Privacy Policy
Effective: 25 August 2026 · Last updated: 25 August 2026
Rare Human is built on a simple commitment: your information is private until you deliberately share it. This policy explains what we collect, why, how long we keep it, and the rights you have over it. It is written to be read — not to be survived.
At this stage Rare Human is a public philosophy site with a waitlist. We do not yet operate member accounts, payments, or agent tooling. This policy covers what exists today and names, clearly, what will change when those launch.
1. Who is responsible for your data
The data controller is UIE Ltd, registered office 66 Paul Street, London, EC2A 4NA (registered in England and Wales, company no. 17334450) ("Rare Human", "we", "us").
- Privacy enquiries and rights requests: privacy@rarehuman.ai
- No statutory Data Protection Officer or UK/EU Article 27 representative is required at the current waitlist processing scale; data-protection queries are handled at privacy@rarehuman.ai.
If you are in the UK or EU, you also have the right to complain to a supervisory authority (see §10).
2. What we collect, and why
We practise data minimisation: we collect the least we need, for a stated purpose, and no more.
2.1 If you join the waitlist
| Data | Why | Lawful basis (UK/EU GDPR) |
|---|---|---|
| Email address | To confirm your interest (double opt-in) and, once you confirm, to email you about Rare Human's launch | Consent (Art. 6(1)(a)) — given by ticking the consent box and confirming via the link we email you |
| Chosen language / locale | To send you information in the right language and format | Consent (part of the same sign-up) |
| Areas of interest (optional) | To make what we send you relevant | Consent |
| A one-way hashed record of your IP + timestamp of consent | Anti-abuse (rate-limiting, spam/bot defence) and to prove your consent was freely given | Legitimate interests (Art. 6(1)(f)) — protecting the service and meeting our accountability duty |
We do not collect your name, and we ask for nothing sensitive. Your waitlist email is treated as private-by-default operational data: it is never placed in analytics, never sold, never used to train any model, and never shared except with the processors named in §5.
2.2 When you simply read the site
The public pages are designed to work with no non-essential cookies and no behavioural tracking (see the Cookie Policy). Our hosting and security infrastructure processes standard technical data — such as IP address and request metadata — transiently, to serve pages and defend against attack. This is our legitimate interest in a secure, available service; it is not used to profile you.
2.3 What we deliberately do NOT collect
No advertising identifiers. No cross-site tracking. No sale of personal data. No "global human score." No behavioural profile of who you are.
3. Automated visitors and AI agents
Increasingly, sites are read and acted upon by AI agents acting for a person, not only by people at a keyboard. Our position, consistent with regulators (an AI agent is a technical means of processing, not a legal person), is:
- The human or organisation that deploys an agent remains responsible for what it does here, and for the lawful basis of any data it collects through us.
- We publish a machine-readable description of our policies and permitted actions (see the Cookie Policy §6 and our
/.well-known/surface) so an agent can read our terms rather than pretend to click a banner. - Where an agent takes an action that needs authority (not applicable at R0, but built into the platform), that authority is expected to arrive as a verifiable mandate carrying the human principal's consent — not as an unattributed click. This is what "secured by WorldAuth" means in practice.
Full detail of how this works across every visitor type is set out in our companion note on agent consent.
4. How long we keep it
| Data | Retention |
|---|---|
| Unconfirmed waitlist email | Deleted automatically if not confirmed within 30 days |
| Confirmed waitlist email | Until you unsubscribe or ask us to delete it, or until the waitlist purpose ends (whichever is first), after which it is deleted or irreversibly anonymised |
| Consent record (hashed IP + timestamp) | Kept for the life of the subscription plus a short period afterwards, as evidence that consent was valid |
| Transient technical/security logs | Short rolling window (typically ≤ 30 days) then deleted |
Every marketing email carries a one-click unsubscribe link, and unsubscribing is honoured immediately.
5. Who we share it with
We do not sell your data and we do not share it for anyone else's marketing. We use a small number of processors who act only on our instructions, under contract, with appropriate safeguards:
- Hosting / edge — {{HOSTING_PROVIDER, e.g. Vercel}} — serving the site.
- Database — {{DB_PROVIDER, e.g. Neon (EU/Ireland region)}} — storing the waitlist record.
- Email delivery — {{EMAIL_PROVIDER, e.g. Resend (EU/Ireland region)}} — sending the confirmation and launch emails. Sent from begin@rarehuman.ai.
Where any processor is outside the UK/EEA, transfers are covered by an adequacy decision or Standard Contractual Clauses / the UK IDTA, with supplementary measures where needed. We will name any additional processor here before it handles your data.
We may also disclose data if legally required (a valid court order or regulator request), or to protect the rights, safety and security of our users and service — disclosing the minimum necessary.
6. How we protect it
Security is architectural, not an add-on:
- Private-by-default data handling and strict least-privilege access.
- Waitlist writes happen only through a server-side, validated, rate-limited path; the public site cannot read the waitlist table.
- Secrets are encrypted and rotated; the credentials that send your email are scoped to sending only and cannot read delivery logs.
- Transport is encrypted (TLS); confidentiality-sensitive channels use quantum-resistant hybrid encryption to defend against "harvest-now, decrypt-later."
No system is perfectly secure, but we design so that a single failure does not expose you.
7. Your rights
Depending on where you live, you have some or all of these rights. We honour them for everyone, regardless of location, as far as we practicably can.
Under UK/EU GDPR you may: access your data; correct it; delete it ("right to be forgotten"); restrict or object to processing; withdraw consent at any time (without affecting prior processing); and receive your data in a portable format. Because our lawful basis for the waitlist is consent, you can withdraw it at any moment — unsubscribe, or email us — and we will erase your record.
Under US state laws (e.g. California/CCPA-CPRA and similar): you may know what we collect, request deletion, and opt out. We do not "sell" or "share" personal information as those laws define it, and we do not use it for cross-context behavioural advertising. We do not discriminate against you for exercising a right.
To exercise any right, email privacy@rarehuman.ai. We respond within the legal timeframe (generally one month under GDPR; 45 days under CCPA). We may need to verify your request to protect you.
8. Children
Rare Human is not directed to children and is intended for adults (18+). We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact privacy@rarehuman.ai and we will delete it.
9. International users and language
English is the authoritative version of this policy. Translations are provided for convenience; if there is a conflict, the English version governs. We serve users globally and process your data in the regions named in §5.
10. Complaints
If you are unhappy with how we handle your data, please tell us first — privacy@rarehuman.ai — and we will try to put it right. You also have the right to complain to a data protection authority:
- UK: the Information Commissioner's Office (ico.org.uk).
- EU: your local supervisory authority (the list is at edpb.europa.eu).
- Elsewhere: your applicable privacy regulator.
11. Changes to this policy
If we materially change how we handle your data — for example when member accounts, payments, or agent features launch — we will update this policy, change the "last updated" date, and, where the change is significant and we have your email, tell you directly before it affects you.
Rare Human — secured by WorldAuth. Build what cannot be generated.