Privacy Policy

1. Data Controller

The controller of your personal data is Semanticad Sp. z o.o., operating the Humanai brand, with its registered office at Os. Dywizjonu 303 20A/5, 31-872 Kraków, Poland, NIP (tax ID): 6762499774.

For any matters relating to personal data protection, contact us at: hello@hmai.agency

2. What Data We Collect and Why

2.1 Contact Form

When you fill in a contact form, we collect: your full name, email address, phone number (optional), company name and website address (optional), the selected topic and your message. The message is delivered to our mailbox, and the data is stored in our CRM system (Bigin).

Together with the form, we store your cookie banner choice in the CRM. If you accepted marketing cookies, we also store a random visitor identifier and the ad click identifier (e.g. gclid) for the measurement described in section 2.6.

Purpose: responding to your enquiry and pre-sales communication.
Legal basis: Art. 6(1)(b) GDPR — processing necessary to take steps at your request prior to entering into a contract; and Art. 6(1)(f) — our legitimate interest in responding to business enquiries.

2.2 Consultation Booking (TidyCal)

You book the free audit and other consultations in the TidyCal calendar embedded on our website. We collect: your full name, email address, the selected time, your website address and your answers to the booking form questions. Once a day we transfer bookings to our CRM system (Bigin) using Make.

After booking, we redirect you to our thank-you page. Your email address is passed in the part of the address after the “#” sign, which never reaches our server. A script on the page removes it from the address bar immediately. If you accepted marketing cookies, it converts the address into a SHA-256 hash (section 2.6); otherwise it discards it.

Purpose: scheduling and conducting the consultation.
Legal basis: Art. 6(1)(b) GDPR — processing necessary to take steps at your request prior to entering into a contract.

2.3 Webinars, Resources and Emails (GetResponse)

When you register for a webinar, download one of our resources (e.g. through an ad form on Facebook or Instagram) or leave your address to be notified about an intake, we collect: your email address, your first name (if you provide it) and the advertising budget range we ask about in the form. The data is stored in the GetResponse email system, and submissions from Meta ad forms are also stored in our CRM (Bigin).

During a webinar you can ask a question (your name and email are optional) and fill in a survey. Questions and answers are stored on our server.

Purpose: sending webinar access or the requested resource, reminders, answers to your questions and — with your consent — marketing emails.
Legal basis: Art. 6(1)(b) GDPR — providing the service you request; Art. 6(1)(a) — your consent to marketing emails, which you can withdraw at any time using the link in the footer of every email; Art. 6(1)(f) — our legitimate interest in improving our webinars (questions and survey).

2.4 Analytics (Google Analytics 4)

With your consent, we use Google Analytics 4 to collect data about how you use the website: pages visited, time spent on pages, traffic source, device type and approximate geographic location (country / region level). Google Analytics distinguishes visitors using identifiers stored in cookies.

Legal basis: Art. 6(1)(a) GDPR — your consent given in the cookie banner.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

2.5 Cookies and Marketing Tools (Google Ads, Meta, ChatGPT Ads)

With your consent to marketing cookies, we use:

• Google Ads — conversion measurement and remarketing;
• Meta Pixel (Facebook, Instagram) — conversion measurement and remarketing. We also send the same events (e.g. a form submission) to Meta from our server (Meta Conversions API): the event name, page address, identifiers from the _fbp and _fbc cookies, IP address and browser data, and for forms — SHA-256 hashes of your email address and, if provided, your first name and phone number, computed on our server;
• ChatGPT Ads (OpenAI) — measuring conversions from ads shown in ChatGPT.

Purpose: measuring the effectiveness of advertising campaigns and remarketing.
Legal basis: Art. 6(1)(a) GDPR — your consent given in the cookie banner.
Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

2.6 Measuring Ad Effectiveness Based on Enquiry Outcomes

With your consent to marketing cookies, we tell Google Ads and Meta which enquiries from ads turned into a call or a contract. This lets us measure and optimise our campaigns. We use:

• from the website: a random visitor identifier (it contains no information about you), ad click identifiers (gclid, gbraid, wbraid, fbclid), the landing page and referring page (without other address parameters), the time of the visit and a SHA-256 hash of the email address from the form or booking — computed by your browser; for this measurement we never send the address itself;
• from our CRM: the stage of your enquiry (e.g. call, proposal, contract) and the value assigned to it, plus SHA-256 hashes of your email address and phone number.

We pass to Google and Meta only SHA-256 hashes of contact details, click identifiers, the stage and the value — never contact details in plain text. Without marketing consent, we do not store the visitor identifier and pass nothing on.

Purpose: measuring and optimising advertising campaigns based on enquiry outcomes.
Legal basis: Art. 6(1)(a) GDPR — your consent given in the cookie banner.
Recipients: Google Ireland Limited and Meta Platforms Ireland Limited (addresses in section 2.5).

2.7 Spam Protection (Cloudflare Turnstile)

Our contact form uses Cloudflare Turnstile to prevent automated spam. Turnstile analyses browser behaviour without storing personal data on our side.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting our systems from abuse.
Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

3. How Long We Keep Data

• Contact form and booking data: up to 3 years from the last communication, or until you request deletion.
• Webinar registration and email list data: until you unsubscribe or withdraw consent; webinar questions and surveys — up to 12 months.
• Analytics data: 14 months (Google Analytics default retention).
• Marketing / advertising data: 90 days for conversion windows; up to 2 years for remarketing lists.
• Ad effectiveness measurement data (section 2.6): visit data not matched to an enquiry — 30 days; data matched to an enquiry — 180 days from the last stage change.
• Cookie consent record: 12 months.

4. Who We Share Data With

We do not sell your data. We share it with entities that process it on our behalf (hosting, CRM, tools) and — with your consent — with analytics and advertising providers, who may also process it for their own purposes in accordance with their privacy policies:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — analytics and advertising (Google Analytics 4, Google Ads, Google Tag Manager)
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland — advertising (Meta Pixel, Conversions API, ad forms)
• OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland — advertising (ChatGPT Ads)
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — security and spam protection (Turnstile)
• Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands — Bigin CRM (EU data centre)
• GetResponse S.A., Gdańsk, Poland — email delivery (webinar registrations, resources, intake notifications)
• Sumo Group Inc. (TidyCal), 1305 East 6th Street, Suite 3, Austin, TX 78702, USA — consultation booking
• Celonis, Inc. (Make), One World Trade Center, 87th Floor, New York, NY 10007, USA — moving data between our tools (bookings and ad form submissions to the CRM and GetResponse)
• SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Poland — website and email hosting (servers in Poland)

5. Transfers Outside the European Economic Area

Google, Meta, OpenAI, Cloudflare, Sumo Group (TidyCal) and Celonis (Make) may process data in the United States. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework, Decision 2023/1795) for certified entities, or on Standard Contractual Clauses, ensuring an adequate level of data protection.

6. Your Rights Under the GDPR

You have the following rights:

• Access — you can request a copy of the personal data we process.
• Rectification — you can ask us to correct inaccurate data.
• Erasure — you can ask us to delete your data (the “right to be forgotten”).
• Restriction — you can ask us to restrict how your data is used.
• Data portability — you can receive your data in a structured, machine-readable format.
• Objection — you can object to processing based on legitimate interest.
• Withdrawing consent — at any time: for cookies via the link in the website footer, for emails via the link in the email footer. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, email us at hello@hmai.agency. We will respond within 30 days.

7. Cookies and Browser Storage

Name	Provider	Purpose	Duration
hmai_consent	Humanai	Stores your cookie consent preferences	12 months
mm-lang, mm-layout, mm-brand	Humanai	Language version and site appearance	localStorage (no expiry)
hmai_zrodlo	Humanai	Which page the consultation was booked from	localStorage / sessionStorage
webinar keys	Humanai	Registration page version, name and email remembered in the question form, completed survey	localStorage / sessionStorage
_loopa_vid	Humanai	Random visitor identifier — measurement from section 2.6, only after marketing consent	90 days
_loopa_fv	Humanai	First visit: date, landing page and referring page — only after marketing consent	90 days
_loopa_click	Humanai	Latest Google or Meta ad click — only after marketing consent	90 days
loopa_visit	Humanai	Landing page and referring page of the current visit — only after marketing consent	sessionStorage (until the tab is closed)
_ga, _ga_*	Google	Analytics — distinguishing users and sessions	2 years
_gcl_au	Google	Google Ads — conversion measurement	90 days
_gcl_aw	Google	Google Ads — ad click identifier	90 days
_fbp	Meta	Meta Pixel — visit tracking for ad attribution	90 days
_fbc	Meta	Meta Pixel — ad click identifier	90 days
__obref	OpenAI	ChatGPT Ads — random browser identifier for conversion measurement	12 months
__oppref	OpenAI	ChatGPT Ads — ad click identifier	30 days
cf_clearance	Cloudflare	Security — Turnstile verification result	Session

Safari may shorten how long cookies set by scripts are kept (usually to 7 days, and to 24 hours after arriving from an ad).

You can withdraw or change your consent at any time by clicking Cookie settings in the website footer.

8. Right to Lodge a Complaint

If you believe we process your data in breach of the GDPR, you have the right to lodge a complaint with the supervisory authority:

Urząd Ochrony Danych Osobowych (UODO) — the Polish Data Protection Authority
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl

9. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top of this page always reflects the most recent version. We encourage you to review this page periodically.