PRIVACY POLICY

HNDLR is a workspace for creators and freelancers: campaigns, contacts, invoices, trips and product seedings in one place. This policy explains what we collect, why we collect it, who else touches it, and how to get rid of it. We do not sell your data and we do not use it for advertising.

For questions about anything here, contact management@hananonymous.com.

What we collect

Account details. Your email address and a password, handled by our authentication provider. We never see or store your password in readable form.

Profile details you choose to add. Your name, profile photo, phone number, website and the social platforms you work on.

Invoicing and business details. Your invoicing name and email, business address, VAT number, trade licence number, preferred currency, and bank details — bank name, account holder, IBAN and BIC — so invoices can be generated with your payment information on them. These are stored so the app can fill in your invoices; they are treated as sensitive and are deleted in full when you delete your account.

Content you put into the app. Contacts (including their names and email addresses), campaigns and campaign costs, invoices, calendar events, trips and trip itineraries, product seedings, borrowed items, message templates, yearly statistics, and your saved app preferences. If you add someone else's contact details, you are responsible for having a lawful reason to hold them.

Payment information. Card payments are handled entirely by Stripe. We never receive or store your card number. We store only the identifiers Stripe gives us — your Stripe customer and subscription IDs, which plan you are on, your subscription status, and when the current period ends.

Location lookups. When you use the map, distance or dining features, the coordinates or place names you look up are sent to Google to get a result. We do not track your location in the background and we do not build a location history tied to your account.

Technical data. Standard server logs, including IP address, which are also used to rate-limit our API endpoints so nobody can run up costs by hammering them.

Why we're allowed to hold it

Most of it we hold because we need it to provide the service you signed up for — that is performance of our contract with you. Rate limiting, security logging and fraud prevention rest on our legitimate interest in keeping the service working and affordable. Records connected to payments are kept where tax and accounting law requires it. Where we ask for your consent, you can withdraw it at any time.

Who processes it on our behalf

Supabase hosts our database, authentication and file storage. Your data is stored in Supabase's Asia-Pacific (Tokyo) region.

Vercel hosts and serves the application.

Stripe processes subscription payments and holds the payment records.

Google Maps Platform resolves addresses, nearby places and travel distances for the map and dining features.

Anthropic generates the AI place suggestions. Only the city name is sent — no account details, no contacts, no invoices.

Resend delivers the invoice emails you choose to send.

These providers operate in several countries, so your data may be processed outside the country you live in. Each of them is bound by their own data processing terms and appropriate transfer safeguards.

How long we keep it

Your data stays for as long as your account exists. When you delete your account it is removed immediately and permanently. Server logs roll off on their normal schedule. Payment records held by Stripe are retained by Stripe for the period required by tax law, which is outside our control.

Your rights

Depending on where you live, you may have the right to access the data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict certain processing, and to complain to your data protection authority. Email management@hananonymous.com and we will respond within 30 days.

Deleting your account

You can delete your account and all of its data yourself, from inside the app, at any time — no email to support required. See Delete your account for the steps and for exactly what is removed.

Storage on your device

The app uses your browser's local storage to remember your session and interface preferences so it works smoothly between visits. This is not advertising tracking, and there are no third-party advertising cookies.

Children

HNDLR is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If we change this policy we will update the date at the top of this page, and for significant changes we will tell you in the app or by email.