Trust Center

Humind's AI assistant is designed to provide reliable, contextualized responses. For each question, the AI draws on the merchant's product catalog and configured knowledge base to generate accurate and relevant answers. This ensures responses are sourced and specific to each brand.

Humind operates under a Zero Data Retention policy for all LLM interactions:

• Our LLM provider is configured in Zero Data Retention mode. No prompts, completions, or embeddings are stored by the provider.
• Conversation data processed by the LLM exists only in memory for the duration of the request and is discarded immediately after the response is generated.
• Customer conversations are never used to train, fine-tune, or improve any AI model — neither ours nor our providers'.

Humind's Factual Mode ensures the AI only provides verifiable, source-backed responses:

• Every response is grounded in retrieved product data. The AI cites specific products and attributes from the merchant's catalog.
• When the AI lacks sufficient information to answer a question, it explicitly states that it cannot answer rather than generating speculative content.
• Guardrails prevent the AI from making claims about pricing, availability, or product specifications that are not present in the indexed catalog data.

Multiple layers of defense protect against LLM-specific attack vectors:

• Prompt injection protection: defense-in-depth mechanisms prevent end users from overriding the AI's behavior.
• Output guardrails: automated controls prevent the AI from disclosing internal instructions or information outside its designated scope.
• Scope limitation: the AI is restricted to the merchant's product catalog and configured knowledge base. It cannot access external data or perform actions outside its defined role.
• Monitoring: all AI interactions are logged (without PII) for quality assurance, anomaly detection, and continuous improvement of guardrails.

Humind's AI shopping assistant is classified as a limited-risk AI system under the EU AI Act (Regulation 2024/1689):

• Transparency: end users are clearly informed that they are interacting with an AI system, not a human agent.
• Human oversight: merchants retain full control over the AI's knowledge base, behavior configuration, and can disable the assistant at any time.
• Documentation: technical documentation on the AI system's capabilities, limitations, and intended use is maintained and available upon request.

Humind uses an LLM-as-a-Judge system where a dedicated evaluation model continuously assesses the quality and safety of AI-generated responses:

• Response quality evaluation: each AI response is automatically assessed for relevance, accuracy, and completeness against the retrieved product data.
• Hallucination detection: a dedicated evaluation model verifies that generated responses do not contain fabricated information or claims unsupported by the source data.
• Inappropriate content filtering: responses are screened to block off-topic, offensive, or non-compliant content before reaching the end user.

• Conversation data: questions asked to the AI assistant and generated responses
• Navigation data: pages visited, products viewed, interaction timestamps
• Technical data: browser type and device information. The IP address is not stored: it is only used in memory to derive a coarse location.
• Identification data: name, email, phone number or order number, only if the visitor shares them spontaneously in the conversation (the assistant never asks for them)

End users can exercise their rights by contacting the merchant (data controller) or by writing to Humind's DPO at dpo@thehumind.com. Humind supports the following rights:

• Right of access: obtain a copy of personal data held
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of personal data
• Right to restriction: limit the processing of personal data
• Right to data portability: receive data in a structured, machine-readable format

Conversation data (transcripts, attachments, satisfaction ratings, contact records) is kept in the active database for 13 months by default from the visitor's last interaction, then deleted automatically. The merchant may request a shorter period, or a longer one under its own responsibility. At the end of the contract, data is returned on request and then deleted within 30 days. LLM interactions are not retained (Zero Data Retention).

Data is hosted and processed exclusively in France and the European Union. No transfer outside the European Economic Area.

The Humind widget sets no cookies and performs no cross-site tracking. It relies only on strictly functional trackers stored in the browser (localStorage / sessionStorage), exempt from consent under Article 82 of the French Data Protection Act: a pseudonymous visitor identifier (13 sliding months), a tab-scoped session identifier, conversation resume data (deleted 90 days after last activity) and, if the merchant enables the consent module, the visitor's choice (13 months). Usage measurement (PostHog Cloud EU) runs without cookies, without storage and without any visitor identifier.

Full inventory of keys and durations