Privacy policy

HumanApproved is a service that lets a person review and approve an insurance purchase, or a change to an insurance policy, that an AI assistant is making for them, and gives the insurer a record of that approval. It is provided by Open. This Privacy Policy explains what personal information Open collects when you use HumanApproved, what we can and cannot see, how we use and share it, and the choices and rights you have.

1. Who we are

In this policy, "Open", "we", "us" and "our" means the Open company in your country of residence shown below, together with its related entities. Open's related entities are the companies in the Open group, all wholly owned by Open Insurance Technologies Pty Ltd (ABN 21 612 668 998): Open Technology Services AU Pty Ltd, Open Technology Services UK Limited and Open Technology Company Pty Ltd. HumanApproved and the HumanApproved logo are trade marks of Open Technology Company Pty Ltd.

"Services" means the HumanApproved review and approval pages, the HumanApproved console used by insurers, the website at humanapproved.com, our support channels, and any related products we provide.

2. Open, the insurer and your AI assistant

Three organisations are involved when you approve a purchase through HumanApproved, and they have different responsibilities for your information.

• The insurer. The insurer whose product you are reviewing decides what information to ask for, what to show you and whether to sell you a policy. It is responsible for your personal information in its quote and sale, and its privacy policy governs how it uses that information. We handle the information shown on a review page on the insurer's behalf and on its instructions.
• Open. We provide the technology: detecting that an AI assistant is making the purchase, pausing it, showing you the review page, recording your decision, and giving the insurer a signed record. We are responsible for the information we collect for our own purposes, such as keeping the Services secure and running our website.
• Your AI assistant. AI assistants (such as ChatGPT, Meta AI, Grok, or Claude) that bring you to HumanApproved are independent. We do not control them and are not responsible for what they do with your information. Your assistant already holds the information it entered for you.

What "sealed" means in this policy. The quote, price and underwriting answers shown to you on a review page are encrypted before they reach us, in a way that is designed so that only you and the insurer can open them. The key that opens them travels in your review link, in a part of the link that your browser never sends to us, and the information is opened only in your browser and by the insurer. The records we store are sealed in the same way. We call this information "sealed information". Depending on the installation the insurer has chosen, either we never handle the key at all, or we handle it for the moment it takes to send you your review link and then discard it without storing or recording it. Either way, we do not look at sealed information in the normal operation of the Services, and our stored records cannot be opened by us.

3. The personal information we collect

Information about the purchase you are reviewing (sealed). The insurer sends us the quote and the information your AI assistant entered on your behalf so that we can show it to you. This can include your name, date of birth, contact details, address, details of the thing being insured (for example your car or home), your claims and driving history and other underwriting answers. Some of this may be sensitive information, for example a medical condition affecting driving. This information reaches us sealed, is shown to you on your device, and is stored and passed back to the insurer sealed.

Information used to verify that a person is present. Before you can approve, you complete a verification step chosen by the insurer: for example a one-time code sent to your mobile number or email address, or a human-verification check in your browser. Where the insurer has asked us to send the code, the insurer gives us your mobile number or email address for that purpose; we use it only to send the message and afterwards keep only a one-way fingerprint of it. Where the insurer sends the code itself, we do not receive your contact details. We check the code you enter against a one-way fingerprint and do not store the code. The verification step confirms that a person with access to the link and the code is present; it does not verify your identity.

Your decision and the approval record (sealed). Your choice to approve or reject, the time you made it, a sealed copy of the pages exactly as they were shown to you, the versions of the insurer's documents, and details of the device and session used. This record is signed by us so that it cannot be altered without detection. The copy of the pages is sealed and can be opened only by the insurer.

Technical and usage information. Your IP address, browser and device type, operating system, language, and time zone; how you interact with a review page (timing, scrolling, typing, and clicks); and signals that help us tell whether a page is being used by a person or by automated software. We collect this using cookies and similar technologies, described in our Cookies Policy. This is the information about you that we can see, and we use it only to run and secure the Services.

Information you give us when you contact us. What you tell us when you contact Support, and our record of the exchange. Please do not include details of your insurance quote or policy when you contact us; we cannot see them and do not need them.

Information from insurers and developers. Insurers using our console give us the names and contact details of their staff and the product content shown on review pages. Developers who integrate with HumanApproved give us their contact and account details. Visitors to humanapproved.com who request a demo or information give us their business contact details.

4. How we use personal information and why we are allowed to

We do not sell personal information, we do not use it for advertising, and we do not use personal information from the Services to train artificial intelligence models.

5. Automated decisions

We use automated detection to decide whether a session on an insurer's checkout looks like it is being driven by automated software and therefore needs a person to approve the purchase. This decision pauses a purchase; it does not decide whether you can buy insurance, and it does not refuse you anything. If our detection treats you as automated software when you are a person, you can simply complete the review and approval yourself. If you believe an automated decision has significantly affected you, contact Support at humanapproved.com and a person will review it. The insurer, not Open, makes all decisions about your quote and policy.

6. Who we share personal information with

• Open's related entities. Our platform is built and operated by Open Technology Services AU Pty Ltd in Australia, and our support is provided by one team for all countries. We share information within the Open group so that we can host, operate, support, and secure the Services, manage our relationships with insurers, and meet our legal obligations. Sealed information is shared within the group only in sealed form. All Open entities are bound by this policy and by written agreements requiring them to protect your information to the standard required in your country.
• The insurer. We send the insurer your decision and the signed approval record, including the sealed copy of what you saw, which the insurer can open with its own key. The insurer uses it to decide whether to issue the policy or make the change, and keeps it as part of its records.
• Your AI assistant. We tell your assistant that an approval or rejection has been completed, using a reference and a token. We do not send it the content of what you reviewed.
• Service providers. Companies that provide hosting, content delivery and security (including bot detection), SMS and email delivery (where we send codes), customer support tools, analytics for our website, and professional services. They act on our instructions under written contracts, may only use personal information to provide their services to us, and cannot open sealed information. Our current service providers and their locations are listed at humanapproved.com (see "Sub-processors") and we will update that list when they change.
• Regulators, courts and law enforcement. Where the law requires it, to protect our rights or the rights of others, or in response to a lawful request. We can only provide information we can see; requests for the content of a sealed record are directed to the insurer.
• A buyer of our business. If we sell, merge or reorganise all or part of our business, personal information may be shared with the parties involved and transferred to a successor, who will be bound by this policy.
• With your consent. In any other case where you ask us to or agree.

7. Where your information is held and international transfers

Sealed information and approval records for United Kingdom residents are stored in the United Kingdom, and for Australian residents in Australia, on separate deployments with their own data stores. If you use the Services while travelling, your information may be processed momentarily in the country you are in before being stored in your home country.

Our platform is operated and supported from Australia, so Open staff in Australia may access the information we can see (such as technical information and approval references) to operate and support the Services; they cannot open sealed information. We also use service providers in the United States, the United Kingdom, the European Union, and Australia.

Where information is accessed from or transferred to another country, we put in place the safeguards required by the law of your country. For United Kingdom residents this includes the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) with each Open entity and service provider outside the United Kingdom, or a UK adequacy regulation. For Australian residents we take reasonable steps to ensure that overseas recipients handle your information in accordance with the Australian Privacy Principles, and we remain accountable for them.

8. How we keep your information secure

We protect personal information with technical, organisational and physical safeguards, including: end-to-end encryption of sealed information so that it is designed to be opened only by you and the insurer; encryption of all other data in transit and at rest; signing of every approval record with keys held in hardware security modules so that records cannot be altered without detection; role-based access with every access to records logged; separate deployments for each country; an in-house security team with continuous monitoring; annual penetration testing by an independent firm; and training for our staff. The software that opens sealed information runs in your browser and is published as signed, versioned releases. We require our service providers and related entities to meet equivalent standards. No system is completely secure, and we cannot guarantee that unauthorised access will never happen, but the records we store are sealed and a breach of our storage would not by itself expose the content of your sealed information.

9. How long we keep information

• Approval records. We keep the signed approval record, in sealed form, for as long as the insurer requires so that it can deal with complaints, disputes, and claims about the policy. Unless the insurer has set a different period, that is seven years after the policy ends for Australian insurers and six years after the policy ends for United Kingdom insurers, or longer if a claim or dispute is open or the law requires. Where an insurer has chosen not to have us keep records, we delete our copy once the insurer has confirmed it has received the record.
• Review links. A review link expires 60 minutes after it is issued. Once it has expired, the key it carries no longer opens anything, and your assistant can ask the insurer for a new one.
• Verification information. Contact details used to send a code are kept only as a one-way fingerprint after the message is sent. Codes are never stored. Delivery and verification logs are kept for up to 13 months for security purposes.
• Technical and usage information. Kept for up to 13 months, then deleted or aggregated so that it no longer identifies anyone.
• Support records. Kept for up to two years after your last contact with us.
• Business contacts. Kept while we have a relationship with the organisation, and for up to two years after the last contact.

We may keep aggregated, de-identified information that does not identify anyone for as long as we need it.

10. Your rights and choices

Depending on where you live, you have rights to: access the personal information we hold about you and receive a copy; have inaccurate information corrected; have information deleted; object to or restrict certain processing; receive your information in a portable form; withdraw consent you have given; and complain to a privacy regulator. Part 14 (United Kingdom) and Part 15 (Australia) describe your rights in more detail.

To exercise a right, contact Support at humanapproved.com. We will need to verify that you are the person the information is about, and we will respond within the time the law requires (one month in the United Kingdom; 30 days in Australia), or tell you if we need longer and why. We will not treat you differently for exercising your rights.

Because sealed information and approval records are held on the insurer's behalf and can be opened only with the insurer's key, we will pass requests about them to the insurer and help it to respond. You can also contact the insurer directly.

11. Children

The Services are for adults buying or changing insurance. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided information to us, contact Support at humanapproved.com and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the new version at humanapproved.com with its effective date and, where the change is significant, tell insurers so that they can inform their customers. The version of this policy in force when you completed an approval is recorded with your approval record.

13. How to contact us and how to complain

For any question, request or complaint about this policy or how we handle your information, contact Support at humanapproved.com. We will acknowledge a complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the regulator for your country named in Part 14 or Part 15.

If your complaint is about your insurance quote, policy, claim, or how the insurer has handled your information, please contact the insurer first. Insurers have their own complaints processes and belong to an independent dispute resolution scheme: the Financial Ombudsman Service in the United Kingdom (financial-ombudsman.org.uk) and the Australian Financial Complaints Authority in Australia (afca.org.au).

14. United Kingdom

This Part applies if you live in the United Kingdom and supplements the rest of this policy.

• Controller and processor. Open Technology Services UK Limited is the controller of personal information we collect for our own purposes: technical and usage information, website visitor information, support records, and business contacts. For sealed information and approval records, the insurer is the controller and Open Technology Services UK Limited is its processor, acting only on the insurer's documented instructions under a written data processing agreement.
• Lawful bases. Our lawful bases are set out in Part 4. Where we rely on legitimate interests, we have balanced them against your interests and rights, and you have the right to object. Special category data (such as health information in your underwriting answers) is processed on the insurer's behalf under the insurer's lawful basis, which is generally the insurance purposes condition in Schedule 1 to the Data Protection Act 2018; we hold it only in sealed form.
• Your rights. Under the UK GDPR you have the rights of access, rectification, erasure, restriction, data portability, and objection, and rights in relation to automated decision-making, in each case subject to the conditions in the law. Part 5 explains the one automated decision we make and how to have it reviewed by a person.
• Complaints. You have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to address your concern first.
• International transfers. Transfers outside the United Kingdom are made under the UK International Data Transfer Agreement or UK Addendum, or to a country covered by UK adequacy regulations. You can ask us for details of the safeguards in place.
• Data protection contact. Contact Support at humanapproved.com, marking your message for the attention of the data protection lead.

15. Australia

This Part applies if you live in Australia and supplements the rest of this policy.

• The Privacy Act. Open Technology Services AU Pty Ltd is bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy is our APP privacy policy.
• Collection. We collect personal information from the insurer, from you (your decision and anything you tell us) and from your device. We collect sensitive information only with the consent you gave the insurer or where the law otherwise permits, and we hold it only in sealed form that we cannot open. If you do not provide information that we or the insurer ask for, the approval may not be able to be completed.
• Overseas disclosure. We disclose personal information to Open entities and service providers in the United Kingdom, the United States, and the European Union, as described in Parts 6 and 7. Sealed information leaves Australia only in sealed form.
• Automated decisions. We use personal information in the automated decision described in Part 5. It does not decide whether you can buy insurance, and you can ask for a person to review it.
• Access and correction. You may ask for access to, or correction of, the personal information we hold about you by contacting Support at humanapproved.com. We will respond within 30 days. If we refuse, we will tell you why and how to complain.
• Complaints. Contact Support at humanapproved.com. We will acknowledge your complaint within seven days and aim to resolve it within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney NSW 2001.
• Direct marketing. We do not send marketing to Approvers. Business contacts can opt out of marketing at any time by following the unsubscribe link or contacting Support at humanapproved.com.

16. United States and other countries

HumanApproved is not currently offered to residents of the United States or of countries other than the United Kingdom and Australia. This policy will be updated before the Services are offered elsewhere.