Privacy Policy

1. Introduction

This Privacy Policy explains how Handoffly ("we", "us", or "our") collects, uses, shares, and protects personal data when you use our service. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Data Controller

The data controller responsible for your personal data is:

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Account Information

When you create an account with Handoffly, we collect your email address through Supabase Auth (our authentication provider). This is necessary to create and manage your account, authenticate you, and communicate with you about the service.

3.2 Project and Content Data

When you use the Service, we collect and store:

• Project data: Information about your projects, including project names, configurations, and settings;
• Block content: Text, images, and other content you designate as editable blocks within your projects;
• Client submissions: Content updates and change requests submitted by your clients through the Service.

3.3 Client Email Addresses

When you share a project link with clients or invite them to propose changes, we may collect and process your clients' email addresses for the purpose of sending notifications and communications related to the Service.

3.4 Waitlist Data

If you join our waitlist, we collect and store your email address to notify you when the Service becomes available.

3.5 Usage and Technical Data

We may collect technical data such as IP address, browser type, operating system, and usage patterns to maintain, secure, and improve the Service. This data is typically anonymized or pseudonymized.

4. Legal Bases for Processing (GDPR)

We process your personal data based on the following lawful bases under the GDPR:

• Contractual necessity: Processing account information, project data, and client submissions is necessary to perform our contract with you and provide the Service (Article 6(1)(b) GDPR);
• Consent: For waitlist subscriptions and certain marketing communications, we rely on your explicit consent (Article 6(1)(a) GDPR). You may withdraw consent at any time;
• Legitimate interests: Processing usage and technical data to improve the Service, maintain security, and prevent fraud is based on our legitimate interests (Article 6(1)(f) GDPR), balanced against your rights and interests.

5. Data Processors and Sub-Processors

We use trusted third-party service providers to operate the Service. These processors access your personal data only to the extent necessary to perform their services on our behalf.

5.1 Supabase

Supabase (operated by Supabase, Inc.) provides our hosting, database, and authentication infrastructure. Supabase processes account information (email addresses), project data, and content stored in the Service.

Supabase is located in the United States and complies with GDPR through standard contractual clauses and data processing agreements.

5.2 Resend

Resend (operated by Resend, Inc.) is our transactional email provider. Resend processes email addresses and sends service-related notifications (e.g., account confirmations, client notifications, waitlist updates).

Resend is located in the United States and complies with GDPR through standard contractual clauses.

5.3 LemonSqueezy

LemonSqueezy (operated by Lemon Squeezy LLC) is our payment processor and Merchant of Record for paid subscriptions. LemonSqueezy processes payment information, billing details, and subscription data. LemonSqueezy acts as an independent data controller for payment data; please refer to LemonSqueezy's Privacy Policy for details on how they handle your payment information.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers (Supabase, Resend, and LemonSqueezy) operate.

We ensure that such transfers comply with GDPR requirements by implementing appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Data Processing Agreements (DPAs) with our processors;
• Technical and organizational measures to ensure data security.

7. Data Retention

We retain your personal data only as long as necessary for the purposes described in this Privacy Policy:

• Account data: Retained for the duration of your account and for a reasonable period after account closure to comply with legal obligations and resolve disputes;
• Project and content data: Retained as long as your account is active and for a limited period after deletion to facilitate account recovery;
• Waitlist data: Retained until you unsubscribe or until the waitlist is no longer active;
• Usage and technical data: Typically retained for up to 12 months, or as required for security and fraud prevention purposes.

After the retention period, we will securely delete or anonymize your personal data.

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you;
• Right to rectification: You can request correction of inaccurate or incomplete personal data;
• Right to erasure ("right to be forgotten"): You can request deletion of your personal data in certain circumstances;
• Right to data portability: You can request a copy of your personal data in a structured, commonly used, machine-readable format;
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes;
• Right to restrict processing: You can request that we limit the processing of your personal data in certain circumstances;
• Right to withdraw consent: Where processing is based on consent, you can withdraw your consent at any time;
• Right to lodge a complaint: You can file a complaint with your local data protection authority. In Slovakia, this is the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk).

To exercise any of these rights, please contact us at [DOPLNIŤ email]. We will respond to your request within 30 days.

9. Cookies and Tracking Technologies

We use only essential cookies to operate the Service. These cookies are necessary for authentication, session management, and basic functionality. We do not use tracking cookies, analytics cookies, or advertising cookies without your consent.

Essential cookies include session cookies used by Supabase Auth to keep you logged in. These cookies are deleted when you close your browser or log out.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include:

• Encryption of data in transit (TLS/HTTPS) and at rest;
• Access controls and authentication mechanisms;
• Regular security audits and monitoring;
• Secure hosting infrastructure provided by Supabase.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

11. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete such data promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, legal requirements, or service features. We will notify you of material changes by posting the updated Privacy Policy on this page with a revised "Last updated" date, or by sending you an email notification if you have an account with us.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

13. Contact Us

If you have any questions about this Privacy Policy, how we handle your personal data, or if you wish to exercise your data protection rights, please contact us at:

[DOPLNIŤ email]

You may also contact us by mail at:
Mudroch.FE s. r. o.
Bebravská 1
821 07 Bratislava – Vrakuňa
Slovensko