Last revised 9 September 2026
This notice explains what we collect, why we use it and how to contact us about your data.
Who is responsible
Predictive Human Insights Ltd, trading as Human Behaviour AI, is the data controller. We are registered in England and Wales, company number 17045845, at 1 Empire Mews, London, England, SW16 2BF. Contact jason@humanbehaviour.ai.
The readiness assessment
When you start, we create a session record and a session cookie that expires after 24 hours. The record includes one-way hashes of your IP address and browser information to help prevent abuse. A hash disguises the original value; it does not make the record anonymous.
The assessment has fifteen questions about culture, leadership and practice. Your answers and scores stay in the page until you ask us to email a report. At that point, we store your work email, answers, scores, written report and submission details. We do not ask for your name in the assessment.
We send your answers and scores to Anthropic’s API to write the report commentary. We do not include your email address in that request. If the AI service is unavailable, we may use prepared commentary instead. The scores are calculated by our scoring rules, not by the AI model.
We email the report through Resend and notify our team by email and Slack. The notification includes your email, scores and suggested service. The assessment suggests a starting point for a conversation; it does not make decisions about your rights or eligibility for a service.
Enquiries and bookings
The enquiry form collects your name, work email, selected services, team-size range, annual-revenue range and message. We send these details to our team by email and Slack so we can reply. Please do not include confidential client information in the message.
If you follow our booking link, Google Calendar collects the details needed to arrange the meeting under its own privacy terms. The public course on Maven and our Substack journal also have their own privacy notices.
Website and security data
Vercel hosts the website and provides bot protection. Requests include technical information such as an IP address, browser information and the page requested. We use this information to operate the site and prevent abuse. Where enabled, Upstash processes IP-based request counts for rate limiting.
We use Vercel Web Analytics to understand page visits, referral sources and broad device and location information. It does not use analytics cookies or track visitors across websites. It uses a temporary identifier derived from request information. We do not send assessment answers or enquiry messages as analytics events.
Why we use this information
We rely on our legitimate interests in providing the requested assessment report, answering business enquiries, arranging meetings, understanding website use and protecting the site. Where we take steps at your request to enter a contract with you, or deliver that contract, we rely on that contractual basis. We use records to meet legal obligations where those obligations apply.
You can object to processing based on legitimate interests by emailing us. We do not add you to a marketing list when you request a report or send an enquiry.
Who processes the data
Our providers include Vercel for hosting, analytics and security; Supabase for assessment storage; Anthropic for report commentary; Resend for email delivery; Slack for internal notifications; and, where enabled, Upstash for rate limiting. Our team also receives notifications in its email service. We do not sell your personal data.
Processing outside the UK
Our assessment database is configured in Supabase’s London region. Some providers and their service partners process data outside the UK, including in the United States. UK storage does not mean all processing stays in the UK.
Provider data-processing terms set out the safeguards for these transfers, including approved contractual clauses and the UK addendum where applicable. Contact us for details of the safeguards relevant to your data. See the Vercel, Anthropic and Supabase data-processing terms.
How long we keep data
We keep assessment and enquiry records while they are needed to deliver or discuss your report, answer your enquiry, support an active engagement or meet a specific legal obligation. We consider whether a conversation or engagement is still active and whether there is a documented reason to keep the record.
Jason reviews assessment records, enquiry emails and Slack copies every quarter. Records no longer needed are deleted or anonymised. If a record must be kept, we record the reason and review it again. This is a manual review process, not automatic deletion after a fixed period. Provider logs and backups follow the relevant provider’s retention arrangements.
Your rights
Depending on the circumstances, you can ask to access, correct or delete your personal data, restrict its use, object to processing or receive a portable copy. Email jason@humanbehaviour.ai to make a request. We normally respond within one month; if an extension is permitted and needed, we will explain why.
You can complain to the Information Commissioner’s Office.
Changes to this notice
This revision updates the assessment and enquiry descriptions, explains security and AI processing, and replaces the fixed twelve-month retention statement with quarterly reviews.