Effective date: November 3, 2026. This Privacy Policy explains what personal data HandyAsk collects when you visit our website, create an account, use our agents, or talk to an agent deployed by one of our customers, why we process it, who we share it with, and the rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR), the California Online Privacy Protection Act (CalOPPA) and other U.S. state privacy laws.
1. Who we are and our role
The Service is operated by YMOX LLC, 8206 Louisiana Blvd NE, Ste A, Albuquerque, NM 87113, United States, doing business as HandyAsk (“HandyAsk”, “we”, “us”). Privacy contact: support@handyask.com. The Service is offered to businesses established in the United States; this Policy also describes the rights of visitors located in the European Union under the GDPR.
We act in two different roles:
- Data controller for the personal data of website visitors, people who contact us or request a demo (leads), and account holders and their users (account, billing, usage events). This Policy applies in full to that data.
- Data processor (service provider) for the conversations between a customer's agent and that customer's own clients. The customer who deployed the agent is the controller; we process those conversations on its documented instructions under our Data Processing Agreement. If you talked to a HandyAsk agent on a professional's website, please address privacy requests to that professional first; we help them respond (see section 9).
2. Personal data we collect
Website visitors
- Technical and usage data: pages viewed, referring page, device and browser type, approximate location derived from your IP address, campaign parameters (utm), and an anonymous session identifier stored in your browser.
- IP address, processed transiently for security and abuse prevention by our hosting provider.
Contact and demo requests (leads)
- Full name, e-mail address, company, phone number, trade, message, and the page you submitted the form from.
Account holders
- Identity and contact details: name, e-mail address, password (stored as a hash), company name;
- Agent configuration: opening hours, service area, prices, services offered, documents you provide;
- Test conversations you hold with your own agents from your dashboard;
- Product usage events (agent created, sign-in, test conversation, plan changed), tied to your account;
- Billing information: plan, invoices and payment history. Payment-card details are collected directly by our payment processor and never stored by us.
Conversations with customers' agents (as processor)
- Messages exchanged between a visitor and the agent, timestamps, and any information the visitor chooses to share (for example an address for a repair, a phone number, a situation). We ask our customers not to collect special categories of data through their agents.
We do not knowingly collect personal data from anyone under 18 (see section 12).
3. Purposes and legal bases
Under the GDPR, we must have a legal basis for each processing activity. The table below lists what we do and why.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service: account, agents, conversations, summaries, notifications, support | Performance of a contract (Article 6(1)(b)) |
| Responding to a contact or demo request | Steps at your request before entering into a contract (Article 6(1)(b)) |
| Billing, accounting, tax, fraud prevention, legal claims | Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)) |
| Securing the Service and preventing abuse (logs, rate limiting) | Legitimate interests (Article 6(1)(f)) |
| First-party usage measurement (events stored in our own database, pseudonymous) | Legitimate interests in improving the Service (Article 6(1)(f)) |
| Google Analytics audience measurement | Consent given through the cookie banner (Article 6(1)(a)), withdrawable at any time |
| Service announcements and product news to customers | Legitimate interests (Article 6(1)(f)); you can opt out in every e-mail |
| Marketing e-mails to prospects | Consent (Article 6(1)(a)); unsubscribe link in every e-mail |
Commercial e-mails we send comply with the U.S. CAN-SPAM Act: they identify the sender, include our mailing address, and contain a working unsubscribe link that we honor promptly. Conversations and Customer Data are never used to train artificial-intelligence models, ours or anyone else's.
4. Service providers and recipients
Personal data is accessible only to authorized HandyAsk personnel and to the following service providers, bound by contract to process it on our instructions and to protect it:
- Vercel Inc. (United States) — hosting of the website and application, content delivery, and Vercel Web Analytics (privacy-preserving page statistics that set no cookies). Vercel processes technical logs (IP address, requests) transiently.
- Supabase, Inc. (United States; project hosted in the European Union, Paris region, AWS eu-west-3) — database, authentication and file storage. Account data, configurations, leads, usage events and conversations are stored there.
- Resend, Inc. (United States) — transactional e-mail (account confirmation, password reset, new-request notifications). Resend processes e-mail addresses and message content.
- Google LLC / Google Ireland Limited — Google Analytics 4, loaded only after you accept analytics cookies; Google Consent Mode denies advertising storage in all cases. Google may transfer data to the United States under the EU-U.S. Data Privacy Framework.
- Anthropic, PBC (United States) — AI language models that generate agent replies. Messages are sent to Anthropic's API for real-time processing only. Under Anthropic's commercial terms, data submitted through the API is not used to train Anthropic's models.
- Payment processor — subscription billing: Stripe, Inc. (United States).
We do not sell or rent personal data. We may disclose it when required by law, court order or a lawful request from a public authority, to protect our rights or safety, or in connection with a merger, acquisition or sale of assets (with notice to you).
5. International data transfers
Application data is stored in the European Union (Supabase, Paris). HandyAsk itself and several of our service providers (Vercel, Resend, Anthropic, Google) are located in the United States, so personal data of EU, EEA, Swiss and UK residents is transferred outside those territories. Such transfers rely on the Standard Contractual Clauses adopted by the European Commission (and the UK Addendum where relevant), supplemented by technical measures such as encryption in transit and at rest, or on an adequacy decision where the recipient is certified under the EU-U.S. Data Privacy Framework. HandyAsk's own status under the Data Privacy Framework: not self-certified. You can request a copy of the applicable safeguards at support@handyask.com.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and agent configuration | Duration of the contract; data is exportable for 30 days after closure, then deleted or anonymized. Billing records and data needed for legal claims are archived for up to 3 years |
| Conversations with agents | 12 months by default; customers can ask for a shorter period or for deletion at any time |
| Contact and demo requests (leads) | 3 years from the last exchange |
| Technical and security logs, usage events | 12 months |
| Billing records and invoices | As long as required by applicable tax and accounting law |
| Cookie consent choice | Until you clear your browser's site data (see Cookie Policy below) |
7. Your rights under the GDPR
If you are in the European Union, the European Economic Area, Switzerland or the United Kingdom, you have the right to:
- access your personal data and obtain a copy;
- rectify inaccurate or incomplete data;
- erase your data, subject to our legal retention obligations;
- restrict processing;
- receive the data you provided to us in a portable format;
- object to processing based on legitimate interests, including to direct marketing at any time;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not make such decisions).
To exercise these rights, write to support@handyask.com, describing your request. We may ask you to verify your identity where there is reasonable doubt. We respond within one month, extendable by two further months for complex requests, and we will tell you if we do. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work: for example the CNIL in France (cnil.fr) or the AEPD in Spain (aepd.es).
8. Your U.S. state privacy rights
Residents of California and of other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon) may have the right, subject to the thresholds and exemptions in those laws, to:
- know what personal information we collect, use and disclose, and access a copy of it;
- correct inaccurate personal information;
- delete personal information we collected from you, subject to legal exceptions;
- opt out of the sale of personal information, of targeted advertising and of profiling;
- not be discriminated against for exercising these rights.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics. Because we do not engage in these activities, no opt-out mechanism is required. To exercise your rights, e-mail support@handyask.com with the subject “Privacy request”. An authorized agent may submit a request on your behalf with proof of authorization. We will verify your request using the information associated with your account or e-mail address and respond within the time required by your state's law (generally 45 days). If we deny a request, you may appeal by replying to our decision.
Do Not Track. Some browsers send a “Do Not Track” (DNT) signal. There is no common standard for how to respond to it, and we do not currently respond to DNT signals. Our analytics cookies are only set with your consent, as described in the Cookie Policy below.
Categories of personal information collected in the last 12 months (as defined by the California Consumer Privacy Act): identifiers (name, e-mail, phone, IP address), commercial information (plan, payment history), internet activity (pages viewed, usage events), professional information (company, trade), and the content of conversations and messages you choose to send. Sources: you, your device, and our service providers. Purposes: as described in section 3. Disclosures: to the service providers listed in section 4, for business purposes only.
9. If you talked to a HandyAsk agent on a professional's website
The professional who deployed the agent decides why and how your conversation is processed and is your first point of contact for any privacy request. We process the conversation on their behalf, keep it for the period they configure (12 months by default), and assist them in responding to your request. If you cannot reach them, write to support@handyask.com and we will forward your request.
10. Security
We protect personal data with encryption in transit (TLS) and at rest, isolation of each customer's data through row-level access rules, hashed passwords or magic-link sign-in, access logging, daily backups and access restricted to authorized personnel. No system is perfectly secure; if a personal-data breach is likely to result in a risk to your rights, we will notify you and the competent authorities within the timeframes required by the GDPR and applicable U.S. state breach-notification laws.
11. Cookie Policy
When you first visit the website, a banner lets you accept or decline analytics cookies. Until you accept, no Google Analytics script is loaded. Vercel Web Analytics sets no cookies. We use no advertising cookies or tracking pixels.
| Name | Purpose | Type | Duration |
|---|---|---|---|
sb-*-auth-token | Supabase authentication session (keeps you signed in to your dashboard) | Strictly necessary | Session, renewed while you are signed in |
NEXT_LOCALE | Remembers the language you chose (English, French, Spanish) | Strictly necessary | Session |
handyask_consent | Stores your cookie choice so the banner is not shown again (browser local storage) | Strictly necessary | Until you clear site data |
handyask_session_id | Anonymous identifier for first-party usage measurement (browser local storage, no third party) | Strictly necessary / legitimate interests | Until you clear site data |
_ga, _ga_* | Google Analytics 4 audience measurement | Analytics — only with your consent | Up to 13 months |
Withdrawing or changing your consent: clear this website's site data (cookies and local storage) in your browser settings; the banner will appear again on your next visit and you can make a new choice. You can also block third-party cookies in your browser or install Google's opt-out add-on for Google Analytics. Declining analytics cookies does not affect your use of the Service.
12. Children
The Service is intended for business professionals aged 18 or over. We do not knowingly collect personal data from anyone under 18, and in particular from children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA). If you believe a minor has provided us with personal data, contact us and we will delete it.
13. Changes to this Policy
We may update this Policy to reflect changes to the Service, our providers or the law. The effective date at the top of this page tells you when it was last revised. For material changes, we notify account holders by e-mail and, where required, ask for your consent again.
14. Contact
YMOX LLC, 8206 Louisiana Blvd NE, Ste A, Albuquerque, NM 87113, United States — support@handyask.com. See also our Legal Notice and Terms of Service.