Effective date: November 2, 2026

These Terms of Use ("Terms") are an agreement between you and Human Control, Inc., a Delaware corporation ("Human Control", "we", "us", "our"). They govern your access to and use of our website, interactive demos, trial and early-access services, documentation and any related content (together, the "Services"). By accessing or using the Services, you agree to these Terms. If you use the Services on behalf of an organization, you confirm that you are authorized to accept these Terms for it, and "you" includes that organization.

1. Eligibility

The Services are intended for businesses and professionals. You must be at least 18 years old and able to enter into a binding contract to use them. The Services are not directed to consumers or children.

2. Accounts and access credentials

Some Services, such as an evaluation, the research console at platform.human-control.com or the API, require an account or an API key. You are responsible for keeping your credentials confidential, for all activity under your account, and for telling us promptly at info@human-control.com if you believe your account or keys have been compromised. We may suspend access that we reasonably believe is compromised or misused.

3. Acceptable use

You agree not to, and not to allow anyone else to:

• use the Services in violation of any law or regulation, or to infringe anyone's rights;
• deploy the Human Control component on devices you are not authorized to manage, or without giving the notices and obtaining the consents required by law;
• use the Services to monitor employee productivity, profile individuals or identify people, rather than to verify sensitive approvals;
• attempt to gain unauthorized access to the Services or to other customers' data, or probe, scan or test their vulnerability outside an agreed security program;
• reverse engineer, decompile or attempt to extract the models, features or source code of the Services, except where the law expressly allows it;
• use the Services or their outputs to build or train a competing product, or to develop techniques for evading human-verification or fraud controls;
• interfere with or overload the Services, or introduce malicious code;
• resell, sublicense or provide the Services to third parties except as agreed in writing.

4. Evaluations, research and demos

Evaluation and early-access features, including the live demo at demo.human-control.com, are provided for evaluation. They may change, be limited or be discontinued, and may not be covered by service levels. Interactive demos on our website run in your browser with simplified logic and sample data: they illustrate how Human Control works and do not measure the performance of the product. Pointer movements you make in a website demo are processed in your browser and are not sent to us. Taking part in classifier research through the console is voluntary and governed by the notice and consent shown there.

5. Your data

As between you and us, you own the data you provide to the Services ("Customer Data"). You grant us a limited right to process Customer Data to provide, secure and support the Services and as described in our Privacy Policy and Data Privacy documents. You are responsible for having the rights, notices and consents needed for us to process Customer Data.

6. Intellectual property

The Services, including software, models, documentation, designs, the Human Control name and logo, are owned by Human Control or its licensors and are protected by intellectual property laws. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable right to use the Services for your internal business purposes during your authorized access. All rights not expressly granted are reserved.

7. Feedback

If you send us suggestions or feedback about the Services, we may use them without restriction or obligation to you.

8. Confidentiality

Non-public information we share with you about the Services, including documentation, security materials, pricing and product roadmaps, is confidential. You agree to use it only to evaluate or use the Services and not to disclose it to third parties, except to your employees and advisers who need to know it and are bound by similar obligations.

9. Third-party services

The Services may link to or integrate with services operated by others, such as scheduling tools, identity providers or device-management systems. We are not responsible for those services, and their own terms apply.

10. Disclaimers

The Services are provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. No verification system detects every automated action. Figures on our website, including pilot targets and illustrative examples, describe goals and scenarios and are not guarantees of results. You remain responsible for your release decisions and your fraud and security controls.

11. Limitation of liability

To the fullest extent permitted by law, Human Control will not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, data or goodwill, arising from or related to the Services, even if advised of the possibility. Our total liability for all claims relating to the Services under these Terms will not exceed the greater of the amounts you paid us for the Services in the twelve months before the claim or one hundred US dollars (US$100).

12. Indemnification

You will defend and indemnify Human Control against third-party claims arising from your breach of these Terms, your Customer Data, or your deployment of the Services without the notices or consents required by law.

13. Suspension and termination

You may stop using the Services at any time. We may suspend or end your access if you breach these Terms, if your use creates a security or legal risk, or if we discontinue an early-access feature. Sections that by their nature should survive termination, including 5 to 8 and 10 to 15, survive.

14. Export controls and sanctions

You will comply with applicable US and international export control and sanctions laws, and will not use or provide access to the Services in embargoed countries or to restricted persons.

15. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules. The state and federal courts located in Delaware have exclusive jurisdiction over any dispute relating to the Services, unless mandatory law where you are established provides otherwise.

16. Changes to these Terms

We may update these Terms. We will post the new version with a new effective date and, for material changes affecting active evaluation or early-access users, give reasonable notice. Continued use after the effective date means you accept the updated Terms.

17. Contact

Human Control, Inc. · info@human-control.com · subject "Terms".

Related documents

Effective date: November 2, 2026

This Privacy Policy explains how Human Control, Inc. ("Human Control", "we", "us") handles personal data when you visit our website, contact us, take part in an evaluation or in classifier research, or when your employer uses Human Control on your workstation. For a technical walk-through of the product's data flow, see Data Privacy.

1. Who is responsible

• Website, business contacts, evaluation and research accounts: Human Control is the controller (or "business") for this data.
• Product data: when an organization deploys Human Control on its reviewers' workstations, that organization is the controller and decides why and how the product is used. Human Control is its processor (or "service provider") and acts only on its instructions. If you are a reviewer at one of our customers, contact your employer first. We will help them answer you.

2. Personal data we collect

What we do not collect: typed text, passwords, clipboard contents, screen recordings, files or browsing history. Raw input events are processed locally by default and held only in short-lived buffers. No camera or physiological signal is used in the initial product.

3. Cookies and similar technologies

Our website does not use advertising cookies, analytics trackers or cross-site tracking. It may store one preference in your browser if you dismiss the announcement banner. Our pages load fonts from Google Fonts, which receives your IP address when a page loads. Interactive demos run entirely in your browser: pointer movements you make in them are not sent to us.

4. How we use personal data

We do not sell personal data, share it for cross-context behavioral advertising, or use product data to identify individuals or monitor productivity.

5. How we share personal data

• Service providers that host our infrastructure, send email, schedule meetings or manage customer relationships, under contracts limiting their use of the data. Messages sent through our contact form are delivered to our inbox by FormSubmit (formsubmit.co).
• Our customers, for product data they control.
• Professional advisers, such as lawyers and accountants, under confidentiality.
• Authorities, when required by law or valid legal process.
• A buyer or successor in a merger, acquisition or sale of assets, under this Policy's protections.

6. International transfers

Human Control is based in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or another valid transfer mechanism.

7. How long we keep data

8. Security

We protect personal data with measures appropriate to the risk: local feature extraction, short-lived raw buffers, signed assertions with protected signing keys, encryption in transit, least-privilege access and logging of access to production systems. No system is perfectly secure, and we will notify affected customers and individuals of a breach as required by law.

9. Your rights

Depending on where you live, you may have the right to know what personal data we hold, access it, correct it, delete it, receive a copy, object to or restrict its use, opt out of direct marketing, and withdraw consent. European rights are detailed on our GDPR page, and Illinois rights on our BIPA page.

California residents have the rights provided by the California Consumer Privacy Act, as amended by the CPRA, including the rights to know, delete, correct and limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights. You may use an authorized agent.

To make a request, email info@human-control.com with the subject "Privacy request". We may need to verify your identity, and we answer within the time the law requires, usually 30 to 45 days.

10. Children

Our Services are for businesses and are not directed to children under 16. We do not knowingly collect their personal data.

11. Changes to this Policy

We will post any change on this page with a new effective date, and notify customers of material changes affecting product data.

12. Contact

Human Control, Inc. · info@human-control.com · subject "Privacy".

Related documents

Effective date: November 2, 2026

This document follows interaction data through Human Control, stage by stage, so your security, privacy and works-council reviewers can see exactly what happens to it. The signed Data Processing Addendum ("DPA") attached to your customer agreement remains the binding document. To request it, write to info@human-control.com.

1. The design rule

Three principles shape every part of the product:

• Collect only what the control question requires. Features are extracted locally by default and raw buffers are short-lived.
• Keep each customer separate. Records are scoped to one customer environment and never mixed with another customer's data.
• Read only at the moment of the approval. Human Control checks a sensitive action, not a person's day.

2. What the component reads

When a reviewer makes a sensitive approval, the component on their workstation reads interaction timing and motion:

• pointer movement around the approval: path, speed, hesitation, corrections;
• click timing and rhythm;
• typing rhythm: the intervals between keys and how long keys are held, never which keys.

It does not read typed text, screen content, screenshots, files, emails, browsing history, camera, microphone or location.

3. Local processing by default

By default, raw input events are processed on the workstation in short-lived buffers and reduced to the features needed for an assessment. They are kept separate from durable assertions and are not retained as records. Any deployment that needs a different data flow documents it in advance.

4. What is sent and stored

5. What an assertion is, and what it is not

An assertion states whether observed control, for a defined interaction or interval, was human, automated, mixed or indeterminate. It does not establish the legal identity of the reviewer, does not score their performance and does not certify that the workstation is free of malware. Your release policy decides what happens next, and a person flagged by mistake can re-confirm in seconds.

6. Integrity of the data

• Collector identity, configuration, timestamps and model version are bound to every result.
• Assertions are signed with protected keys, so a forged or altered assertion is rejected. A signature protects integrity; accuracy is measured separately.
• The executor accepts an assertion only for the exact action it is bound to. A compromised endpoint may fabricate input, which is why each profile states its limits.
• Data in transit is encrypted, and access to production data is restricted and logged.

7. Revocation and deletion

• Customers can remove the component from any workstation at any time through their device-management tools.
• Customers can ask us to delete the records linked to a workstation or a reviewer. We complete verified deletion requests within 30 days.
• When an agreement ends, the customer's environment and its data are deleted within 30 days, unless the law requires us to keep something longer.

8. Improving detection

Customer data is used to measure and improve detection for that customer. It is not used to train models shared with other customers unless the customer agrees to it in writing. Red-team runs during a pilot use synthetic agent activity on the customer's staging queue.

Research sessions recorded through the console at platform.human-control.com are consented and labeled, and have their own notice, permissions and data flow, separate from any production deployment.

9. Sub-processors and hosting

We use a small number of sub-processors, mainly a cloud provider for hosting, databases and key management, and a provider for transactional email. We use no advertising or data-broker processors. The current list, with hosting regions, is available to customers on request, and customers are told in advance of any new sub-processor, with the right to object.

10. Breach notification and assistance

We notify affected customers without undue delay after becoming aware of a personal data breach, with the information they need to meet their own obligations. We help customers answer data subject requests, carry out data protection impact assessments and complete security questionnaires.

11. Questions

Technical and security questions: info@human-control.com, subject "Data privacy". Region-specific rights are covered on our GDPR and BIPA pages.

Related documents

Effective date: November 2, 2026

1. Purpose and scope

This is the public written policy of Human Control, Inc. under the Illinois Biometric Information Privacy Act, 740 ILCS 14 ("BIPA"). It covers interaction data processed by Human Control about Illinois residents, and sets out our retention schedule and guidelines for permanent destruction. We apply the same standard in other states with similar laws.

2. Our position on interaction data

Human Control reads interaction timing (pointer movement, click timing, typing rhythm) to assess whether an interaction was controlled by a person, by automated software, or both. It does not collect retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry, and it is not used to identify who a person is.

Even so, because interaction data describes how a person behaves, we choose to apply BIPA's protections to any interaction data and derived features we process, as if they were biometric information.

3. Notice and consent before collection

Human Control is deployed by our customers, on workstations they manage. Before the component reads any interaction data from an Illinois resident, the customer must:

• inform the person in writing that interaction data is being collected, of the purpose and of how long it is kept;
• obtain the person's written release, which may be electronic.

We provide customers with a notice and consent template for this purpose, and our customer agreement requires them to use it or an equivalent.

Research sessions recorded through our console at platform.human-control.com start only after the notice and written consent shown there.

4. Retention schedule

• Raw input events are processed locally by default, held only in short-lived buffers and not retained.
• Derived features and assertion records are kept only as long as needed for evaluation, investigation or audit, as agreed with the customer.
• They are permanently destroyed at the earliest of: the purpose being satisfied; the end of the customer's agreement; 30 days after a verified deletion request; or three (3) years after the person's last interaction with Human Control.

5. Destruction guidelines

Destruction means permanent deletion from production systems and from backups as they rotate, so that the data cannot be reconstructed. When records are destroyed, the related assertions remain valid as a record that an assessment took place, but no longer contain derived interaction features.

6. No sale, no profit, no unauthorized disclosure

We never sell, lease, trade or otherwise profit from interaction data. We disclose it only:

• to the customer that collected it, as part of the service;
• to service providers bound by confidentiality who help us operate the service;
• with the person's consent;
• when required by law, a valid warrant or a subpoena.

7. Standard of care

We store, transmit and protect interaction data using a reasonable standard of care for our industry, at least as protective as the way we handle other confidential and sensitive information: encryption in transit, encryption at rest, least-privilege access controls and audit logging.

8. Rights of Illinois residents and contact

Illinois residents can ask what interaction data is held about them, request its destruction, or withdraw consent. Because our customers control their deployments, we route requests to the relevant customer and help them answer. Write to info@human-control.com with the subject "BIPA request". We respond within 30 days.

Related documents

Effective date: November 2, 2026

Human Control is designed so that the most sensitive data never leaves the reviewer's workstation. This page explains how we apply the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

1. Roles

• Customers are controllers of the personal data of their reviewers and console users. Human Control processes that data as their processor, under a Data Processing Addendum meeting Article 28.
• Human Control is the controller for website visitors, business contacts evaluation and research participants. See our Privacy Policy.

2. Data protection by design

• Data minimisation (Art. 5): features are extracted locally by default and raw buffers are short-lived. Models are population-level: no one is enrolled as a biometric identity.
• No content: no typed text, screen content or files are collected.
• Purpose limitation: data is used only to verify sensitive approvals, never to monitor productivity or profile people.
• Storage limitation: retention limits are set out in Data Privacy and BIPA.
• Security (Art. 32): signed assertions, protected keys, encryption and restricted access.

3. Legal bases

For the product, the customer determines the legal basis, typically its legitimate interest in preventing fraud and securing payments (Art. 6(1)(f)), or compliance with a legal obligation (Art. 6(1)(c)). Where a customer relies on legitimate interest, we provide the information it needs for its balancing test. For our own website and business contacts, see the table in our Privacy Policy.

4. Employees and works councils

Because Human Control runs on employees' workstations, customers may need to inform or consult employee representatives before deployment. We provide a reviewer notice template, a data-flow sheet and the technical documentation these consultations usually require.

5. Automated decisions (Art. 22)

An HCA assertion describes how an interaction was produced; it does not decide anything about the person. When an assessment doesn't support human control, the customer's policy chooses a retry, an approved alternative or review by a person. HCA results must not become disciplinary findings or productivity measures, and people can challenge a classification.

6. Impact assessments

We help customers carry out data protection impact assessments (Art. 35) with a description of processing, data categories, risks and safeguards.

7. International transfers

Human Control is based in the United States. Transfers of personal data outside the EEA, the UK or Switzerland rely on the European Commission's Standard Contractual Clauses, with the UK addendum where relevant, supported by a transfer risk assessment.

8. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time where processing relies on consent.

9. Making a request

If you are a reviewer at one of our customers, send your request to your employer, which controls that data. We will assist them.

For any other request, write to info@human-control.com with the subject "GDPR request". We answer within one month, which can be extended by two further months for complex requests, as allowed by Article 12.

10. Representative and complaints

Where the GDPR requires it, we will appoint a representative in the EU and the UK and list them on this page. You also have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where an alleged infringement took place.

Related documents