h@ndle Privacy Policy

Handle App, LLC ("Handle", "we", "us", or "our") operates the h@ndle app and website at myhandle.app (the "Service"), a marketplace connecting content creators ("Creators") with brands and businesses ("Brands"). This Privacy Policy explains what information we collect, how we use it, and the rights you have over it.

The Service is offered to residents of the United States only. By using the Service, you confirm you are a US resident and you agree to the practices described here.

1. Information We Collect

1.1 Information you provide

When you sign up and use the Service, you provide:

• Account details: name, email address, password (stored hashed), user type (Creator or Brand), and for Brands, company name and verification information.
• Profile information: bio, profile photo, content categories, languages spoken, country, social media links and follower counts you choose to display, rate cards, portfolio items, and past collaborations (including any campaign details you add).
• Payment information: Brands enter payment-card details directly with our payment processor, Stripe; Handle never sees or stores card numbers. Creators connect their payout account through Stripe Connect; we receive a Stripe account identifier but not full bank or tax-form contents (Stripe holds those).
• Tax information: Creators required to receive a US tax form (e.g., W-9 information) provide it through Stripe's identity-verification flow. Handle stores only the last four digits of any tax identifier (TIN) for matching purposes.
• Content you create: profile content, posts, messages, contracts, briefs, and any other content you submit through the Service.
• Communications: the contents of messages you send through the Service's messaging feature.

1.2 Information we collect automatically

When you use the Service we automatically collect:

• Usage data: pages viewed, features used, actions taken (e.g., signing a contract, sending a message), and timestamps of those events.
• Device and connection information: IP address, browser type and version, operating system, device type, language preference, and referring URL.
• Cookies and similar technologies: see Section 5.

1.3 Information from third parties

If you choose to connect a social media account (e.g., YouTube, Instagram, TikTok, Twitter/X, Twitch, Kick), we receive limited information from that platform via OAuth. See Section 6 for the full disclosure.

2. How We Use Your Information

We use the information described above to:

• Operate, maintain, and improve the Service.
• Create and manage your account, profile, and verifications.
• Facilitate matching and communication between Creators and Brands.
• Process payments, payouts, fees, and refunds, and provide accounting and tax records related to those transactions.
• Compute Handle Score and other reputation signals (this is automated and based on platform activity; you can request a manual review — see Section 9).
• Send transactional emails (e.g., contract notifications, payment confirmations, password resets, security alerts). Transactional emails are necessary to operate the Service and you cannot opt out of them while you have an active account.
• Send marketing emails (e.g., product updates, newsletters, feature announcements) — but only if you have opted in. See Section 7.
• Detect, investigate, and prevent fraud, abuse, security incidents, or violations of our Terms of Service.
• Comply with legal obligations, enforce our Terms, and respond to lawful requests from authorities.

3. How We Share Your Information

We do not sell your personal information. We share information only in the following ways:

3.1 With other users of the Service

Your public Creator or Brand profile (name, photo or logo, bio, categories, follower counts, public collaborations, public reviews) is visible to other users and may be visible to non-users via search engines. Information you share inside a contract or message thread is visible only to the other party in that interaction.

3.2 With service providers (subprocessors)

We share data with third-party vendors that help us operate the Service. Each vendor is bound by contract to use the data only on our instructions. Current subprocessors:

• Stripe, Inc. — payment processing, payouts, identity verification (stripe.com/privacy).
• Railway Corporation, Inc. — application hosting (US data centers).
• Sentry (Functional Software, Inc.) — error monitoring; receives stack traces and limited request metadata when an error occurs (sentry.io/privacy).
• Resend, Inc. — transactional and marketing email delivery (resend.com/legal/privacy-policy).
• Cloudflare, Inc. — DNS, edge security, and inbound email routing.
• Anthropic, PBC — AI-assisted content suggestions in the brief and matching features. Inputs sent for these features are used only to return responses and are not used to train models per Anthropic's commercial terms.
• Connected social platforms (Google/YouTube, Meta, TikTok, Twitter/X, Twitch, Kick) — only when you explicitly connect an account; see Section 6.

3.3 For legal reasons or to protect rights

We may disclose information if we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; to detect or prevent fraud or security issues; or to protect the rights, property, or safety of Handle, our users, or others.

3.4 In a business transfer

If Handle is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you (e.g., via email or in-Service notice) before your information becomes subject to a different privacy policy.

3.5 With your consent

We share information with other parties when you direct us to do so (for example, by posting it publicly on your profile or sending it through a message).

4. Public Profile and User-Generated Content

Your Creator or Brand profile is public by default. This includes your name, photo or logo, bio, categories, slug-based profile URL, connected platform handles and follower counts, rate ranges if you choose to display them, and any case studies or portfolio items you publish. Posts you share to the public feed are also public.

You can change what appears on your profile at any time from the Edit Profile page. Information that has already been viewed, cached, or copied by other users or third parties may persist outside of our control.

5. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, and understand usage. The categories we use:

• Strictly necessary: session and authentication tokens (e.g., your login JWT). The Service will not function without these.
• Functional: preferences such as collapsed sidebar state.
• Analytics: error monitoring via Sentry. We do not use third-party advertising or behavioral-tracking analytics.

Most browsers let you block cookies via their settings. Blocking strictly-necessary cookies will sign you out and break Service functionality. We do not currently respond to "Do Not Track" browser signals because there is no industry standard for them; we do honor the Global Privacy Control (GPC) signal as a request to opt out of any future sale or sharing of personal information.

6. Third-Party Platform Connections

The Service lets you connect external accounts (Google/YouTube, Meta/Instagram, TikTok, Twitter/X, Twitch, Kick) so that follower counts, channel verification, and engagement metrics can be displayed on your profile and used in your Handle Score. Connection happens through each platform's OAuth flow.

6.1 What we receive

From each connected platform, we request only the minimum scopes needed for verification and display. Typical scopes per platform:

• Google / YouTube: youtube.readonly — channel ID, channel name, public subscriber count, public view count.
• Instagram: via the Instagram API with Instagram Login (instagram_business_basic) — username, account type, profile picture, and follower count. Read-only: we never publish, comment, or message on your behalf.
• TikTok: profile information and follower statistics.
• Twitter / X: profile information and follower count.
• Twitch: user ID, display name, follower count.
• Kick: channel handle and follower count.

6.2 How we use this data

Data received from connected platforms is used solely to:

• Verify that the platform handle you claim is actually controlled by you.
• Display follower counts and verification badges on your public profile.
• Compute your Handle Score and other reputation signals.
• Refresh the displayed counts on a periodic background sync.

6.3 Google API Services User Data Policy — Limited Use

Handle's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Data received from Google APIs is used only to provide and improve the user-facing features described above (profile verification, follower display, Handle Score).
• We do not transfer Google user data to third parties except as necessary to provide and improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (with appropriate notice).
• We do not use Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read Google user data unless we have your affirmative agreement, doing so is necessary for security purposes (such as investigating abuse), or to comply with applicable law, or the data is aggregated and anonymized.

The same Limited Use principles apply to data we receive from any other connected platform.

6.4 Disconnecting and revocation

You can disconnect any connected platform at any time from your Edit Profile page. Disconnection stops all future data refreshes from that platform. You can also revoke Handle's access directly from each platform's account settings — for Google, this is at myaccount.google.com/permissions; for Instagram, remove Handle under Instagram → Settings → Apps and websites, which notifies us to delete the Instagram data we stored (username and follower count). You may also email hello@myhandle.app to request deletion. We delete the previously-stored access token and platform data within 7 days of disconnection.

7. Marketing Communications

We send two kinds of email: transactional (necessary to operate the Service — contract notifications, payment receipts, password resets, security alerts) and marketing (product updates, newsletters, feature announcements).

Marketing emails are sent only with your opt-in. You can withdraw consent at any time by clicking "unsubscribe" at the bottom of any marketing email or by emailing privacy@myhandle.app. We honor unsubscribe requests within 10 business days as required by CAN-SPAM.

You cannot opt out of transactional emails while you have an active account; deleting your account stops both kinds.

8. Data Retention

We retain your personal information for as long as your account is active and as needed to provide the Service. When your account is deleted, we apply the following defaults:

• Account, profile, and connected-platform data: deleted within 30 days of your deletion request.
• Messages and content: deleted within 30 days, except messages or content that are part of an active or disputed transaction (retained until resolution).
• Transaction records (contracts, payments, fees, payouts): retained for 7 years to comply with US tax, financial-records, and audit requirements.
• Backups: may persist for up to 30 additional days as the relevant backup snapshot rotates out.
• Aggregated and anonymized data: may be retained indefinitely.

9. Your Privacy Rights

9.1 Rights available to all US users

Regardless of your state, you may:

• Access a copy of the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your account and associated personal information yourself at any time from Settings → Delete account, or request deletion by email (subject to retention exceptions in Section 8).
• Opt out of marketing communications (Section 7).

9.2 California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know: the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: personal information we hold about you, subject to exceptions allowed by law.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing: Handle does not sell personal information and does not share personal information for cross-context behavioral advertising. There is nothing to opt out of, but we honor the Global Privacy Control signal as a confirming opt-out for any future change.
• Right to limit use of sensitive personal information: we use sensitive personal information (e.g., government identifiers handled by Stripe for tax purposes) only as necessary to provide the Service and as permitted by the CCPA's limited-use exceptions; we do not use it for inferences about your characteristics.
• Right to non-discrimination: we will not deny you the Service, charge you a different price, or provide a different level of service because you exercised your privacy rights.

9.3 Other US states

Residents of other US states with comprehensive privacy laws — including but not limited to Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Montana, Oregon, Delaware, New Jersey, New Hampshire, Kentucky, Maryland, Minnesota, and Rhode Island — have substantially similar rights to access, correct, delete, opt out of targeted advertising, opt out of sale, and opt out of certain profiling. Specific rights and verification procedures vary by state; we honor whichever framework applies to you.

9.4 How to submit a request

Email privacy@myhandle.app with the subject line "Privacy Rights Request" and a description of what you'd like to do. We will:

• Acknowledge receipt within 10 business days.
• Verify your identity by confirming you control the email address associated with your Handle account, and possibly by asking you to confirm one or two pieces of account information.
• Respond substantively within 45 days, with a one-time extension of up to 45 additional days where necessary (we will let you know if an extension is needed).

You may designate an authorized agent to make a request on your behalf. We may require written authorization and identity verification from both you and the agent.

10. Security

We use industry-standard security practices to protect personal information, including encrypted connections (HTTPS), hashed passwords (bcrypt), JWT-based session management with rotation on password change, payment processing isolated to PCI-compliant providers (Stripe), and access controls on internal systems. No system is fully secure. Choose a strong, unique password for your Handle account and enable two-factor authentication if available.

If we discover a security incident affecting your personal information, we will notify you and applicable authorities consistent with US state breach-notification laws.

11. Children's Privacy

The Service is not directed at children under 18 and we do not knowingly collect personal information from anyone under 18. If we discover that we have collected information from a minor, we will delete it promptly. If you are a parent or guardian and believe a minor has used the Service, contact privacy@myhandle.app.

12. International Visitors

The Service is intended for residents of the United States only. We do not market to or knowingly serve residents of the European Union, the United Kingdom, or other jurisdictions outside the US. If you access the Service from outside the US, you do so at your own initiative and you are responsible for complying with any local laws that apply to you.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes, we will notify you by email and/or by an in-Service notice at least 30 days before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

Email: privacy@myhandle.app
Mail: Handle App, LLC
67 Piney Point Rd
Anaconda, MT 59711