Privacy Policy

1. Who we are

[YOUR FULL NAME] trading as Handld, [YOUR ADDRESS OR VIRTUAL OFFICE], [POSTCODE].

ICO Registration Number: [YOUR ICO NUMBER]  ·  Contact: hello@handld.co.uk

2. What this covers

This policy explains how Handld handles personal data for: visitors to handld.co.uk, businesses using the Handld service ("Clients"), and customers of those businesses whose calls Handld handles ("End Users").

3. Data we collect

Website visitors

• Contact and onboarding form submissions: name, business name, phone, business type, services, pricing, hours, FAQs
• Server logs: IP address, browser type, pages visited, timestamps

Clients

• Name, business name, email, and phone number
• Business information provided during onboarding
• Payment information (processed by Stripe - Handld never stores card details)

End Users (customers of Handld clients)

• Phone number (received when the call forwards to the Handld system)
• SMS message content sent and received during the conversation
• Name and contact details provided voluntarily during the conversation

End Users' data is processed on behalf of the Client (Data Controller). Handld acts as Data Processor.

4. Legal basis

Data type	Legal basis	Purpose
Website enquiries	Legitimate interest	Responding to business enquiries
Client data	Contract performance	Delivering the service
Payment data	Contract performance	Processing subscriptions
End User data	Legitimate interest (Client)	Missed call automation on behalf of the Client
Server logs	Legitimate interest	Security and fraud prevention

5. How we use data

We use data only to deliver the Handld service. We never sell personal data or use End User data to market Handld to those End Users.

6. Who we share data with

Provider	Purpose	Location
Twilio Inc.	SMS and phone numbers	USA (SCCs)
Anthropic PBC	AI conversation	USA (SCCs)
Supabase Inc.	Data storage	EU (Europe West)
Railway Corp.	Server hosting	USA (SCCs)
Stripe Inc.	Payment processing	EU/USA
Formspree Inc.	Onboarding forms	USA (SCCs)

SCCs = Standard Contractual Clauses, the approved mechanism for international transfers under UK GDPR.

7. Retention

Data type	Retention period
Website enquiries	12 months
Client account data	Contract duration + 6 years
End User conversations	24 months
Payment records	7 years (HMRC requirement)
Server logs	90 days

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or port your data, and to object to processing. Email hello@handld.co.uk to exercise any right. We will respond within 30 days.

You can complain to the ICO at ico.org.uk or 0303 123 1113.

9. Security

• All data stored in EU-based Supabase databases (Europe West)
• All data transmitted over encrypted connections (TLS/HTTPS)
• Each client's data in an isolated, separate database
• API keys stored as encrypted environment variables, never in code
• Stripe handles all payments - Handld never stores card details

10. Cookies

Handld does not currently use tracking or analytics cookies. No Google Analytics, Facebook Pixel, or similar tools are in use. If this changes, this policy will be updated and visitors notified before any tracking begins.

11. Changes

We may update this policy. Significant changes will be notified to Clients by email at least 30 days before they take effect.

12. Contact

[YOUR FULL NAME] trading as Handld
hello@handld.co.uk  ·  handld.co.uk
[YOUR ADDRESS OR VIRTUAL OFFICE], [POSTCODE]
ICO Registration: [YOUR ICO NUMBER]