Privacy Policy

Handro · Version 2.1 · Effective date: November 2, 2026

Until November 2, 2026, Version 2.0 (effective September 23, 2026) applies. The only new practice in Version 2.1 is the trial setup emails in Section 3, item 7, and Section 12. None are sent before that date.

Changelog — v2.1 (announced September 30, 2026; effective November 2, 2026): added trial setup emails. During an Organization's 14-day free trial, its account owner may get up to three short how-to emails, such as how to add a first customer or send a first estimate. Whether one is sent depends only on what the account already contains (a customer, a job, an estimate or an invoice), not on product analytics. Each has an unsubscribe link, and none contains an offer, an upsell or a discount. Section 12 now also says what the trial-ending notice contains: it mentions a discount only when that discount is already applied to the subscription. Marketing email, meaning offers, upsells and tips after the trial, still needs your express opt-in. Nothing else in this policy has changed.

Addition — October 12, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): Google Ads: a sign-up, only if you allowed Google measurement. We no longer offer new free trials, so the report described in the October 6 addition now happens when your Organization is created on the web, not when a trial starts. Under the same conditions as before (you chose "Accept all", you arrived from one of our Google ads, and your browser sent neither Global Privacy Control nor Do Not Track when you signed up), once a day our server tells Google that the ad click led to a sign-up: the click code, when the Organization was created, the conversion's name, and the value we assign to it with its currency. Nothing else is sent, apart from a note that you allowed Google measurement and did not allow ad personalization, and we still delete the code 30 days after we store it. Wherever this policy says our server reports the ad click to Google when a trial starts, read it as when the Organization is created. See Sections 3 and 11.

Addition — October 11, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): the app you opened our link in. When you open our site inside the Facebook or Instagram app, that app usually doesn't tell us which site sent you. In that case handro_attr records the app's name ("facebook" or "instagram"), read from your browser's user agent, in place of the referring site's name. We don't keep the user agent itself. See Sections 2A and 4.

Addition — October 11, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): Google Ads: the amount of a subscription, only if you allowed Google measurement. When your Organization subscribes to Solo or Team on the web and you chose "Accept all" on our cookie bar, the one conversion event our checkout page sends Google now also carries the subscription amount for that first payment, before tax, and its currency. Nothing else about you or the Organization is added.

Addition — October 10, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): offer links. If you open an offer link we sent you, a first-party cookie, handro_offer, keeps that offer's code for up to 30 days so it's applied for you when you pick a plan. It holds only the code and isn't used for advertising. See Section 4.

Addition — October 10, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): Meta: a purchase at checkout, only if you allowed Meta measurement. We no longer offer new free trials, so subscribing to Solo or Team is a purchase at checkout. When that checkout completes on the web, Meta's pixel and our server may tell Meta once that a purchase happened, with its amount and currency, under the same conditions and with the same details as the "trial started" report in the October 7 addition (the page address, a one-way code, Meta's click code, Meta's browser ID and your browser's user agent). We keep none of these; we record only when we reported it, so that we report it once. See Sections 3 and 9.

Addition — October 9, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): our demo video, played from YouTube only when you press play. Our home page, our search landing pages, and the Help pages and setup card of our web app show demo videos hosted on YouTube. Until you press play, the page shows only our own still image and nothing is sent to YouTube. Our welcome email and our mobile app show our own still image as a link that opens the video on youtube.com itself (or the YouTube app), not the privacy-enhanced mode, so YouTube's usual privacy policy applies there. When you press play, the video loads from YouTube in its privacy-enhanced mode (youtube-nocookie.com), so YouTube, which is part of Google, receives your visit (the page address, your IP address and browser details) and may store data in your browser while the video plays, under Google's own privacy policy. We receive nothing back about you from YouTube. See Sections 2C, 4 and 14.

Addition — October 7, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): Meta (Facebook and Instagram) ads measurement, only if you allow it. Our cookie bar now names Meta. If you choose "Accept all" on it, Meta's pixel runs on our public marketing pages and on the page you see right after checkout. Meta receives your visit (the page address, your IP address and browser details), the name of the landing page you viewed and, if you start a trial on the web, one "trial started" event with a one-way code for your Organization. If you arrived from one of our Meta ads, we keep Meta's click code in a first-party cookie, handro_fbclid, for up to 30 days. If you then create an Organization or start a trial on the web in that browser, our server tells Meta once for each: what happened and when, the page address, the one-way code, the click code, Meta's browser ID and your browser's user agent. We never send Meta your name, email address, phone number or business details. Meta may also use what it receives under its own terms, including to choose the ads it shows you. An "Accept all" given before this date, when the bar named only Google, doesn't cover Meta. Meta never runs if your browser sends Global Privacy Control or Do Not Track, whatever you chose. See Sections 2A, 2C, 3, 4, 6, 7, 9, 11 and 14.

Addition — October 7, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): a support chat on our public pages. If you type a question into it, we send your messages to our AI model provider, Anthropic, through Vercel's AI Gateway, to write an answer. Anthropic doesn't train its models on them. We keep the chat (your messages, our answers, the page you were on and when) for 90 days after your last message, to improve our answers; we don't add your IP address, name or email address to it, so don't type anything you don't want kept. If you choose to send the chat to our team, we email it to support@gethandro.com with the email address and name you give, and the page you were on, and keep it like any other support email. See Sections 2C and 9.

Addition — October 6, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): Google Ads sign-ups, reported from our server, only if you allow it. If you chose "Accept all" on our cookie bar and you arrive from one of our Google ads, we keep the click code Google adds to the ad's link (gclid, or on some Apple devices gbraid or wbraid) in a first-party cookie, handro_gclid, for up to 30 days. If you then start a trial on the web, we store that code with your Organization, and once a day our server tells Google which ad clicks led to a trial. We send the click code, when the trial started, the conversion's name and the value we assign to a trial. We never send your name, email address, phone number or business details. We delete the code from our records 30 days after we store it, or sooner if your account is deleted. If you chose "Required only", didn't choose, or your browser sends Global Privacy Control or Do Not Track when you sign up, we keep nothing about the click and send nothing. See Sections 2A, 2C, 3, 4, 6, 7, 9, 11 and 14.

Addition — October 1, 2026 (effective on posting; applies under Version 2.0 and Version 2.1): our customer referral program. Every Organization has a referral link (gethandro.com/i/…). If you open one, we set a first-party cookie, handro_invite, for 60 days. It holds only that link's code, nothing about you. If you create an Organization in that browser within those 60 days, we record which Organization referred it, so both can earn the credit described in our Referral Program Terms. Neither Organization receives the other's account details. To stop self-referrals, we may compare the two Organizations' account details and the billing details our payment provider gives us, never full card numbers. See Sections 2A, 2C, 3, 4 and 9. When an account is deleted, we keep a code made from the owner's email address for 2 years, only so that if the same person signs up again, the new Organization isn't counted as a new referred business. We can't read the address from it.

Addition, v2.0 — September 27, 2026 (effective on posting): if you apply to our creator partner program at gethandro.com/partners, we keep what you enter in the application to review it and, if you join, to run the program, and delete it 12 months after we approve or decline it. This applies only to people who apply. See Sections 2D and 9.

Correction, v2.0 — September 27, 2026 (effective on posting): this policy said our public pages set no cookies. That was wrong. Our public pages set first-party cookies, including: handro_attr, which remembers how you first reached us (campaign tags from the link, the referring site's name and the first page you landed on), so that if you sign up we can record where your Organization came from; handro_pricing_currency, which remembers whether you chose to see prices in US or Canadian dollars; and handro_ref, only if you arrive through a creator partner's link, which holds that creator's link name. They also set two short-lived sign-in security cookies (see Section 4). The signed-in web app also sets sidebar_state, which remembers whether the sidebar is open, and a short-lived security cookie while you connect Square. None is used for advertising or shared with anyone. See Sections 2A, 2C, 3 and 4.

Update, v2.0 — September 27, 2026 (effective on posting): our public pages now use Google Ads measurement, but only if you allow it. A cookie bar asks first. If you choose "Accept all", Google's tag runs on our public pages so we can see which of our ads bring sign-ups: Google receives your visit (the page address, the ad you clicked, if any, your IP address and browser details) and, if you then start a trial on the web, one "trial started" event with a one-way code for your Organization, never your name, email address or other contact details. Google also sets its own advertising cookies on our site. If you choose "Required only", or don't choose, nothing is sent to Google and no Google cookie is set. We keep your choice in a cookie, handro_consent, for 12 months, and you can change it any time with "Cookie settings" at the bottom of our public pages. Google processes this data in the United States and other countries where Google operates. The signed-in web app and the mobile app don't run Google's tag, apart from that one "trial started" event, sent from the page you land on right after checkout. See Sections 2C, 3, 4, 6, 7, 9, 11 and 14.

Previous correction, v2.0 — September 25, 2026: this policy now discloses product analytics. When you are signed in to the web app or the mobile app, we use PostHog to understand which features account holders use: your user ID, email address and organization ID, the screens you open in the mobile app, and standard device data including IP address. It never receives Customer Data, records sessions, or runs on our public pages, and it is not used for advertising. The web app sets one PostHog cookie. See Sections 2A, 3, 4, 6 and 9. Earlier versions said we ran no analytics; that was out of date and has been corrected.

Previous changelog — v2.0: added device location. With the user's permission, the mobile app records where a clock-in or clock-out happened and centres the job map on the device. This is when-in-use only — there is no background or "always" location, and no location tracking while the app is closed. It is optional everywhere: declining, revoking, or simply having no signal records no coordinate and never prevents clocking in or using any other feature. Also added Google Play subscription records, alongside the Stripe and Apple records already described, now that the Android app can sell a subscription through Google Play billing.

Previous changelog — v1.9: aligned this policy's version with the revised Terms of Service, under which a new Organization picks a plan at signup and its 14-day free trial starts with that choice. On the web and Android the payment method for that trial is entered on Stripe's hosted checkout page and never reaches our database; we receive the subscription and trial status. Handro's privacy practices are otherwise unchanged.

Previous changelog — v1.8: self-service account deletion now permanently deletes the Organization and its Handro data immediately after owner confirmation. Removed the former 72-hour recovery window and cancellation email. Routine backup rotation and legally required or pseudonymous billing records remain as described below.

Previous changelog — v1.7: aligned this policy's version with the revised Terms of Service. Handro's privacy practices and the information described in this policy have not changed.

Previous changelog — v1.6: added Apple purchase verification records, billing-provider data flows and account-deletion exceptions. These disclosures apply when App Store subscriptions are available and chosen.

Previous clarification, v1.5 — September 3, 2026: approving an estimate now creates a signed-acceptance record (Sections 2B and 9) — the End Customer's typed name, an optional drawn signature image, and an audit trail (when it was signed, the IP address and browser/device involved, and the exact wording they agreed to). This supports the enforceability of the Organization's estimate. No new subprocessor and no new recipient — it's held the same way, and for the same audience, as the rest of the estimate record.

Previous changelog — v1.5 (September 2, 2026): Calendar sync now includes each job's customer name, phone number, and service address in the calendar event it creates — a change from the prior design, which included none of that. Added Google as a subprocessor (Section 6) for Organizations that connect Google Calendar. Clarified that the calendar subscription (.ics) feed's destination — Apple Calendar, Outlook, or any other calendar app the connecting user chooses — is NOT a Handro-selected or Handro-contracted subprocessor, since the Organization's own user picks it (Section 6). Updated Section 7 (cross-border transfers) to reflect that this data is no longer confined to our usual US-based subprocessors. Added a note to Section 9 that disconnecting or deleting an account does not retroactively remove events already placed on a third-party calendar. Added Section 2 entries describing the Google Calendar connection and the calendar subscription link. This is an AI compliance pass (Smith), not a substitute for a licensed BC/tech attorney's review. (Prior versions' changelogs were intentionally omitted per a pre-launch convention; this is the first entry now that the product has real users.)

Plain-language summary (not a substitute for the policy)

• We're a tool your service company uses. If a plumbing, HVAC, or electrical business manages you as their customer in Handro, that business — not us — decides why your information is collected. We store and process it for them. Contact them first about your data; we'll help them respond.
• What we collect about account holders: name, email, a hashed password (or, if you sign in with Google or Apple, your name and email from them), your organization's details, and what you put into the app.
• We don't sell anyone's data for money or show ads in Handro. Our public pages run no analytics, and use advertising measurement (Google and Meta, to see which of our ads bring sign-ups) only if you allow it on the cookie bar; "Cookie settings" at the bottom of our public pages changes your choice. If you allow it, arrive from one of our ads and sign up, we keep the ad's click code for up to 30 days and tell Google or Meta that the ad led to a sign-up. We never send your name or contact details. Meta may also use what it receives to choose the ads it shows you. Meta never runs if your browser sends Global Privacy Control or Do Not Track. When you're signed in, we use one product-analytics service (PostHog) to see which features get used — never on Customer Data, never on our public pages. Our own cookies are first-party, for example to keep you signed in and protect sign-in, to measure feature use while you're signed in, and to remember how you found us, your pricing currency, a creator partner's or another customer's referral link, your sidebar layout, your cookie choice and, only if you allow it, the click code of the ad that brought you. Section 4 lists every one.
• Your data lives on servers in the United States (and with the providers listed below — hosting, database and file storage, payments, accounting sync, email, error monitoring, product analytics).
• If your business turns on Calendar sync, your customers' name, phone number, and service address go onto a calendar you don't fully control. Connecting Google Calendar sends that information to Google. Creating a calendar subscription (.ics) link and adding it to Apple Calendar, Outlook, or any calendar app does the same — to whichever provider you or your teammate chooses, on their own account. That's a third party outside our control once it's there, and it may end up stored outside the United States. See Sections 2, 6, and 7.
• Export is free and built in. Businesses can download all their data — including payment records and job photos — as CSV/JSON any time.
• Deletion is self-service. Delete your account yourself, in the app, any time. After you confirm, we permanently delete the Organization and its Handro data immediately; there is no recovery window. We keep only the few records Section 9 lists, such as a coded sign-up check for 2 years. Can't sign in? Email us instead.
• Payments are handled by Stripe or Square, whichever your Organization connects. Card numbers go to that provider, never to our database. Your own Handro subscription is billed through Stripe on the web and Android or, where offered, Apple in the iOS app — including the card you add to start a free trial, which goes straight to Stripe. We receive subscription, trial and transaction records, not full card details.
• Text messages (SMS) only go to a phone number that opted in. If a business's customer agrees to text updates, we send them through Twilio; message content and the phone number are shared with Twilio for that purpose. No SMS marketing is sent today.
• Questions or requests: support@gethandro.com. We answer within 30 days.

This policy explains how Handro ("we", "us", "our") handles personal information in connection with our field-service management software (the "Service") and its websites. It covers three groups:

1. Who is responsible for your information

For Organization users and visitors, Handro decides how and why personal information is processed — we are the organization responsible (the "controller").

For End Customer information, the Organization that serves you is responsible. It collects your details to run its business; we process them on that Organization's behalf as a service provider (a "processor"), under contract terms that limit our use to providing the Service. If you are an End Customer, please direct questions and requests about your information to the business that serves you — Section 11 explains how we help.

Accountability (PIPEDA / Quebec Law 25). The person in charge of personal information at Handro is our Privacy Officer, reachable at support@gethandro.com.

2. What we collect

A. From Organization users

B. About End Customers (processed for your service company)

We ask Organizations not to enter special categories of data (health details, government IDs, card numbers) into notes or other free-text fields; the Service is not designed for them.

C. From visitors

Our public pages run no analytics, and use advertising measurement only if you allow it (below). They set first-party cookies (Section 4 lists every one), including handro_attr, which remembers how you first reached us so that if you sign up we can record where your Organization came from, handro_pricing_currency, which remembers the currency you chose for prices, and two short-lived sign-in security cookies. If you arrive through a creator partner's link (gethandro.com/r/…), we set a first-party cookie, handro_ref, that lasts 60 days and holds only that creator's link name, nothing about you; if you create an organization in that browser within those 60 days, we record which creator referred it so we can pay them a commission, and the creator never receives your name, contact details or account data. If you arrive through a Handro customer's referral link (gethandro.com/i/…), we set a first-party cookie, handro_invite, that lasts 60 days and holds only that link's code, nothing about you. If you create an organization in that browser within those 60 days, we record which customer referred it, so both of you can earn the credit described in our Referral Program Terms. The customer who referred you never receives your name, contact details or account data. Standard web logs at our hosting providers (IP address, user agent, timestamp) are used for security and operations. If you submit a booking form, Section 2B applies.

Support chat. If you type a question into the chat on our public pages, your messages go to our AI model provider, Anthropic, through Vercel's AI Gateway, only to write an answer. Anthropic doesn't train its models on them. We keep the chat (your messages, our answers, the page you were on and when) for 90 days after your last message, to improve our answers; we don't add your IP address, name or email address to it, so don't type anything you don't want kept. If you send the chat to our team, we email it to support@gethandro.com with the email address and name you enter and the page you were on, so we can reply.

Demo video, only when you press play. Our home page, search landing pages, and the web app's Help pages and setup card show demo videos hosted on YouTube (in the welcome email and the mobile app, it's a link that opens youtube.com or the YouTube app, where YouTube's usual privacy policy applies). Until you press play, the page shows only our own still image and nothing is sent to YouTube. When you press play, the video loads from YouTube's privacy-enhanced mode (youtube-nocookie.com): YouTube, which is part of Google, receives your visit (the page address, your IP address and browser details) and may store data in your browser while the video plays, under Google's privacy policy. Pressing play is your own request, so it doesn't depend on your cookie-bar choice. We receive nothing about you from YouTube.

Google Ads measurement, only if you allow it. Our public pages show a cookie bar. If you choose "Accept all", Google's tag runs on them and Google receives your visit (the page address, the ad you clicked, if any, your IP address and browser details); if you then start a trial on the web, Google also receives one "trial started" event with a one-way code for your Organization. If you arrived from one of our Google ads, we also keep the ad's click code in a first-party cookie, handro_gclid. If you start a trial on the web, our server then reports the click and the trial to Google (Section 3, item 9). We never send Google your name, email address, phone number or Customer Data. If you choose "Required only", or don't choose, nothing is sent to Google and we keep no click code. You can change your choice any time with "Cookie settings" at the bottom of our public pages (Section 4).

Meta ads measurement, only if you allow it. Since October 7, 2026 our cookie bar also names Meta (Facebook and Instagram). If you choose "Accept all" on it, and your browser sends no Global Privacy Control or Do Not Track signal, Meta's pixel runs on our public marketing pages and on the page you land on right after checkout. Meta receives your visit (the page address, your IP address and browser details) and the name of the landing page you viewed; if you then start a trial on the web, Meta also receives one "trial started" event with a one-way code for your Organization. If you arrived from one of our Meta ads, we also keep Meta's click code in a first-party cookie, handro_fbclid. If you then create an Organization or start a trial on the web in that browser, our server reports it to Meta (Section 3, item 9). Meta's pixel never runs when you sign up, sign in or use the app, or in the mobile app. Meta's Advanced Matching and its automatic collection of form and page details are turned off, and we never send Meta your name, email address, phone number, business details or Customer Data. Meta may also use what it receives for its own purposes, including choosing the ads it shows you (Section 6). Nothing is sent to Meta, and we keep no Meta click code, if you choose "Required only", don't choose, gave your "Accept all" before our bar named Meta, or your browser sends Global Privacy Control or Do Not Track.

D. From people who apply to our creator partner program

3. What we use personal information for

1. Providing the Service — accounts, tenancy, scheduling, customers, jobs, estimates, memberships, payments, exports. Where a user has allowed it, device location is used for two narrow things: recording where a clock-in or clock-out happened, so a shop's timesheet shows where the day's hours were worked, and centring the job map on the device. We do not use it to follow anyone's movements, build a location history, infer where someone lives, or track anything while the app is closed.

2. Transactional messages — booking confirmations and notifications, arrival/"on my way" alerts, appointment reminders, estimate links and estimate-ready notifications, review requests, receipts, and account/billing status notices. These are sent by email through our email provider, and — only for phone numbers that have opted in — by text message through our SMS provider, Twilio, each on the relevant Organization's behalf. A given message may go by one channel or both, depending on the Organization's settings and the contact details on file. These are not marketing. Section 12 has channel-specific detail, including how the email review-request unsubscribe and SMS opt-in/opt-out work.

3. Security and abuse prevention — authentication, tenant isolation, rate limiting, honeypots, investigating incidents.

4. Reliability — monitoring errors and fixing bugs.

5. Legal — complying with law, enforcing our Terms, establishing or defending claims.

6. Product analytics — understanding which features account holders use, so we know what to improve. Limited to the account-holder data in Section 2A; never Customer Data, never sold, never used for advertising.

7. Trial setup emails — helping a new Organization get set up. During its 14-day free trial, we may send the account owner at most three short how-to emails, such as how to add a first customer, schedule a job, or send an estimate or invoice. Whether one is sent, and which one, depends only on what the account already contains (whether it has a customer, a job, an estimate or an invoice) and on the day of the trial. We do not use product analytics (item 6) or any profile of how you use the app to decide. These emails contain no offers, upsells or discounts, and they stop when the trial ends. Each one has an unsubscribe link; using it stops the rest. This is service email about your own trial, not marketing (Section 12).

8. Signup attribution, creator commissions and referral rewards — learning which campaigns and sites bring businesses to Handro, and paying creator partners the commission they earned. Where an Organization came from is recorded once, when it is created (Section 2A). A creator is credited only if the Organization was created in the browser that followed their link, within 60 days. Creators receive only totals (credited sign-ups, paying organizations, revenue collected and their commission), never a customer's name, contact details or account data. Not used for advertising or profiling. A Handro customer is credited with a referral only if the Organization was created in the browser that followed its referral link, within 60 days, and only one referrer, customer or creator, is ever credited. To prevent self-referrals and abuse, we may compare the two Organizations' account details (such as owner and team email addresses and business details) and the payment details our payment provider gives us (such as whether the same card was used, never the card number). A referring customer sees only how many businesses signed up through its link and the status of its rewards, never who they are. If an Organization's owner had a Handro account that was deleted in the last 2 years, the new Organization doesn't count as a new business for referral rewards. We check this with the code described in Section 9, never with the deleted account's data.

9. Advertising measurement, only with your consent — learning which of our Google and Meta ads lead to sign-ups, so we spend on the ads that work. Only if you choose "Accept all" on our cookie bar:

   • Google's tag runs on our public pages. When an Organization's web trial starts after checkout, the tag tells Google once, with a one-way code derived from the Organization.
   • If you reached us from one of our Google ads, we keep the ad's click code. If your Organization starts a web trial, our server tells Google once: the click code, when the trial started, the conversion's name ("Trial started") and the value we assign to a trial.
   • Meta's pixel runs on our public marketing pages (each page view, and the name of the landing page you viewed). When an Organization's web trial starts after checkout, the pixel tells Meta once, with the same kind of one-way code. This needs an "Accept all" given on the bar that names Meta, and a browser that sends no Global Privacy Control or Do Not Track signal.
   • If you reached us from one of our Meta ads, and the same conditions are met, our server tells Meta once when your Organization is created on the web and once when its web trial starts. It sends the event's name and time, the page address (without anything after the path), the one-way code, Meta's click code, Meta's browser ID if your browser has one, and your browser's user agent (the browser and system it says it is). We keep none of these; we record only when we reported the trial, so that we report it once.

   None of these sends a name, email address, phone number, business details or Customer Data, hashed or not. We tell Google not to use this data to personalize ads. Google says it handles our server reports in its "restricted data processing" mode: it may use them to deliver and measure our ads, for security, and to improve its services, but not to add anyone to remarketing or audience lists. Meta is different: it receives the data under its own terms and may use it, with other information it has, to measure and deliver ads, to choose the ads and content it shows you, and to improve its products (Section 6). We don't use what Google or Meta receives to build ad audiences, such as retargeting lists. We keep the Google click code for at most 30 days, and we keep no copy of what Google's tag or Meta's pixel sends. Withdraw any time with "Cookie settings" (Section 4). After you've signed up, you can also email us (Section 11).

What we do not do: we do not sell or rent personal information for money; we show no ads in the Service and run no profiling that produces legal or similarly significant effects; we do not use Customer Data to train AI models.

Cross-context behavioral advertising, only with your consent. The one way our data can be used to target ads is Meta's own use of what its pixel and our server send (item 9): Meta may use it to choose the ads it shows you. Some US state privacy laws call that "sharing" or "targeted advertising", and some may call it a "sale". We do it only if you choose "Accept all" on the bar that names Meta, never when your browser sends Global Privacy Control or Do Not Track, and you can opt out at any time with "Cookie settings" at the bottom of our public pages: that is how you opt out of the sale or sharing of your personal information and of targeted advertising (Section 14). The Google Ads measurement in item 9 runs with ad personalization turned off. If any of this ever changes, this policy will change first, with notice (Section 15).

For Canadians: our legal grounding under PIPEDA is your consent (given when you sign up or submit a form, given expressly on the cookie bar for advertising measurement, and implied for purposes a reasonable person would consider obvious and appropriate, such as processing a booking you submitted), plus our legitimate business need to secure and operate the Service. You may withdraw consent (Section 11), subject to legal or contractual limits — some withdrawals mean we can no longer provide the Service.

4. Cookies

Our own cookies are all first-party. Two of them, handro_gclid and handro_fbclid, are for advertising measurement and are set only if you allow it. None of the others is used for advertising or shared with anyone. Google's and Meta's advertising cookies, too, are set only if you allow them (below).

No other advertising cookies. If you choose "Accept all", your browser also contacts Google's own domains (googletagmanager.com, googleadservices.com, google.com and doubleclick.net), where Google may read or set its own cookies under Google's privacy policy, and Meta's own domains (connect.facebook.net and facebook.com), where Meta may read or set its own cookies, for example if you're signed in to Facebook, under Meta's Privacy Policy. The mobile app keeps the equivalent analytics identifier in the app's own storage on your device.

Demo video. If you press play on our demo video (Section 2C), YouTube's player loads from youtube-nocookie.com and YouTube may store data in your browser (cookies or local storage on YouTube's domains) while it plays. Nothing from YouTube loads, and nothing is stored, until you press play.

Your choice. Our public pages show the cookie bar until you choose. "Required only", or ignoring the bar, keeps advertising measurement off: nothing is loaded from Google or Meta, except YouTube's player if you press play on our demo video. "Accept all" turns it on. An "Accept all" given before October 7, 2026, when the bar named only Google, still covers Google but not Meta; Meta stays off until you choose again in Cookie settings. Change your choice any time with Cookie settings at the bottom of our public pages; choosing "Required only" there stops Google's tag and Meta's pixel, and removes handro_gclid, handro_fbclid, Meta's _fbp and _fbc cookies, and the Google cookies and local-storage entries set on our site. Neither Google's tag nor Meta's pixel runs when you sign up, sign in or use the app, apart from the single "trial started" event each may send from the page you land on right after checkout, and only if you chose "Accept all". (Our server's reports to Meta when you create an Organization or start a trial on the web are in Section 3, item 9.) Global Privacy Control and Do Not Track: Meta stays off whenever your browser sends either signal, even if you chose "Accept all". For Google, we treat either signal as "Required only" unless you choose "Accept all" yourself in Cookie settings, and if either signal is on when you sign up, we don't keep the Google ad's click code, whatever you chose (Section 14).

5. Estimate links — a note on token URLs

Estimates are shared through links containing a long random token. The page shows the estimate's contents (names, addresses, line items, prices) to anyone who has the link. We do not index these pages, and tokens are unguessable, but a forwarded link is a forwarded document — Organizations and End Customers should share estimate links only with people who should see them.

6. Who we share personal information with (subprocessors)

We share personal information only with the service providers that run the Service ("subprocessors"), under contracts limiting their use of it:

For customer payment processing, Stripe and Square are alternatives chosen by your Organization. Stripe also processes Handro subscriptions purchased on the web, regardless of whether you connect a customer-payment account. QuickBooks is a paid-plan feature you opt into from Settings. Twilio is only involved for a given End Customer's phone number if that person has opted in to receive text messages — an Organization enabling texting in Settings does not, by itself, send anything to Twilio for any customer who hasn't separately opted in. If you sign in with Google or Apple instead of a password, that choice also means Google or Apple provides your name and email to us (Section 2A); we don't consider them a subprocessor in the same sense as the providers above, since they act as your own identity provider rather than processing data on our instructions, but we're naming them here for completeness.

Apple-billed subscriptions. If you choose an App Store subscription, Apple processes the purchase under its own terms and privacy policy. We send Apple the purchase identifiers and a random organization-linked token needed to validate your purchase, restore it to the same organization and keep its status current. Apple returns signed transaction and subscription-status information and sends renewal/refund notifications. This flow does not send your job records, customer list or job photos to Apple. Apple handles its own billing records; deleting Handro cannot erase those records or cancel your Apple subscription. Apple operates globally, so its processing is not limited to Handro's US database location.

Google Ads measurement, only if you allow it. If you choose "Accept all" on our cookie bar, Google LLC receives your visits to our public pages and, if your Organization starts a trial on the web, one "trial started" event with a one-way code derived from the Organization (Sections 2C and 3, item 9). If you arrived from one of our ads, our server also gives Google that ad's click code, the time the trial started, the conversion's name and the value we assign to a trial, once. We send no name, email address, phone number or Customer Data. Google's "enhanced conversions" and its automatic collection of contact details from our forms are both turned off. Google handles the tag's data under its own advertising terms and privacy policy, and may connect it to a Google account you're signed in to. We tell it not to use the data for ad personalization. Google says it processes our server reports in its restricted data processing mode, as our service provider. Without your consent, nothing is sent.

Meta ads measurement, only if you allow it. If you choose "Accept all" on the version of our cookie bar that names Meta, and your browser sends no Global Privacy Control or Do Not Track signal, Meta Platforms, Inc. receives your visits to our public marketing pages and, if your Organization starts a trial on the web, one "trial started" event with a one-way code derived from the Organization (Sections 2C and 3, item 9). If you arrived from one of our Meta ads, our server also tells Meta, once each, when your Organization was created on the web and when its web trial started, with the details in Section 3, item 9. We send no name, email address, phone number, business details or Customer Data, hashed or not: Meta's Advanced Matching and its automatic collection of form and page details are turned off. Meta handles some of this on our behalf, to match and measure our ads, but it also uses it for its own purposes under its Business Tools Terms and Privacy Policy: it may connect it to a Facebook or Instagram account you're signed in to, and use it, with other information it has, to deliver ads, to choose the ads and content it shows you, and to improve its products. To opt out on our site, choose "Required only" in Cookie settings. To limit how Meta uses activity from other businesses, including ours, to choose your ads, use the ad settings in your Facebook or Instagram account (Accounts Center › Ad preferences). Without your consent, nothing is sent.

The calendar subscription (.ics) feed is different: we do not choose or contract with its destination. When you or a teammate subscribes to that feed from Apple Calendar, Microsoft Outlook, or any other calendar app, you are choosing where that data goes — on your own personal or work account with that provider, under your agreement with them, not ours. We do not list Apple, Microsoft, or other calendar providers as subprocessors for that reason: we have no contract with them, no visibility into their retention or security practices, and no ability to reach into your calendar account to delete anything once it's there. Disconnecting Google Calendar, or regenerating your subscription link, stops future updates but does not retroactively remove events already placed on a calendar (Section 9).

We also disclose personal information if required by law or legal process (we will notify the affected Organization where lawful), to protect rights and safety, or as part of a merger, financing, or sale of Handro or the Service — in which case this policy continues to apply to the transferred data and we will give notice of any change in responsibility. A current version of this subprocessor list will be maintained at gethandro.com/legal/subprocessors; we will give Organizations advance notice by email before adding a subprocessor that handles Customer Data.

7. Where your information is stored (cross-border transfers)

The Service's data is stored in the United States (AWS us-west-2, Oregon), and our subprocessors process data in the United States. If you are in Canada, your personal information leaves Canada and is subject to US law, including lawful access by US authorities, while stored there. We use contractual and technical safeguards (Section 8) regardless of where data sits.

Quebec residents: personal information about you is communicated outside Quebec (to the United States) for the storage and processing described above.

Google Ads measurement (only if you choose "Accept all", Section 4), including the click code our server reports, is processed by Google in the United States and other countries where Google operates. For Quebec residents, that choice means this information is communicated outside Quebec.

Meta ads measurement (only if you choose "Accept all" on the bar that names Meta and your browser sends no Global Privacy Control or Do Not Track signal, Section 4), including what our server reports, is processed by Meta in the United States and other countries where Meta operates. For Quebec residents, that choice means this information is communicated outside Quebec.

Calendar sync is an exception to the above. If your Organization connects Google Calendar, the relevant job's customer contact details are processed by Google, which operates globally — we cannot commit to a single country for that data once it leaves us. If you or a teammate subscribes to our calendar feed from Apple Calendar, Outlook, or any other app, that data is stored wherever that provider — and that person's own account with it — is domiciled, which we do not control and may not know. If your business or your customers are in Quebec, turning on Calendar sync for a Quebec customer's job is a communication of personal information outside Quebec that your Organization is directing; Quebec's Law 25 may require your own assessment before you do (Terms of Service Section 3.4).

8. Security

• Encryption in transit (TLS) everywhere; encryption at rest by our database provider.
• Tenant isolation enforced in the database itself — PostgreSQL row-level security on every tenant table, so one Organization's queries cannot reach another's rows.
• Passwords stored only as salted hashes; sessions via signed tokens.
• Role-based access (owner/admin/staff) inside each Organization; least-privilege database roles on our side.
• Rate limiting and honeypots on public forms; error monitoring for anomalies.

No system is perfectly secure; Section 10 describes what happens if safeguards fail.

9. How long we keep information

Organizations control the records inside their tenant and may correct or delete individual records (for example an End Customer's file) at any time in the app; deletions propagate to backups on the rotation above.

Account-level deletion is self-service. An Organization's owner can delete the account themselves, in the app, at any time (Settings → Danger zone → Delete account). After the owner confirms, we immediately and permanently delete the Organization and its Handro data from our live systems, sign out every Authorized User, and cancel a Stripe-billed Handro plan. There is no recovery window or cancellation email. A new Organization may be created afterward, but deleted data cannot be restored or transferred into it. We keep one thing for 2 years: a code made from the owner's email address, so that if the same person signs up again, the new Organization isn't counted as a new business for referral rewards (see the table above). It can't restore anything. An Apple-billed subscription must be cancelled separately in App Store subscription settings; we show this warning and ask for acknowledgement before you proceed with deletion. If you can't sign in, email support@gethandro.com from the address on your account and we'll verify you and delete it, typically within 30 days. Full detail, including exactly what is and isn't deleted, is at gethandro.com/legal/account-deletion.

Calendar sync leaves a copy outside Handro. Disconnecting Google Calendar, or regenerating your calendar subscription link, stops future updates immediately, but any calendar events already created are not automatically deleted from Google Calendar, and anything already fetched by a subscribed calendar app is not automatically deleted from that app or device — delete those yourself, in that calendar, if you need them gone. The same is true when your Organization's account is deleted: deleting your Handro account removes Handro's own connection and mapping records, but cannot reach into a third-party calendar account to remove events already placed there.

10. If something goes wrong (breach notification)

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as PIPEDA requires (and the Commission d'accès à l'information for Quebec residents, per Law 25). We keep records of all breaches for at least 24 months. Where the affected data is Customer Data, we will notify the affected Organization without undue delay so it can meet its own obligations to its customers, and we will cooperate with its response. US state breach statutes are addressed through the same process.

11. Your rights and choices

We honor these rights for everyone — Organization users, End Customers, and visitors — regardless of where you live, even where no statute requires it:

• Access / know: get confirmation we hold personal information about you, a copy of it, and an account of how it's used and to whom it's been disclosed.
• Correction: fix inaccurate or incomplete information.
• Deletion: ask us to delete your personal information, including your product-analytics profile.
• Portability: receive your information in a structured, machine-readable format (Organizations: the built-in CSV/JSON export answers this instantly, free, any time).
• Withdraw consent (Canada), subject to legal/contractual limits. For Google Ads measurement, use Cookie settings at the bottom of our public pages; it takes effect at once. If you've already signed up, email support@gethandro.com and we'll delete the ad click code stored with your Organization. If Google already received the report (usually within a day of signing up), that copy stays with Google. For Meta measurement, Cookie settings works the same way and also stops our server's reports to Meta at once; it removes handro_fbclid and Meta's cookies on our site. We don't store Meta's click code with your Organization, so there is nothing more for us to delete. What Meta already received stays with Meta under its own policy; your Facebook or Instagram ad settings control how Meta uses it (Section 6).
• No discrimination for exercising rights.

How to exercise them: for account deletion, the fastest path is in-app self-service (Section 9, above) rather than email. For everything else — access, correction, portability, or a deletion request if you can't sign in — email support@gethandro.com from the address associated with your information (or with enough detail for us to verify you — we verify to protect you, and we may decline requests we cannot verify). We respond within 30 days. If we refuse a request, we will say why and what law permits the refusal, and you may complain to us, to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec (Quebec residents), or to your state attorney general (US residents). If a future state-law obligation applies to a request we deny, you may appeal by replying to our decision; we will answer the appeal within 45 days.

If you are an End Customer, the business that serves you controls your records, so we will refer your request to that Organization and help it respond (its staff can view, correct, export, or delete your records in the app). If the Organization is unreachable or no longer exists, we will handle your request directly.

Authorized agents may submit requests with proof of authority.

12. Email and text messages (SMS): what we send today, and marketing later

Email

Transactional: booking confirmations and notifications, arrival ("on my way") alerts, estimate links and estimate-ready notifications, payment receipts, appointment reminders, review requests, and account/billing status notices (including Trial-ending reminders and Limited Access notices) — messages required to deliver the Service, triggered by you, the Organization serving you, or your Organization's own Trial or subscription status. These are sent even without marketing consent because the Service doesn't work without them; each identifies the business it concerns.

Review-request emails include a one-click unsubscribe. Using it stops future review-request emails from that business by email — it does not affect the other transactional emails above (arrival alerts, reminders, estimate updates, receipts, and account notices), and does not affect text messages. The other transactional emails have no unsubscribe because the Service can't be delivered without them.

Trial emails to the account owner. Two kinds, both service email about your own Handro trial, not marketing:

• Setup emails. At most three, sent only during your Organization's 14-day free trial. Each is a short how-to for a step your account hasn't taken yet, such as adding a customer, scheduling a job, or sending an estimate or invoice. What triggers them is the records in your account, not product analytics (Section 3, item 7). They contain no offers, upsells or discounts. Each has an unsubscribe link: using it stops the remaining setup emails and does not affect any other email. You can also ask support@gethandro.com to stop them.
• The trial-ending notice. Sent before a trial turns into a paid subscription. It tells you when the trial ends, what you'll be charged and how to cancel (Terms of Service Section 6.3). It mentions a discount only when that discount is already applied to your subscription, so the amount shown is what you'll actually pay. It never offers a new discount or promotes a different plan. It has no unsubscribe, because it's about a charge you agreed to.

Both identify the sender as OHE Services Inc. (operating as Handro) and include our mailing address.

Text messages (SMS)

Opt-in only, unlike transactional email. Unless an End Customer's phone number is marked as opted in, we never send it a text message. Opt-in happens two ways: the Organization's staff can check a box on that customer's record, or the End Customer can check a box themselves on the Organization's public booking page. Either way, we record the date, the method, and the exact consent text shown at the time.

What's sent, today, transactional only: arrival ("on my way") alerts, appointment reminders, and estimate-ready notifications — each sent by the Organization's business name, through Twilio, under one shared Handro-registered sender brand. That is the full list: review requests are not sent by text (they are email-only, above), and no SMS marketing or promotional content is sent.

Your opt-in data stays private. Phone numbers collected for SMS, opt-in status, and consent records are never shared with, sold to, or rented to third parties or affiliates for marketing or promotional purposes. They are used solely to deliver the opted-in messages described here, via our SMS delivery provider (Twilio, Section 6).

Opt-out. Reply STOP (or ARRÊT) to any text to immediately stop all future automated texts from that Organization to that number; reply HELP for help. We honor STOP instantly — there is no waiting period. Message and data rates may apply, and message frequency varies with your appointments; texting is never required to book or receive service.

Where texts don't go: we don't send automated texts before 8am or after 8pm in the recipient's local time, and we don't text a number that has opted out, regardless of any other setting an Organization has enabled.

Marketing (both channels)

None is sent today. Marketing means offers, upsells, product tips after your trial, and any other promotional email or text. We will send it only to people who have given express, opt-in consent. When it starts, we will follow CASL — express, opt-in consent collected separately (never a pre-checked box), sender identification (including a mailing address), and a working unsubscribe honored within 10 business days — and, for US recipients, CAN-SPAM (email) and the TCPA (SMS), which similarly require opt-in consent and a working opt-out. Consent records will be retained. Organizations that use the Service to contact their customers are responsible for their own compliance with these laws (Terms of Service, s. 7).

13. Children

The Service is business software and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or the age your local law protects). If you believe a child's information has been submitted, contact us and we will delete it.

14. Do Not Track and Global Privacy Control

We do not sell data for money. Our public pages use Google and Meta ads measurement only if you choose "Accept all" (Section 4), and the only targeted advertising our data can feed is Meta's own use of it, described in Section 3. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal:

• Meta: always off. Meta's pixel doesn't load and our server reports nothing to Meta, even if you chose "Accept all". We treat the signal as your request to opt out of the sale or sharing of your personal information and of targeted advertising.
• Google: we treat it as "Required only": the cookie bar doesn't ask, and nothing is sent to Google unless you later choose "Accept all" yourself in Cookie settings. If either signal is on when you sign up, we don't keep the ad's click code or report your trial from our server, even if you chose "Accept all".

Pressing play on our demo video (Section 2C) is your own request, so YouTube's player loads whatever these signals say.

Our product analytics (Section 3, item 6) is first-party, runs only for signed-in account holders, and is never used for advertising.

15. Changes to this policy

We may update this policy as the Service evolves. Material changes (a new data category, a new subprocessor handling Customer Data, a new purpose) take effect no sooner than 30 days after we email account owners and post an in-app notice; non-material clarifications take effect on posting. The version number and effective date at the top of this document identify the current version.

16. Contact

Handro Person in charge of personal information / Privacy Officer · support@gethandro.com

Complaints: we investigate every complaint. Unresolved concerns can go to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'accès à l'information du Québec (Quebec), or your state attorney general (US).