Privacy Policy

Who we are

The data controller for Handler is Alexander Safiulin, operating the Handler business software platform from Koh Samui, Surat Thani, Thailand.

For privacy questions or requests, contact us at support@handlerbos.com.

Information we collect

Account and profile: name, email address, password hash (for email sign-up), role, language preference, and authentication identifiers from Supabase Auth.

Google sign-in (optional): when you choose “Continue with Google”, we receive your Google account email address, display name, and profile picture URL from Google, as permitted by your Google account settings and our OAuth scopes. We do not receive your Google password.

Business and POS data you enter: company and store details, catalog, inventory, sales receipts, customers, employees, payroll and HR records you choose to store in Handler, device enrollment data for POS terminals, and operational logs needed to run the service.

Technical data: IP address, browser or app version, device type, cookies and similar technologies (see our Cookie Policy), and security / audit logs.

Support and communications: messages you send to us (for example via support@handlerbos.com or contact forms).

How we use information

We use information to provide, secure, and improve Handler; authenticate users; sync POS and BackOffice data; process subscriptions when you purchase a paid plan; send transactional email (such as email verification and security notices); comply with law; and respond to support requests.

We do not sell your personal information. We do not use Google user data for advertising, and we do not allow humans to read Google user data except when necessary for security, support with your consent, or legal compliance.

Google API Services and Limited Use

Handler’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google sign-in data only to authenticate you, create or link your Handler account, display your name and avatar in the product, and maintain your session. We do not transfer Google user data to third parties except as described in “Subprocessors” below, and only to provide or improve Handler, comply with law, or as part of a merger with notice.

You can revoke Handler’s access to your Google account at any time in your Google Account security settings.

Legal bases (EEA/UK) and Thailand PDPA

Where GDPR applies, we rely on contract performance (providing the service), legitimate interests (security, fraud prevention, product improvement), consent (where required, for example marketing cookies), and legal obligation.

Where Thailand’s Personal Data Protection Act (PDPA) applies, we process personal data on similar grounds including consent, contract, and legitimate interest, and we respect data subject rights described below.

Storage and location

Handler is operated on Self-hosted servers operated by the Handler team (VPS infrastructure in the European Union and Southeast Asia, with primary application and database hosting under our control).. Backups and logs may be stored in the same controlled infrastructure.

We apply access controls, encryption in transit (TLS), and industry-standard practices appropriate to a business operations platform. No method of transmission or storage is 100% secure.

Subprocessors

We use trusted service providers who process data on our instructions: email delivery (Resend or equivalent SMTP provider for transactional mail), payment processing (Stripe, when you subscribe to a paid plan), cloud infrastructure hosting our self-hosted stack, and error monitoring (Sentry) with configured data scrubbing.

We do not use Sumsub or other identity-verification vendors for Handler sign-up.

Subprocessors are bound by confidentiality and data protection terms. A current list is available on request at support@handlerbos.com.

Retention

We retain account and business data while your account is active and as needed to provide the service.

After termination, we delete or anonymize personal data within a reasonable period unless we must retain it for legal, tax, accounting, or dispute resolution purposes.

Security and access logs are retained for a limited period appropriate for incident response.

Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability.

You may withdraw consent where processing is consent-based. You may lodge a complaint with a supervisory authority.

To exercise rights, email support@handlerbos.com. See also our Data deletion page for account removal steps.

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Children

Handler is a business product not directed at children under 16. We do not knowingly collect personal data from children. Contact support@handlerbos.com if you believe a child has provided data.

Changes

We may update this policy. We will post the new version on this page and update the effective date. Material changes may be notified by email or in-product notice where appropriate.