Privacy Policy
Last updated: 03.11.2026
Human Amplified is a personal AI assistant. It connects to your email and calendar (e.g., Gmail and Google Calendar) so it can sort your email, draft replies, keep your calendar in order and remind you of what matters. This policy explains what data we process, why, where it goes and what rights you have.
Who we are
Human Amplified is operated by Nauerz Holding BV, Helmgrasstraat 5, 1087 SJ, Amsterdam, the Netherlands, Chamber of Commerce (KvK) number 81122950 ("we", "us"). We are the controller for the personal data described here.
Privacy questions: [email protected]
Security issues: [email protected]
What we collect
Account data: your name, email address and password (stored hashed), so you can sign in.
Waitlist data: your email address, when you join the waitlist, so we can invite you and send the updates you asked for.
Google account data: your Gmail messages and metadata, labels, drafts, your calendar list and events. Only after you connect your Google account and grant permission, and only to provide the features you use.
Content you create: chat messages, notes, tasks, reminders and files you upload.
Memory: facts the assistant learns about you from your conversations and connected accounts. You can view, correct and delete them in Settings.
Usage and error data: pseudonymous product events and error reports, to keep the app working and improve it. Never the content of your messages, emails or documents.
Technical logs: IP address, timestamps and request metadata, for security and operations.
People who write to you: emails and invitations you receive contain data about other people. We process it only to handle your own correspondence for you, and never use it for anything else.
Sensitive data
Your email, calendar and conversations can reveal sensitive information, such as health, religion or political views. We treat all of this data as special-category data under Article 9 GDPR. The assistant only infers personal facts about you after you give explicit consent, and you can withdraw that consent at any time in Settings.
Google user data
When you connect Google, we ask for access to:
Gmail (read, modify, compose): to read and sort your email, apply labels, archive, and draft replies for you to review.
Google Calendar (calendar list, events, free/busy, events you own): to show your schedule, find free time and make changes you approve.
Your Google email address: to identify the connected account.
Human Amplified's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
In particular:
We use Google user data only to provide and improve the user-facing features of Human Amplified that you use.
We do not sell Google user data, use it for advertising, or transfer it to others, except to the service providers listed below that help us run the service, to comply with the law, or with your explicit consent.
We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
No human reads your Google data, unless you explicitly ask us to (for example in a support request), it is needed for security reasons such as investigating abuse, or the law requires it.
You can disconnect Google at any time in Settings or at https://myaccount.google.com/permissions. When you disconnect, we revoke our access and delete the stored Google credentials.
How the AI processes your data
To answer you and act for you, the relevant parts of your data (for example an email you ask about) are sent to our AI model provider, Anthropic, for processing. Under Anthropic's commercial terms, this data is not used to train their models and is deleted after a limited retention period. Anthropic processes it on our behalf.
Legal bases
Contract: to provide the service you signed up for (Art. 6(1)(b) GDPR).
Explicit consent: for processing sensitive data, including memory, and for optional analytics (Art. 9(2)(a) GDPR).
Legitimate interest: for security, fraud prevention, error tracking and service logs (Art. 6(1)(f) GDPR).
Consent: for the waitlist and newsletter. You can unsubscribe in every email (Art. 6(1)(a) GDPR).
Service providers
These companies process data on our behalf:
Supabase: database and sign-in. EU (Frankfurt, Germany).
Hetzner: application servers. EU (Germany).
Anthropic: AI processing. United States.
Google: Google sign-in and the Gmail and Calendar access you grant.
Cloudflare: hosting and network security. Global.
Resend: account and reminder emails. Sent from the EU (Ireland); the provider is based in the United States.
PostHog: pseudonymous product analytics and error tracking, no content. EU (Frankfurt, Germany).
beehiiv: waitlist and newsletter. United States.
Where data leaves the EU, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We do not sell personal data.
How long we keep data
Account, content, memory and mirrored Google data: as long as your account exists, deleted within 30 days after you close your account.
Usage events and error reports: 12 months.
Service logs: 30 days.
Database backups: 7 days (Supabase), plus encrypted offsite backups for up to 30 days (Hetzner, Germany).
Newsletter and waitlist email: until you unsubscribe or join the beta.
Your rights
You can ask us to access, correct, delete, restrict or export your data, object to processing, and withdraw consent at any time. Withdrawing consent does not affect processing that already happened. Send requests to [email protected]. We answer within one month.You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).
Security
Data is encrypted in transit and at rest. Google credentials are stored encrypted, with a key held only by the service that needs it. Access to production data is restricted, and every emergency access is logged. If a breach affects you, we will tell you and the authority as the law requires.
Children
Human Amplified is not intended for anyone under 16.
Changes
We will update this page when our practices change, and tell beta users by email about important changes.