Privacy policy

1Who we are

Humans Together is a team operating system: a company’s Guide, its Plan, the work, and the check-ins where people review them, in one place. This policy covers humanstogether.team and every company address under it, such as yourcompany.humanstogether.team.

Humans Together is run by Humans Together LLC, 7832 91st St, Seminole, FL 33777. Wherever this policy says “we” or “us”, it means Humans Together LLC.

A company that uses Humans Together decides who is added to it and what is written in it. That company controls its people’s information, and we handle it on the company’s behalf: in data protection terms, the company is the controller and we are its processor. A data processing agreement is available on request (section 13).

2What we store

We store what your company writes, and what the product needs to run it for you:

• About each person: their email address, first and last name, the roles they hold, and the date they left if they have left.
• What your company writes: its Guide and values, its Plan and goals, its teams, roles and duties, projects and their notes, actions and their steps, metrics and their monthly numbers, and check-ins with their schedules, invitations, replies and the record of each meeting.
• Conversation: the messages people write on actions, duties, projects and check-ins, and which messages each person has read.
• One-to-ones: the scores given in a one-to-one, a lead’s culture score and the person’s own answers about their wellbeing. These are the most sensitive things we hold, and section 5 says who can see them. A team’s monthly check-in also shows the average of its people’s wellbeing answers, and only once at least five have answered.
• Recordings: transcripts, who spoke, summaries and suggestions, and audio until the check-in’s lead confirms who spoke. Section 6 has the detail.
• Zoom, if your company connects it. Section 7 has the detail.
• Signing in: a record of each signed-in session, and for each sign-in link a one-way fingerprint of its code, never the code itself.

We do not take payment details in the product, and the product’s database does not record your IP address or which browser you use. Our hosting provider keeps its own server logs (section 8).

3How a company and its people get in

There is no public sign-up. We create each company by hand when it becomes a customer, together with its first admin. After that, the company’s admins add the people who work there, and each person belongs to exactly one company.

People sign in with a link we email them. A sign-in link works once and expires after 30 minutes; the link in an invitation lasts seven days. Once signed in, a person stays signed in on that browser for 30 days, or until they sign out.

4What we use it for

We use what we store to run Humans Together for your company: to show each person their work, to run check-ins, to send the emails the product sends, and to write summaries of the check-ins your company records.

We do not sell it. We do not use it for advertising. We do not use your company’s content to train AI models. There are no analytics or tracking scripts on these pages or in the product.

5Who sees what

Inside your company, what a person sees follows the roles they hold. Admins set the company up, leads see and run their teams’ work, and everyone sees the Guide, the Plan and their own work. On a project, everyone on the project sees all of its work and its conversation, and the project’s lead runs it.

A one-to-one is different. Its scores and its recording are seen by the person it is about and the lead who held it. If that lead leaves the company before it is completed, whoever then leads the person takes it over. Once it is completed, whoever leads that person today can read it too, while the person is still on that team. Rank alone does not open a one-to-one, an admin’s included.

People at Humans Together look at a company’s content only at that company’s request, to keep the service running and secure, or where the law requires it.

6Recordings and transcripts

Whoever runs a check-in, called its lead here, can add its recording: a transcript file, an audio file, or audio recorded in the room with the Record this room button. A check-in’s lead is the team’s lead for a team check-in or a one-to-one, and an admin for the Guide and the Plan; an admin can also act for a team’s lead, never on a one-to-one.

Before anything is added, the lead confirms that everyone in the check-in knew it was recorded, and we store who confirmed it and when. A check-in linked to a Zoom meeting is confirmed once, when it is linked, for every meeting held on it after that (section 7).

• Audio is stored privately in Cloudflare R2 and handed to AssemblyAI through a link that works for a short time, so AssemblyAI can turn it into a transcript. We delete the audio when the lead confirms who was speaking, or when the recording is removed, whichever comes first, and keep it until then. There is no other time limit.
• The transcript is kept with its check-in as part of that meeting’s record. Once the recording has been processed, the lead can delete its words; the summary and every decision made from it stay, with a note of who deleted the words and when.
• The summary is written by Anthropic’s Claude. We send it the transcript with the names of the people who spoke, the names and roles of everyone invited, and the parts of your company’s Guide, Plan and work that the check-in reviews, a team’s average wellbeing among them. It writes a summary and suggestions, and nothing changes until the lead approves a suggestion.
• What AssemblyAI and Anthropic keep: audio is sent to AssemblyAI to be transcribed, and transcripts to Anthropic to be summarised. Each keeps what it receives only as its own terms with us allow. We do not ask either to delete what it received.

7Zoom

If an admin connects your company’s Zoom account, a check-in held on its Zoom meeting and recorded to the cloud brings its transcript in by itself. We read only what that needs:

• We store your Zoom account’s id, the Zoom user id of the person who connected it, and the access Zoom granted. The keys Zoom gives us are encrypted before they are stored, are sent only to Zoom, and are never written to a log.
• Whoever sets a check-in’s schedule links it by pasting its Zoom invite link. We keep the meeting number, and who confirmed that everyone knew it was recorded and when, never the passcode.
• For each recorded session of a linked meeting we keep its number, start time and length. A session that turns out not to be a check-in is deleted after 30 days.
• We fetch the transcript Zoom made of a linked check-in. We never fetch the audio or the video.
• To recognise who was on a call, we compare the email addresses Zoom lists with the ones your people use here. They are compared and never stored.

Disconnecting Zoom deletes the keys and the words of every transcript Zoom brought in, and so does removing the app in Zoom once Zoom tells us it was removed. The Zoom app page says exactly what goes and what stays.

8The companies that help us run it

These companies process information for us, each only for the job named here.

Render

Hosts the product, its database and its scheduled jobs, in the United States (Oregon). Everything in section 2 is stored there, except audio, which is held in Cloudflare R2.

Cloudflare

Runs the domain name system for humanstogether.team, and R2, the private storage that holds audio files.

Resend

Sends the product’s emails. It receives each recipient’s address and the email itself.

AssemblyAI

Turns audio into a transcript with the speakers told apart. It receives the audio of a recording.

Anthropic

Writes summaries and suggestions. It receives a transcript, the names and roles of the people in the check-in, and the parts of your company’s work the check-in reviews.

Zoom

Only for a company that connects it. We receive transcripts of linked check-ins, and the meeting details and lists of who attended that we need to match them.

Humans Together runs in the United States and stores its information there. Information from anywhere else is transferred to the United States.

9Cookies and email

We set one cookie to keep you signed in, on your company’s address only, for 30 days. While an admin connects Zoom we set a second, for ten minutes, that ties Zoom’s answer to the admin who asked. There are no advertising or analytics cookies.

The product sends email for its own work: sign-in links and invitations, reminders about actions and check-ins, messages in a conversation you are part of, word that a check-in’s summary is ready, notices about work you lead, hold or flagged, and notices an admin needs, such as Zoom needing to be connected again. An email names what it is about, such as an action’s title or a message’s words.

10How long we keep it

• Your company’s content stays while your company uses Humans Together, until someone in your company changes or removes it.
• People who leave are marked as left, not deleted. They can no longer sign in, the roles they held are vacated, and everything they wrote keeps their name.
• Audio goes when the lead confirms who spoke or removes the recording. Transcripts stay with their check-in until the lead deletes their words.
• Zoom sessions that are not a check-in go after 30 days, and everything Zoom brought in goes as the Zoom app page describes.
• When your company stops using Humans Together, its information is deleted within 30 days of the subscription ending. Before then, a copy is available on request.
• Backups: deleted information can remain in our database host’s backups for up to 30 days.

11Your rights

You can ask to see the information we hold about you, to have it corrected, or to have it deleted, and you can object to how it is used. If you work at a company that uses Humans Together, your company decides what is written about you here, so its admins are the quickest route: they can correct your name, change your roles, and mark you as left. You can also write to us (section 13), and we will help, working with your company where it is the one that decides. If you are in the UK or the EU, you can also complain to your data protection authority.

We answer a request to see, correct or delete someone’s information within 30 days, and a person can be erased on request.

12Security

• Everything a person reads or writes is limited to their own company’s information.
• Every page is served over HTTPS, and our connections to the companies in section 8 are encrypted.
• There are no passwords. A sign-in link works once, and we store only a fingerprint of its code.
• Zoom’s keys are encrypted at rest and never written to a log.
• Audio storage is private, and a file is written or read only through a link that works for a short time.
• Every message from Zoom is checked against Zoom’s signature before anything is done with it.

13Changes and contact

When this policy changes, we email every company’s admins 30 days before the change takes effect.

Questions about privacy, and requests about your information, go to hello@humanstogether.team. The support page has more ways to get help.