Checking your session

HUMAVECT 90™ — Founder Staging Test Privacy Notice Version: H90-STAGING-PRIVACY-EN-20261018-RC09 Language: English Status: FINAL TEXT — RELEASE REQUIRES EXACT VERSION/HASH APPROVAL Effective date: The effective UTC is recorded with controller release approval for this exact version and hash. This version is not effective until that approval is recorded. The limited private-test exception does not itself approve these exact bytes, create participant acceptance, verify provider retention or constitute Room05 final privacy conformance. 1. Who we are and the scope of this notice HUMAVECT is operated by Ai 4 Emotional Intelligence LLC, 78 Cross Ridge, Greenville, SC 29607, USA. Contact contact@humavect.com for privacy questions and rights requests, or support@humavect.com for access and technical help. Ai 4 Emotional Intelligence LLC determines the purpose and essential means of its own limited product test and is the controller. The Founder acts for the company when directing the test and is separately the individual taking part. No new employer/customer controller arrangement is created by the TEST organization record. No formal DPO appointment is triggered by this limited one-person operational test on the supplied facts. Our privacy contact remains contact@humavect.com; the mailbox is not presented as a DPO. This finding does not certify all other company activities. Our company is registered in the United States and is regularly managed and operated from France. This test takes place in the context of those ongoing French operations, so the EU GDPR applies under Article 3(1). An EU representative under Article 27 is not required for this processing on that basis. No additional UK territorial or representative requirement is established for this limited test on the confirmed facts. This notice concerns the existing adult Founder's current authenticated session, session refresh, logout, personal invitation acceptance and initial authorized S01 Journey Hub/map read only. No further OTP email is authorized. If authentication expires or refresh fails, the test stops. Access ends at completed checks, earlier withdrawal or 2026-10-20T19:00:00Z, whichever happens first, followed by documented staging-access closure. There is no Day 0, assessment, coaching, external AI participant processing, 360, marketing, research, third-party invitation or commercial programme in this scope. 2. Information used Sign-in and sessions: Historical sign-in used your email and one-time code; the present path uses the already-authenticated current session and sends no new OTP email. Supabase Auth processes your existing account identifier, session identifiers, access/refresh tokens, authentication assurance, session times and status. The reviewed staging Auth records contain IP address and browser/user-agent values. The limited application adapter does not copy email or display name into its new participant account record. Invitation and acceptance: The test uses an invitation identifier, an invitation secret submitted in a request body, its stored verification hash, the intended existing account and test organization, and issue, expiry, withdrawal and consumption information. If you personally accept, the application records your participant/account, membership and participant-role identifiers and statuses, the initial Journey identifier/state/version, the exact legal document versions and hashes, the acknowledgment wording/hash, your explicit acceptance, acceptance time, session identifier and minimum correlation/audit information. The acceptance record itself has no IP or user-agent field. Initial Journey read: The read returns the Journey identifier/version and primary, exception and parallel-state labels. An initial label is not evidence that an assessment, 360 process, experiment or 90-day Journey has started. Technical information: Render receives web/API requests, connection information and application output/error logs. The application's controlled API request-completion logs exclude email, tokens, request bodies, paths, IP and user agent. This does not establish that all hosting, framework, authentication or database-provider logs are equally minimized. Database error settings can retain failed statements. Supabase provider/gateway logs may contain information beyond application logs. A socket address is also used temporarily for an in-memory rate limiter with a 60-second window. Expired entries are removed on later traffic or process exit; this is not a promise that every entry is erased exactly after 60 seconds. Behind hosting infrastructure, this may be a proxy address rather than your own IP. No persistent application device fingerprint is implemented. Mail and requests: Brevo is the configured Supabase OTP transport and historical delivery is confirmed. This path sends no further OTP mail. Historical mail processing involved sender/recipient information, the OTP message and delivery metadata. If you contact support or privacy, the mailbox provider processes the email content, attachments and headers. Do not send secrets or unnecessary personal information. No work-content input is offered by this limited flow. No challenge, assessment response, score, reflection, experiment, coaching evidence or research feedback form is collected through it. 3. Where information comes from Sign-in information and the acceptance choice come from you and Supabase Auth. The authorized test owner supplies the invitation's existing account/test scope. The system generates access, state and audit records. Hosting, authentication and email providers generate their necessary operational records. No third party is invited and no employer roster is imported. Source-code and deployment evidence may be held in existing private engineering systems; raw OTPs, session tokens and invitation secrets must not be copied into reports. 4. Browser storage The browser stores the Supabase session, including access/refresh tokens and provider user/session information, in tab-scoped sessionStorage. A PKCE verifier and a signed-out marker may also be present. Automatic session refresh is enabled. The application does not configure persistent Auth cookies or Auth localStorage. Reloading can restore the session in the tab. Closing a tab is not provider session revocation; browser restore or tab duplication may preserve or copy the stored session. Email, code and invitation form values are otherwise held in page memory. Browser autofill and password-manager behavior are outside this application storage setting. No advertising tracker, analytics or session replay was found in the examined limited page paths. This is not a claim that browsers or infrastructure providers produce no telemetry. 5. Purposes and lawful-processing determination for adoption This notice accompanies a completed, purpose-specific assessment for controller adoption with approval of this exact document version and hash. EU GDPR applies to this test. The assessed bases submitted for controller adoption are: - Authentication, requested OTP delivery and intended-account verification: Article 6(1)(f), legitimate interests in checking the actual restricted access boundary. - Invitation binding, explicit participation and version evidence, duplicate prevention and initial authorized state read: Article 6(1)(f), legitimate interests in reliable one-time enrollment and accountable testing. - Necessary security, abuse prevention and failure diagnosis: Article 6(1)(f), legitimate interests in protecting the account and resolving access failures, limited to necessary information and duration. - Supervised closure of test access: Article 6(1)(f), legitimate interests in ending access safely and recording what was closed. - Requested technical support and the minimum justified participation/closure or dispute record: Article 6(1)(f), assessed separately for necessity and retention. - Handling rights or security duties actually imposed on the company by applicable GDPR: Article 6(1)(c), only for the identified duty, such as applicable duties under Articles 12–22 or 32–34. This does not create a statutory requirement to keep every test record for five years. The interest is this specific operational test before wider use, not general behavioral research. Controlled tests have already been used; they do not prove the actual existing account's personal acceptance and access/closure behavior. The test uses one voluntary adult Founder account and no work-content input. Necessary identifiers and state records do not justify unnecessary mail previews, tracking or indefinite provider logs. The narrow purpose and minimum-data necessity are limited to this one existing adult Founder account and the access actions described here. Room 05 does not require account-level contract-version/date records or a complete provider support-country inventory as a staging-admission condition for this no-new-mail path, and this notice does not claim that those records were independently verified. The private operating/closure record and actual fallback are confirmed. The Founder/controller has authorized a limited private-test exception while F3 remains NOT_ESTABLISHED; that authorization does not verify provider retention, adopt an unassessed lawful basis or establish external-law or contract sufficiency. No broader participant, work-content, marketing, research, 360, Company or Day 0 processing is authorized. Without account verification, invitation checks and explicit terms agreement, enrollment cannot proceed. You are not legally required by this test to participate. Accepting terms does not supply a general GDPR consent or automatically establish a contract-processing basis. There is no marketing, research or 360 consent request and no special-category collection or inference. Do not send health or other highly sensitive information through support. Necessary session storage for requested access is a separate terminal-storage question; additional-purpose tracking is not authorized by this notice or by the participation checkbox. If you object to the nonessential test processing, the recommended response is to stop further checks and arrange supervised closure. Any limited information retained for an independent lawful reason must be identified and justified. No automatic erasure or immediate invalidation of every token is promised. 6. People and organizations who may see information This test has no assigned coach, reviewer or active organization administrator service. Enrollment grants participant authority only. There is no employer-facing coaching report. The locked product privacy rules prohibit organization access to private individual coaching data and suppress organization aggregates below ten eligible participants; a one-person test cannot create those coaching aggregates. Application role restrictions do not remove infrastructure privileges. The Founder/platform owners and existing authorized release executor have relevant dashboard or protected operational access. Database-owner/migrator and platform administration can access records beyond ordinary participant permissions. Provider-authorized personnel and subprocessors may have access under the actual service arrangements. Brevo's account support-access permission was disabled and verified after reload on 17 October 2026 around 13:57 Europe/Paris, as reported by the Founder. This does not establish the absence of prior access or eliminate provider processing under its service arrangements; applicable provider-access locations and coverage remain to be established. A private dated operating record identifies the internal privileged roles allowed to administer this test, their scope and operating country. The public notice does not identify those individuals. Provider-authorized personnel and subprocessors may also have service-level access. No claim that “only you can ever access the data” is made. Normal technical support must stay within the minimum account/status information required. Room 05 requires purpose-limited, audited exceptional privacy/security access. This notice does not claim that a full privacy console, staffed review service or self-service deletion tool is operational. 7. Providers, locations and transfers The observed service flows are: - Render hosts the staging web and API in Frankfurt. - Supabase provides Auth and PostgreSQL; the staging project region is eu-west-1. - Brevo is the configured Supabase OTP mail transport and historical real OTP delivery/sign-in is confirmed. No further OTP email is authorized for this test path. The test uses the already-authenticated current session. If that session can no longer authenticate or refresh, the test stops rather than sending another OTP under this approval. - Google Workspace is the confirmed HUMAVECT support/privacy mailbox service when those addresses are used. The Founder's receiving-inbox provider is not required by this no-new-mail test path and is not inferred here. - Existing private GitHub/registry/Codespace and connected engineering custody hold source, images and restricted operational evidence. They are not a permission to put participant messages or secrets into reports. The examined participant call paths do not establish a Cloudflare participant integration. There is no external AI call in the examined deployed limited flow and no assessment interpretation or participant profiling operation. This does not describe unrelated repository code, engineering tools or providers' internal operations. An EU server region does not mean that every controller, support or subprocessor access is confined to the EEA. The controller is a US company. Render and Supabase are the existing services used by this limited staging path. Account-specific agreement/DPA versions and a complete provider support/subprocessor country inventory were not independently verified in this staging review. This notice therefore does not claim all-EEA access, a specific transfer mechanism or an account-level contractual status that was not verified. The test remains limited to the minimum account, invitation, acceptance, state and security information described here and does not collect work content. 8. Retention, closing access and deletion Access ends after the approved checks, earlier withdrawal or the fixed fallback end 2026-10-20T19:00:00Z, whichever happens first, followed by verified staging-account closure. Access closure and erasure are different operations. This test may use an already-authenticated current session. The session is not treated as permanent authority: every guarded staging read remains subject to current server-side access checks. If authentication expires or refresh fails before the limited checks are complete, the test stops. No new OTP email is sent under this path. Local sign-out is not represented as provider-wide session revocation. The existing approved Room 05 categories include unaccepted invitations for 60 days, security/audit records for 12 months, actual support cases for 24 months after closure, minimum privacy-notice evidence for 5 years after account closure, privacy-rights processing records for 5 years, and deleted-data backup residuals for a maximum 35-day rolling expiry. Room 05 supplied the staging-specific mapping, and the Founder approved amendment A1–A4 on 17 October 2026 at 10:28 Europe/Paris. The approved timing rules are: - Anchor the 60-day unaccepted-invitation limit at the authoritative issue time, without resetting it on resend, retry, expiry or withdrawal. - Anchor a rights-request processing record's 5-calendar-year period at its final documented terminal closure. Ordinary correspondence does not reset it; a lawful reopening follows the amendment's specified final-closure rule. - Dispose of or safely minimize/anonymize unnecessary unfinished staging operational records no later than 30 calendar days after verified staging-account closure. An unaccepted invitation follows the earlier applicable invitation or staging-disposal deadline. The authoritative closure timestamp is recorded only after closure commit is reconciled and current staging access is no longer usable. It is not logout, invitation consumption, Journey completion, K061 or S34. The completed legal recommendation does not support the amendment's optional five-year extension for the additional Terms/participation fields in this limited test. A4 requires a separate lawful-basis and necessity confirmation for its longer Terms retention. That confirmation is not given for this test; those additional fields therefore follow the approved maximum 30-day operational disposal rule. They do not acquire five-year retention merely because they were recorded together with notice acknowledgment. The separate existing minimum privacy-notice evidence mapping contains only opaque evidence/subject references, notice version/hash, acknowledgment time, verified closure time/reason/event reference and retention-policy version. It excludes email, raw OTP, invitation secret, access/refresh tokens, IP/user-agent, raw provider payload, the full Journey and raw messages. Its five-year policy limit is a maximum, not a statutory requirement to keep every field throughout that period; retained linkage still needs a necessary purpose, with earlier lawful minimization where the purpose ends. The general completed-Journey period of 24 months after completion and reflection period of 12 months after completion do not apply as completion clocks for this unfinished initial Journey. No reflections or completed Journey are created here. An owner-operated closure and operational-minimization mechanism has now been implemented, locally verified on disposable databases and independently accepted for the exact prepared source and retained test evidence. The earlier source-level immutable-linkage blocker is closed. The access safeguards described below are now deployed, but no closure or disposal has been performed for your account. This does not establish a fully operating disposal service. The prepared mechanism permanently retires the bounded single-test enrollment store, preserving its original immutable-row protections and only the approved minimum evidence fields. It is not a general row-deletion API or authority for future enrollment. It refuses additional acceptances or unexpected dependencies rather than disposing of other users' records. It can preserve unrelated valid uses of an account or organization. The minimum privacy-evidence core has exactly nine fields: evidence reference, opaque subject-evidence reference, privacy-notice version, privacy-notice hash, notice-acknowledgment time, staging-account closure time, closure reason, closure-event reference and retention-policy version. The seven additional Terms-extension fields are retained long term only if A4's separate lawful-basis and necessity condition is genuinely satisfied. That condition is not confirmed for this test, so the additional Terms fields follow the approved 30-day operational deadline. The access-guard migrations and mandatory guarded adapters are now deployed to the existing staging API. Their readiness and access-denial behavior were verified after deployment. A private due register identifies due or blocked work; it does not automatically erase data or prove that a scheduled job ran. Actual owner authorization, target admission, provider-session handling and post-commit access/closure evidence remain necessary. Local restore tests verify specified rejection, suppression and reconciliation cases. They do not prove provider-wide rollback detection: a full migrated pre-closure snapshot requires quarantine and comparison with an external closure/disposal manifest before ordinary traffic resumes. The 35-day backup residual limit runs from an actual logical deletion/minimization event, not from access closure. Local database field retirement does not erase historical database logs, WAL, provider backups or other residual copies; those remain separate account-provider evidence. No full operational record may be kept merely for a foreign key. On 17 October 2026 around 13:43 Europe/Paris, the authenticated HUMAVECT Brevo account settings were inspected and reported to this document owner. Transactional email log retention was set to 1 MONTH for ALL SENDERS, and new transactional email previews were set to NEVER STORE PREVIEWS. These are observed configuration values, not proof that every historical record or preview has been erased. The label 1 MONTH is not represented as a guaranteed 30-day OTP purge or as a limit on every provider copy. Existing Brevo account safeguards remain as recorded: transactional email logs were set to 1 MONTH for all senders; new transactional previews were set to NEVER STORE PREVIEWS; Anonymous email tracking was NO; the Founder reported Per-contact tracking consent = YES and Track contacts whose consent is unknown = NO; account support access was disabled and reload-verified. These settings do not prove that a particular recipient has consented to engagement tracking, that delivered OTP messages contain no tracking, or that historical previews were erased. No engagement-tracking purpose is authorized for this staging test. Because this test proceeds without further OTP mail, the recipient-specific tracking field, residual SMTP measurement behavior and historical-preview disposition are not prerequisites to the current-session acceptance/read path. Any future OTP send is held until the mail path is separately re-admitted and the recipient/residual tracking conditions are resolved. F3 remains NOT_ESTABLISHED. The actual provider-restorable backup/PITR/hidden backup/snapshot/WAL inventory and maximum windows have not been established for this project. Room05 accepted the bounded known engineering-copy evidence and quarantine/external-manifest restore control design, but did not find the provider-residual condition satisfied. The Founder/controller has separately authorized a limited private-test exception for this one supervised existing adult Founder account. The exception does not verify provider retention, change the approved maximum 35-day rule measured from actual logical deletion/minimization, or promise expiry of unverified provider copies. The missing provider inventory/max-window fact remains follow-up work; this notice does not conceal it or claim Room05 final privacy conformance. Provider technical-log source/export periods were not independently verified in this staging review. Application logging is minimized and this test contains no work content. No specific unverified provider log period is promised. The private operating/access/closure record and fixed fallback are confirmed. This prepared final text proceeds on the separately authorized limited private-test exception while F3 remains NOT_ESTABLISHED, not on a claim that Room05's provider-residual condition was met. Commissioning is permitted only with matching recorded controller approval of these exact document versions/hashes, an approval reference and effective UTC. Other provider contract, log-window, support-country, receiving-inbox and historical-mail uncertainties are disclosed and controlled as described above rather than represented as verified guarantees. Pseudonymized records can still be personal data. Immutability does not authorize indefinite retention. 9. Your rights and how to stop To stop the test, tell the supervising operator or email support@humavect.com. To ask about your information or exercise applicable rights, email contact@humavect.com. These support and privacy routes are monitored during the staging test by the privately recorded staging operator. No response-time or staffed-service guarantee is made. No self-service erasure facility is promised. Depending on applicable law, you may request access, correction, erasure, restriction, objection to legitimate-interest processing and portability where its conditions apply. We may ask for proportionate identity verification. Do not send passwords, OTPs or invitation secrets. Where an activity relies on consent, consent may be withdrawn without changing the lawfulness of earlier processing. This test does not convert a participation acknowledgment into consent for unrelated uses. Objecting, stopping access and asking for deletion are separate choices; say which you want or ask for help. Where GDPR applies, the general response period is one month, subject to lawful exceptions/extensions. You may complain to the competent data-protection authority, including in the EEA country where you live or work or where the alleged infringement occurred. For France, see https://www.cnil.fr/en/complaints. The territorial determination for this test is complete; exact document approval remains separate, and the limited private-test exception does not establish unverified provider safeguards. 10. Changes A broader test, new data use or new recipient requires the appropriate review, updated information and any required choice before it starts. Keep a copy of the versions shown to you. These documents, controller release approval and the limited private-test exception do not create participant acceptance; that requires your later personal action in the authenticated flow.