Privacy Policy

Last Updated: March 14, 2025

This Privacy Policy describes how Human Union Data, Inc. ("HUD," "we," "us," or "our") collects, uses, and discloses information about you when you use our website (hud.so), applications, evaluations platform, SDK, API, and other services (collectively, the "Services"). For the purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether an individual or an entity.

Please note that this Privacy Policy does not apply to information that our customers upload to or otherwise process using our Services. To learn more about how such information is collected, used, and disclosed, please contact the relevant HUD customer.

At HUD, we believe that you are in control of your information, and we are committed to privacy. Please read this Privacy Policy carefully. By using any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access the Services.

1. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time, in which case we will update the "Last Updated" date at the top of this Privacy Policy. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.

2. COLLECTION AND USE OF INFORMATION

When you use or access the Services, we collect certain categories of information about you from a variety of sources.

Information You Provide to Us

Some features of the Services may require you to directly provide certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes:

• Basic contact and account details, such as name, organization name, email address, and password. We use this information to create, maintain, and secure your account and to provide the Services, and to communicate with you (including to tell you about products or services that may be of interest to you).
• API credentials and authentication information, such as API keys, OAuth tokens, and other authentication information needed to access our SDK and evaluation services. We use this information to authenticate your requests, provide the Services, and maintain security.
• Payment information, such as credit or debit card information processed through Stripe, and billing address. We use this information to process your payment and provide the Services.
• Infrastructure details, such as information about AWS accounts, EC2 instances, S3 buckets, and other cloud resources that you connect to our Services. We use this information to provision and manage infrastructure for evaluations.
• Evaluation data, such as configuration settings, metadata, actions, and other data related to evaluations performed using our platform.
• Team and organization information, such as team member details, roles, and permissions.
• Any other information you choose to include in communications with us, for example, when sending a message through the Services.

Information Collected Automatically

We may also use cookies or other tracking technologies to automatically collect certain information about your interactions with the Services. We collect and use this information to tailor your experience with the Services, run analytics, better understand user interactions with the Services, etc. Such information includes:

• Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, and clickstream data.

Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of cookies. If you so choose, you may block or delete certain of our cookies from your browser; however, blocking or delete cookies may cause some of the Services, including any portal features and general functionality, to work incorrectly. Your browser settings may also allow you to transmit a "Do Not Track" signal when you visit various websites. Like many websites, our website is not designed to respond to "Do Not Track" signals received from browsers.

Information Collected From Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes:

• Analytics data we receive from analytics providers such as PostHog which we use to improve our website, communications, and the Services.
• Information we receive when you choose to link any third-party accounts to your account or login to your account using any third-party platforms, such as Google, which we use to maintain your account and login information.

Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third Party Websites and Links.

3. DISCLOSURE OF YOUR INFORMATION

We may disclose your information for legitimate purposes subject to this Privacy Policy, including the following categories of third parties:

• Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications, web analytics, payment networks, and payment processing.
• Cloud service providers that provide infrastructure, computing resources, data storage, and related services necessary to deliver our Services. These providers may store and process your information in various geographic locations according to their terms of service.
• Third parties to whom you request or direct us to disclose information, such as through your use of Google OAuth login integration or when you authorize API access.
• Professional advisors, such as auditors, law firms, or accounting firms.
• Third parties in connection with or anticipation of an asset sale, merger, bankruptcy, or other business transaction.

We may also disclose your information as needed to comply with applicable law or any obligations thereunder or to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.

4. THIRD PARTY WEBSITES AND LINKS

We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

5. CUSTOMER DATA AND EVALUATION RESULTS

Our Services enable you to process, store, and analyze data related to your AI agent evaluations. This may include information about your AI models, agent behavior, task performance, and interaction data. We treat this information as confidential and will only use it to:

• Provide the Services to you
• Improve the functionality and performance of the Services
• Comply with applicable laws and regulations
• As otherwise specified in our service agreements with you

6. DATA SECURITY AND RETENTION

We implement appropriate technical and organizational measures to protect your information against unauthorized or unlawful processing, accidental loss, destruction, or damage. However, despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.

7. DATA TRANSFER

We may transfer your personal information to countries outside of your country of residence, which may have different data protection laws. When we do so, we will ensure appropriate safeguards are in place to protect your information and comply with applicable legal requirements.

8. CHILDREN'S PRIVACY

Our Services are not intended for children, and we do not seek or knowingly collect any personal information about children. If we become aware that we have unknowingly collected information about a child, in particular any child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

9. YOUR RIGHTS AND CHOICES

Depending on your location, you may have certain rights regarding your personal information. These may include:

• Right to Access: You may have the right to request information about how we process your personal information and to obtain a copy of that information.
• Right to Rectification: You may have the right to request that we correct inaccurate or incomplete information about you.
• Right to Erasure: You may have the right to request that we erase your personal information in certain circumstances.
• Right to Restrict Processing: You may have the right to request that we restrict the processing of your personal information in certain circumstances.
• Right to Data Portability: You may have the right to request that we provide you with your personal information in a structured, commonly used, and machine-readable format.
• Right to Object: You may have the right to object to our processing of your personal information in certain circumstances.

To exercise any of these rights, please contact us using the contact information provided below. We will respond to your request in accordance with applicable laws.

10. CALIFORNIA PRIVACY RIGHTS

If you are a California resident, the California Consumer Privacy Act ("CCPA") may provide you with additional rights regarding our use of your personal information. These include:

• Right to Know: You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months.
• Right to Delete: You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.
• Right to Opt-Out of Sales: You have the right to opt-out of the sale of your personal information. However, we do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights under the CCPA, please contact us using the contact information provided below.

11. HOW TO CONTACT US

Should you have any questions about our privacy practices or this Privacy Policy, please email us at team@hud.so or contact us at: