using the Services, you will need to provide your name, email address, telephone number, and your credit card or debit card number, expiration date, and security code, as well as any such information as necessary to verify the applicable payment. Our payment processor will use your payment-related information in accordance with its privacy policy. Where online storefront for the Services is hosted or powered by a third party, we encourage you to review any posted terms and privacy policies. Contact Forms and Requests for Information or Support . To contact us for more information, quotes for our applicable products and services, or to request support via the Services, you will need to provide your contact information (as discussed above) as applicable, as well as (to the extent applicable) details of the products or services you are interested in, the company you work for, a link to your business website, and information about your potential use of the services. You may also have the ability to join a waitlist to access our Services. To join our waitlist, you will need to provide us your name, contact information, as well as some information about your role at the company you work for. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may combine this information with other Collected Information (including personal information) and information obtained from third parties for security reasons and to protect our rights or the rights of others. The suppliers that we use to provide the Services may collect information about your visits to the Services and other websites. Some of this information may be collected using cookies and similar tracking technologies as explained below under “Cookies and Tracking Technologies.” Analytics. We use PostHog to measure and understand how the Services are used (e.g., pages viewed, feature usage, clicks) so we can maintain and improve performance. PostHog collects event and technical data such as your device and browser type, approximate location (derived from IP address), timestamps, and basic interaction events. PostHog places or reads first-party cookies and similar technologies to recognize returning users and attribute usage over time. We configure PostHog not to use data for advertising and we use it only for analytics and product improvement. Feature Flags and Experiments. We may use PostHog feature flags and limited experiments to roll out and evaluate features. These rely on anonymous identifiers and analytics events and are not used for advertising. Session Replay. We may use PostHog's session replay to view anonymized recordings of how users interact with the Services (e.g., clicks, scrolls, and non-sensitive form interactions) to diagnose bugs and improve UX. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As described in this Privacy Policy above, applicable business purposes for such disclosures include, without limitation, product and service fulfillment, internal operations, prevention of fraud and other harm, and legal compliance. The categories of third parties to which we may share the above categories of information, include, without limitation: Our affiliates, subsidiaries, and related entities;” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ The Services may link to, or be linked to, websites, applications, or services not maintained or controlled by Company. Company is not responsible for the privacy policies or practices of any third parties or any third-party websites, applications, or services. This Privacy Policy does not apply to any third-party websites, applications, or services or to any personal or other information that you may provide to third parties. You should read the privacy policy for each website, application, and service that you visit or use.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Our affiliated companies may contact you directly with respect to such products and services, provided that if applicable law requires, your prior consent will be obtained. You may opt out of receiving communications from any such affiliated company pursuant to that affiliate's own policies. You may opt out of receiving communications from us by contacting us using the information below under "Contact Us." Sharing Collected Information with Our Third-Party Suppliers and Service Providers. We will disclose Collected Information to our and our affiliates' respective suppliers, vendors, and service providers as necessary for us to provide the Services and our products and services to you and to engage in the use and sharing of Collected Information as permitted by this Privacy Policy and applicable law. These third parties include, without limitation, our website management and hosting suppliers, customer support providers, those handling the processing and delivery of mailings, cloud storage providers, website analytics providers, payment processors (if and as applicable), product installers, and email service suppliers. Our service providers are authorized to and may use and disclose Collected Information as necessary for them to provide the applicable products and services to us and as provided by their own privacy policies and our agreements with those third parties. Evaluation and Improvement. We may use and disclose Collected Information to analyze, develop, and improve the content, materials, products, and services that we provide; to inform marketing and communication plans and strategies; to understand user demographics and preferences; to analyze the effectiveness of the Services; and to evaluate user needs and customize Services content and the user” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Embedded Content. The Services may incorporate content, including feeds, scripts embedded in the Services' code, and visible content (e.g., videos), provided by third parties. In some cases, those third parties collect data about how you interact with their content. Information that We Obtain from Third-Party Sources. We may obtain data about users of the Services from various third-party companies and public sources, whether offline or online (e.g., marketing companies, analytics consultants, publicly available social media profiles, other public sources of information), and we may combine that data with Collected Information. This enhances our existing information about our users and customers and improves our ability to contact you and our marketing's relevancy.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Interactions, integrations, and content sharing with social media platforms and their features may require or allow the social media company to collect information from or about you, whether through cookies, registration information, or otherwise. Social media companies may track your online activity even when you do not choose to interact with the social media platform or its widgets or other features. We encourage you to review the privacy policy of any social media platform that you use or visit in connection with the Services, as those platforms’ respective privacy policies will govern their collection, use, and disclosure of information they collect from you. We cannot control any policies or terms of such third party platform. As a result, we cannot be responsible for any use or disclosure of your information or content by third-party platforms, which you use at your own risk. If you do not want social media platforms to collect information relating to you via the Services or to link information collected via the Services to your social media accounts, we suggest that you: (a) do not connect to or share information with social media platforms using the Services; (b) hide social media platform plug-ins using an ad blocker; (c) always log off completely from social media platforms before visiting the Services or other websites and delete all related cookies; and, (d) where the option is made available by a social media platform, disable the advertising services and networks operated by that platform. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third party service providers: including, but not limited to, payment processing companies, data analytics providers, fraud prevention providers, cloud storage providers, IT service providers, delivery partners, and marketing companies; and” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third party websites and mobile applications (e.g., websites that share information with us or our service providers);” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.