Privacy policy

This notice explains how HumanDesign.AI LTD handles personal data in connection with the Human Design API. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

The short version: the API does not store the birth details you send it. A request is calculated in memory and the result returned. There is no database behind the API in which that information could be kept.

Who we are

HumanDesign.AI LTD is a company registered in England and Wales, company number 14696719, with its registered office at 128 City Road, London, EC1V 2NX. We operate the Human Design API and are the data controller for the account information of the people and companies who hold API keys.

We are registered with the Information Commissioner's Office as a data controller under the Data Protection (Charges and Information) Regulations 2018. Write to [email protected] for any question about this notice or to exercise the rights described below.

Two different roles

This distinction matters, because it determines who is responsible for what.

For your account we are the controller. Your contact details, membership status, billing records, API key and usage history are ours to hold and answer for.

For the birth details you send us we are a processor, and you are the controller. When your product sends us a date, time and place of birth belonging to one of your users, you decide why it is being processed and on what lawful basis. We act on your instruction, which is the API call itself, and we do nothing else with it. Because we do not retain it, our role begins and ends inside that single request.

What we process, why, and on what basis

Account and billing information such as name, email address, company, membership level and payment records. We process this to provide the service and to take payment, on the basis of our contract with you, and to meet accounting and tax obligations, on the basis of legal obligation. UK financial records are ordinarily kept for six years.

API key and usage records. Each call is checked against your key so that plan limits can be enforced, and we record which operation was called and what it consumed. This is necessary to perform our contract with you, and we also rely on our legitimate interest in preventing abuse and keeping the service available to everyone.

Technical logs recording request paths, response codes and error types. These support reliability, security and abuse prevention, on the basis of our legitimate interests. They do not contain request bodies.

Birth details submitted with a request are used to compute the chart and are discarded when the response is returned. The astronomical calculation runs inside our own service using a local ephemeris, so these details are not sent to any third party in order to produce a result.

For clarity: a date, time and place of birth is personal data, but it is not special category data under Article 9 of the UK GDPR. It is not health information, biometric data, or a measurement of anything about a person, and our API does not treat it as such.

What we do not do

We do not retain the content of API requests. We do not sell personal data. We do not use the birth details you send for our own purposes, for training models, for analytics or for marketing. We do not carry out automated decision making producing legal or similarly significant effects, and we do not profile the individuals whose details pass through the API.

How long we keep things

Request content is not kept at all, so there is no retention period, nothing to export and nothing to erase. Account and billing information is kept for as long as you hold an account and then for the period required by UK accounting and tax law. Usage records are kept for as long as needed to administer plans, resolve billing questions and investigate abuse. Technical logs are kept for a limited period determined by what is needed for reliability and security, and no longer.

Who else is involved

We use a small number of service providers, each engaged under terms that require them to act only on our instructions and to keep the data secure.

Railway hosts the API service, in the European Economic Area. Cloudflare provides network and security services in front of it. Supabase stores the public reference data behind the celebrity endpoints, hosted in London. Our own account system at my.humandesign.ai validates keys and counts usage. Payments are handled by our payment providers, who receive the details necessary to take payment and are controllers in their own right for that purpose.

No provider receives the content of an API request, because that content is not stored or forwarded anywhere.

Transfers outside the UK

Where personal data is processed outside the United Kingdom, it is processed within the European Economic Area, which the UK recognises as providing an adequate level of protection. If we ever need to use a provider in a country without that recognition, we will put an International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses in place first, together with any additional safeguards required.

Security

Access to the API requires a key, which is checked on every call. Traffic is encrypted in transit. Keys are yours to keep on your own server, and you should tell us promptly if one is exposed so we can replace it. Not storing request content is itself the strongest protection we can offer for the people whose details pass through: what is never kept cannot be breached.

Your rights

Under UK data protection law you have the right to be told how your data is used, to ask for a copy of it, to have inaccurate data corrected, to ask for erasure, to ask us to restrict processing, to object to processing carried out on the basis of legitimate interests, and to receive data you gave us in a portable form. Where we rely on consent you may withdraw it at any time without affecting what came before.

Write to [email protected] to exercise any of these. We will respond within one month and will not charge you. If your request concerns birth details your own product sent to the API, please note we hold none of it, and the person to approach is the operator of that product.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113, and doing so does not depend on raising it with us first.

Children

The API is sold to developers and businesses and is not directed at children. If you build a product used by children, that responsibility and the associated obligations, including the Children's Code, sit with you as the controller.

Changes

We may update this notice. Material changes will be notified by email to the address on your account or by notice on this site. The date below is the current version.