hum.community Privacy Policy

1. Who We Are

The Wellbeing Protocol ("we", "our", or "us") operates the hum.community app (the "App", installed from phone.hum.community) and its partner and funder dashboards to support community-led decision-making, community savings groups, mutual-credit exchange, and participatory grantmaking.

We comply with the EU General Data Protection Regulation (GDPR), the New Zealand Privacy Act 2020, and the Australian Privacy Principles.

2. What We Collect

3. How We Use Your Information

• Managing your account and signing you in.
• Running your community's governance, currency, and savings features.
• Paying funded projects.
• Sending notifications you opt into.
• Improving reliability and fixing errors.

We never sell or rent personal information.

4. What Other People Can See

Hum is a community platform, and taking part means some information is visible to others:

• Community members see your name, photo, and bio — and your phone number if your community enables that.
• The community-currency ledger shows your name and transaction amounts to members of your community.
• Savings-group records are visible to your group and its stewards.
• Your voting participation is visible according to your community's governance rules.
• Partners and funders supporting your community can see membership lists and community activity; your community can withdraw that access at any time.

5. Service Providers We Rely On

• Supabase — database, sign-in, and file storage, hosted in Australia (Sydney).
• Railway — application hosting and operational logs.
• Vercel — dashboards hosting; Vercel Analytics collects page-view and performance data on the dashboards only, not in the App.
• Resend — transactional email.
• Twilio (via Supabase) — SMS sign-in codes.
• Anthropic — AI processing of correspondence sent to our team inbox; never of your App content.
• BaseScan / Etherscan — public blockchain lookups for communities using crypto payouts.

Each provider operates under its own privacy terms, and we maintain data-processing agreements with them.

6. Your Privacy Rights

You can:

• Access the personal data we hold about you.
• Correct your profile and banking details in the App at any time.
• Delete your account from Account → Delete account in the App — this permanently removes your login, contact details, photo, and banking details; your past transactions and votes remain for your community's records but show as "Deleted Member".
• Request a copy of your data (portability), object to processing, or withdraw consent.

To exercise your rights, contact info@hum.community.

• EU/EEA: complaints may be made to your local Data Protection Authority.
• New Zealand: Office of the Privacy Commissioner — privacy.org.nz.
• Australia: Office of the Australian Information Commissioner — oaic.gov.au.

7. How Long We Keep Data

We keep your information while your account is active. When you delete your account, your personal details are removed immediately as described above.

• Technical error logs are deleted after 30 days.
• Community activity feeds are deleted after 2 years.
• Financial records are retained where the law requires it.

8. Security

We protect your data with encryption in transit, row-level database access controls, role-gated interfaces, and rate-limited sign-in.

9. Indigenous Data Sovereignty

We acknowledge and respect Indigenous data rights:

• UNDRIP: Supporting the rights of Indigenous peoples to data sovereignty.
• Maori Data Sovereignty: Upholding principles outlined by Te Mana Raraunga in Aotearoa New Zealand.
• Aboriginal and Torres Strait Islander Data Sovereignty: Recognising the role of the Maiam nayri Wingara Indigenous Data Sovereignty Collective and similar frameworks.

We are committed to engaging with Indigenous and local communities to ensure their data is governed in line with cultural values.

10. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect data from children. If a child's data is found to have been collected, it will be deleted immediately.

11. International Data Transfers

Your information is processed in Australia and, for some of the providers listed above, in the United States. Where data crosses borders we apply safeguards such as standard contractual clauses, in line with the GDPR and other applicable law.

12. Changes & Contact

We may update this policy. Updates are posted in the App and on our website with a new version date, and we will ask you to review material changes — continued use alone is not treated as acceptance.

The Wellbeing Protocol

Email: info@hum.community

Website: www.hum.community