Privacy Policy

Last updated: June 2026

🔒 Short version: Your data stays on your device. When you use AI features, only column headers and sample values are sent to Anthropic's API — never your full dataset. We do not store any of your files or personal data on our servers.

1. Who we are

HumanitarianLink is a data interoperability tool for humanitarian organizations, developed as part of research at the University of Twente, Netherlands. Contact: mohmadabumery@gmail.com

2. What data we process

HumanitarianLink processes the following data:

Account data: Your email address and organization name, stored securely in Supabase (EU region) for login purposes.
Session data: Your column tags and session names, stored in Supabase so you can resume your work. This data does not include your actual Excel file contents.
API key: Your Anthropic API key is stored only in your browser's localStorage. It is never sent to our servers.
Excel data: Your Excel files are processed locally in your browser and on our server only during an active session. They are not stored persistently.

3. What gets sent to Anthropic

When you use AI features (auto-suggest or natural language queries), the following is sent to Anthropic's API:

Column header names from your spreadsheet
A small number of sample values (up to 5 per column) to help identify the data type
For queries: a summary of your tagged data schema and a limited excerpt of your data

We do not send full datasets, personal names, ID numbers, or sensitive beneficiary information to Anthropic. You are in control of what gets tagged and queried.

Anthropic processes this data under their own privacy policy: anthropic.com/privacy. We have signed Anthropic's Data Processing Agreement.

4. Legal basis (GDPR)

We process your data under the following legal bases:

Contract: Account data is processed to provide the service you signed up for.
Legitimate interest: Session data is stored to allow you to resume your work.
Consent: When you use AI features, you consent to column headers and sample values being sent to Anthropic's API.

5. Data storage and transfers

Account and session data is stored in Supabase (EU West — Ireland region).
The application server runs on Railway (US West region). Excel files processed during a session are held in server memory only and discarded after the request completes.
When AI features are used, limited data is sent to Anthropic (US). This transfer is covered by Anthropic's compliance with the EU-US Data Privacy Framework.

6. Your rights

Under GDPR you have the right to:

Access the data we hold about you
Delete your account and all associated data
Export your session data
Object to processing

To exercise any of these rights, email: mohmadabumery@gmail.com

7. Cookies and local storage

We use browser localStorage to store:

Your Anthropic API key (never sent to our servers)
Your GDPR consent acknowledgement

We do not use tracking cookies or analytics.

8. Data retention

Account data: retained until you delete your account
Session data: retained until you delete the session
Excel files: never stored — processed in memory only

9. Changes to this policy

We will notify registered users of any material changes to this policy by email.