Privacy Policy

1. What Information Do We Collect?

Personal Information You Provide

We collect personal information that you voluntarily provide to us when registering or using the Services. This may include:

• Name
• Email address, profile image, and timezone
• Account credentials and authentication information
• Organization, workspace, and team membership information
• Support messages and other communications you send us

User-Uploaded Content

We collect and store files and content that users upload to the Services, such as documents, PDFs, images, and other materials. These files may contain personal or business information depending on what the user chooses to upload. We also process filenames, file types and sizes, checklist details, deadlines, submission and review history, and access permissions. We use this content to store, organize, share, and display documents and operate the requested workflows. We do not sell document content or use it for advertising.

Sensitive Information

We do not ask for special categories of personal data, such as health information, biometric identifiers, or information about religious beliefs. Uploaded documents may nevertheless contain sensitive data. Only upload such information if you have a lawful basis and authority to share it. Do not submit information that is unnecessary for your document collection workflow.

Social Login Information

If you choose to register or log in using a third-party authentication provider (such as Google), we receive basic profile information (such as name and email) as provided by that service.

Information Provided by Other Users

An organization or team member may provide your name, email address, company, relationship to the organization, and documents concerning you, including when sending document requests or invitations. You may use a request link without creating a Handinly account.

Technical and Usage Information

We process session and security information, including IP addresses, browser or device information, login times, and records needed to authenticate access and prevent abuse. When product analytics is enabled, we also process page visits, technical browser information, and analytics identifiers, which may be linked to your account ID. See section 9 for details.

2. How Do We Process Your Information?

We process personal information to:

• Create and manage user accounts
• Store and organize user-uploaded documents
• Provide access to features of the Services
• Respond to support requests
• Send important service-related communications
• Maintain security, troubleshoot issues, and prevent misuse
• Understand product usage and improve the Services
• Send emails and notifications at the user's request, including messages sent on behalf of the user as part of the Services

We do not use document content for advertising. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

3. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or similar jurisdictions, we process personal data under the following legal bases:

• Performance of our contract with you: creating your account and providing the features you request.
• Legitimate interests: securing and maintaining the Services, responding to inquiries, and supporting document requests made by organizations, subject to your rights and interests.
• Consent: where required for optional analytics or similar storage technologies. This notice alone does not constitute consent.
• Legal obligations: responding to lawful requests and retaining records where applicable law requires it.

We act as a controller for account administration, security, and our own service operations. When an organization uses Handinly to collect and manage personal data in its documents and client records, that organization generally acts as the controller and we process that data on its behalf. The organization is responsible for its lawful basis, notices, and instructions. Contact that organization about its use of your information; we can help route your request.

Account and contact details needed to authenticate you or deliver a request are necessary for those features. Without them, we may be unable to provide the relevant account, invitation, or request.

4. Sharing of Information

We do not sell personal information.

We may share personal information with trusted service providers who assist us in operating the Services, including hosting and database providers, Cloudflare R2 for file storage, Resend for email delivery, PostHog for product analytics and Google Analytics for public-page visits when enabled. If you choose Google sign-in, Google also processes information under its own privacy policy. Each provider receives information needed for its function.

Documents and related information are also available to organization members and recipients according to the permissions configured by authorized users. Anyone who obtains a valid shared link may be able to use its permissions; treat these links as confidential.

We may disclose information where legally required, to protect rights and security, or in connection with a merger, acquisition, or transfer of the Services, subject to applicable data protection requirements.

5. Data Retention

We retain account information while it is needed to provide your account and manage our relationship with you. Organizations control the documents and client records they add to their workspaces. Retention depends on the purpose of the data, the organization's instructions, and applicable legal obligations; an active account does not by itself determine every retention period.

Moving an item to Trash or archiving it does not permanently erase its data; it can remain stored for recovery. Plan limits on visible history or storage capacity also do not automatically delete existing files. Contact info@handinly.com to request account closure or permanent erasure. Removing your account does not necessarily erase records an organization controls and is entitled or required to retain.

We assess deletion requests under applicable law and may retain data needed for legal obligations, security, or legal claims. Backup copies may remain until the applicable backup cycle expires. You can contact us for information about retention for your specific data.

6. Data Security

We implement appropriate technical and organizational measures to protect personal information. However, no system is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

Handinly accounts are intended for people aged 18 or older. If you believe a child has created an account or provided personal data directly to us, contact info@handinly.com so we can investigate and take appropriate action. Organizations remain responsible for the lawfulness of any information about children in their documents.

8. Your Privacy Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Request data portability where applicable
• Withdraw consent at any time where processing relies on consent, without affecting the lawfulness of earlier processing
• Lodge a complaint with your data protection supervisory authority

These rights are subject to applicable conditions and exceptions. We may need to verify your identity before acting on a request. Where GDPR applies, we normally respond within one month; if an extension is permitted, we will explain the reason and timing. You can exercise these rights by contacting us at info@handinly.com.

9. Cookies, Analytics, and Browser Signals

We use cookies or similar browser storage for authentication and service preferences. Blocking essential cookies can prevent sign-in or other features from working.

PostHog and Google Analytics load only after you accept analytics in our cookie banner. Rejecting analytics does not prevent you from using Handinly. You can withdraw or give consent at any time using Cookie settings on this Privacy Policy page. Withdrawal stops further analytics collection; it does not undo processing that occurred before withdrawal. Your choice is stored in this browser until you change it or clear site storage. When you accept, PostHog records page visits and uses browser storage to recognize visits. Signed-in visits may be associated with your account ID. Our analytics configuration disables session recordings and automatic click and form capture, removes query strings and URL fragments, and masks identifiers in supported private routes. Document contents are not included in the page-view events we send.

Google Analytics measures visits to our public marketing and legal pages. We send page paths without query strings or fragments and do not send account IDs, document names or shared-link tokens to Google Analytics. Google Analytics uses browser identifiers to recognize visits. Advertising storage, advertising personalization and Google Signals are disabled. Collection stops when you enter account or shared-document pages or withdraw consent.

You can manage cookies and site storage in your browser settings. These settings may affect service functionality. Browser Do-Not-Track signals do not currently change our processing.

10. International Processing

Our service providers may process information in countries other than your own. The safeguards required for a transfer depend on the destination and applicable law. Transfers subject to GDPR must have a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, where required. Contact us for details about processing locations and safeguards applicable to your data.

11. Changes to This Notice

We may update this notice as the Services or our processing practices change. We will revise the date above and provide additional notice of material changes where required by law.

12. Contact Us

Email: info@handinly.com