Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Account information: your name and email address, provided when you create an account.
• Business information: business name, category, address, website, and brand voice preferences that you provide during onboarding.
• Review data: customer reviews fetched from connected platforms (Google Business Profile, Yelp, Facebook), including reviewer names, ratings, and review text.
• Payment information: billing details processed securely through Stripe. We do not store your full card number, CVV, or other sensitive payment details on our servers.
• Usage data: information about how you interact with our service, including pages visited, features used, and timestamps.
• Platform credentials: OAuth tokens used to connect your business accounts on third-party platforms. These are encrypted at rest using AES-256-GCM.

2. How We Use Your Data

• Providing the service: aggregating reviews, generating AI-powered response drafts, and publishing approved responses to review platforms.
• AI response generation: review text and your brand voice settings are sent to our AI provider (Anthropic Claude) to generate draft responses. No personal account data is included in these requests.
• Analytics: computing sentiment analysis, rating trends, and review volume statistics displayed on your dashboard.
• Communication: sending weekly digest emails summarising your review activity and any urgent reviews requiring attention.
• Billing: processing subscription payments and managing your billing cycle through Stripe.

3. Third-Party Services

We use the following third-party services to operate Handled. Each has its own privacy policy governing how they handle data:

• Supabase: database hosting and authentication.
• Stripe: payment processing and subscription management.
• Anthropic (Claude): AI-powered review response generation.
• Google APIs: fetching and responding to Google Business Profile reviews.
• Meta / Facebook: fetching and responding to Facebook page reviews.
• Yelp Fusion API: fetching Yelp reviews.
• Resend: transactional and digest email delivery.
• Vercel: application hosting and infrastructure.
• Google Analytics 4 (Google Ireland Ltd): optional usage analytics on this website. It loads only after you accept the cookie banner. When enabled, Google receives the pages you visit and their titles, the referring page, your device and browser type, an approximate location derived from your IP address, and a random identifier stored in the _ga cookies. We do not use advertising features, and advertising signals are disabled. You can withdraw consent at any time via the Cookie settings link in the site footer. Analytics data is retained for up to 14 months.

4. Data Retention

We retain your personal data for as long as your account exists. Cancelling a subscription moves you to the free tier and keeps your account and review data so you can reactivate at any time; it does not delete anything by itself. You can permanently delete your account yourself at any time from Settings (Data & account), which records your closure request and suspends review activity. We confirm billing cancellation and revoke connected Google access before removing your sign-in, profile, businesses, reviews, replies, collection links and widgets. If a provider is unavailable, the status page shows pending cleanup and lets you retry or contact support. Data needed to complete that request stays protected until cleanup succeeds. We retain a minimal closure record with the account identifier, email, request and completion dates, cleanup status and Stripe customer reference to prevent accidental recreation and resolve billing issues. Payment records are retained by our payment processor (Stripe) as required for statutory accounting. You can also export all of your data as JSON from the same place, or contact us for either request.

5. Your Rights (GDPR)

Under the GDPR (EU and UK), you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object: object to processing of your data for certain purposes.

To exercise any of these rights, please contact us at liam@soluxeagency.com. We will respond to your request within 30 days.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data. All OAuth tokens are encrypted at rest using AES-256-GCM encryption. Data in transit is protected using TLS. Access to personal data is restricted to authorised personnel only. We regularly review our security practices to ensure your data remains protected.

7. Cookies

We use essential cookies required for authentication and session management. We do not use third-party tracking cookies or advertising cookies. By using our service, you consent to the use of essential cookies as described in this policy.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a notice on our service. Your continued use of Handled after such changes constitutes acceptance of the updated policy.