Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Account information: your name and email address, provided when you create an account.
• Business information: business name, category, address, website, and brand voice preferences that you provide during onboarding.
• Review data: customer reviews fetched from connected platforms (Google Business Profile, Yelp, Facebook), including reviewer names, ratings, and review text.
• Payment information: billing details processed securely through Stripe. We do not store your full card number, CVV, or other sensitive payment details on our servers.
• Usage data: information about how you interact with our service, including pages visited, features used, and timestamps.
• Platform credentials: OAuth tokens used to connect your business accounts on third-party platforms. These are encrypted at rest using AES-256-GCM.

2. How We Use Your Data

• Providing the service: aggregating reviews, generating AI-powered response drafts, and publishing approved responses to review platforms.
• AI response generation: review text and your brand voice settings are sent to our AI provider (Anthropic Claude) to generate draft responses. No personal account data is included in these requests.
• Analytics: computing sentiment analysis, rating trends, and review volume statistics displayed on your dashboard.
• Communication: sending weekly digest emails summarising your review activity and any urgent reviews requiring attention.
• Billing: processing subscription payments and managing your billing cycle through Stripe.

3. Third-Party Services

We use the following third-party services to operate Handled. Each has its own privacy policy governing how they handle data:

• Supabase: database hosting and authentication.
• Stripe: payment processing and subscription management.
• Anthropic (Claude): AI-powered review response generation.
• Google APIs: fetching and responding to Google Business Profile reviews.
• Meta / Facebook: fetching and responding to Facebook page reviews.
• Yelp Fusion API: fetching Yelp reviews.
• Resend: transactional and digest email delivery.
• Vercel: application hosting and infrastructure.

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. Review data is retained for the duration of your subscription. If you cancel your subscription, your data will be retained for 30 days to allow for reactivation, after which it will be permanently deleted. You may request immediate deletion at any time by contacting us.

5. Your Rights (GDPR)

Under the GDPR (EU and UK), you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object: object to processing of your data for certain purposes.

To exercise any of these rights, please contact us at liam@soluxeagency.com. We will respond to your request within 30 days.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data. All OAuth tokens are encrypted at rest using AES-256-GCM encryption. Data in transit is protected using TLS. Access to personal data is restricted to authorised personnel only. We regularly review our security practices to ensure your data remains protected.

7. Cookies

We use essential cookies required for authentication and session management. We do not use third-party tracking cookies or advertising cookies. By using our service, you consent to the use of essential cookies as described in this policy.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a notice on our service. Your continued use of Handled after such changes constitutes acceptance of the updated policy.