Privacy Policy

This policy describes how Handled Technologies LLC, doing business as Handled ("Handled," "we," "us," or "our") handles information in connection with our software and related services (the "Service").

1. Information we collect

From businesses using Handled

• Account and profile data — name, email address, business name, role, and the settings you provide when you sign up or use the Service.
• Business configuration — phone numbers and call routing, business hours, services offered, service areas, schedules, messaging templates, AI assistant configuration, website content, and integration settings.
• Billing data — subscription state, plan, and payment records. Card details are handled by our payment processor and are never stored by Handled.
• Usage and technical data — device and browser type, log data, diagnostics, and security-related information such as IP address, used to operate and secure the Service.

About the people who contact those businesses

• Contact records — name, phone number, email address, service address, and the history of interactions with that business.
• Calls — caller number, time, duration, outcome, and a written summary of what the call was about. See §3 for what is and is not retained.
• Voicemail — the audio recording a caller chooses to leave, and its metadata.
• Text messages — the content and metadata of SMS sent and received through the business's Handled number, and opt-out records.
• Email — where a business connects a mailbox, the messages, headers and attachments in that mailbox. See §7.
• Bookings and appointments — requested service, preferred times, addresses, notes, and the resulting appointment.
• Website activity — page views, clicks on calls-to-action, phone and booking clicks, referrer, and campaign parameters, on websites Handled hosts for that business.

2. How we use information

• Provide, maintain, secure and improve the Service;
• Answer, route and follow up on calls, messages, emails and booking requests on behalf of the business;
• Operate the AI features a business enables — answering calls, replying to texts, classifying urgency and intent, summarizing conversations, and drafting replies for a person to review;
• Host and serve the business's website and report on how visitors use it;
• Authenticate users, prevent fraud and abuse, and protect the Service;
• Communicate with you about the Service, billing and support;
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use the information described in this policy for advertising, cross-context behavioral profiling, or any purpose unrelated to providing the Service.

3. Calls, voicemail, recording and transcripts

Handled can answer calls with an AI receptionist. This section describes exactly what happens to the audio, because the distinctions matter and are easy to blur.

The AI receptionist discloses that it is automated

Every call answered by Handled's AI receptionist begins with a short disclosure that the speaker is an automated assistant (today: "Just so you know, I'm an automated assistant helping the team here."). That sentence is part of the first message the caller hears. If a business supplies a custom greeting that omits it, Handled still places the disclosure in the opening message before the custom words. A business cannot turn the disclosure off.

The greeting itself is otherwise a normal business introduction (for example, thanks for calling and an optional assistant name). It is not written as "you have reached our virtual receptionist," and the disclosure is not a recording notice — it does not replace any recording notice a jurisdiction may require.

The assistant is instructed never to pretend to be a human employee. If a caller asks whether they are speaking with a person or a bot, it confirms that it is automated. It does not claim to be human.

Call audio is processed live; Handled does not keep the recording or transcript

To conduct a conversation, the assistant necessarily processes call audio as it happens. That is transient processing and the call cannot occur without it.

What is kept from a call

• Call records — the caller's number, the time, the duration and the outcome.
• A derived summary and structured outcome — for example the caller's name, the service requested, and whether a booking was created. This is generated from the conversation and is what makes a non-retained call still useful to the business. It is not a recording or a full transcript of the caller.

Voicemail is different, and is recorded

When a caller is sent to voicemail and chooses to leave a message, Handled plays a short instruction (for example, to leave a message after the tone), plays a beep, and then begins recording. That message is recorded and stored. The recording is created and held by our telephony provider and referenced by Handled so the business can play it in its Handled inbox. Access is limited to the business's authenticated Handled users for that organisation.

Leaving a voicemail is the caller's own act after that prompt, which is why Handled treats it separately from recording a live two-way conversation. The voicemail prompt is an operational instruction to leave a message; it is not, by itself, a complete jurisdiction-specific recording notice for every location where recording laws apply.

Chat on a Handled-built website

Some websites Handled builds carry a chat box. When one is enabled, the messages a visitor types are answered by an automated assistant, not by a live person on the line, and are stored with the business's other enquiries so the business can see them. Anything the visitor puts in that box — including a name, phone number or email address they choose to give — is stored that way.

The chat is answered by the same AI provider listed in the subprocessor table below. If a visitor asks for a person, Handled does not open a live chat with a human agent. It records the request for the business and can tell the visitor that the team will follow up. If someone from the business later replies in Handled, that reply can be delivered back to the waiting visitor — that is asynchronous follow-up, not a live handoff. Handled's chat API can include an automated-assistant notice with replies; how prominently that notice appears in the on-site chat box depends on how that published site is configured. If a business has not enabled chat, no chat box appears and nothing is collected this way.

4. SMS messaging and privacy

Handled respects your privacy and does not sell or share SMS consent information for third-party marketing purposes.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Phone numbers you provide—and records of your messaging consent preferences—are personal information we treat as part of your account relationship with Handled, subject to the protections described in this policy. SMS consent is not shared or sold to third parties or affiliates for their marketing purposes. We may still rely on telecommunications and infrastructure providers to deliver messages operationally (for example carriers and messaging platforms), consistent with how the Service works and as summarized in Sharing below.

Depending on your interaction with us, SMS may relate to:

• Customer support,
• Onboarding and setup,
• Demo scheduling and sales follow-up you request,
• Missed-call follow-up,
• Booking or appointment-related updates,
• Other reasonable service-related communication connected to Handled.

Message frequency may vary based on how you use the Service or respond to workflows. Message and data rates may apply. Where supported by your carrier and consistent with applicable rules, you can opt out of Handled SMS by replying STOP. You may reply HELP for help where supported, or contact support@handleddesk.com for assistance. See our dedicated SMS Terms summary for wording you can surface at sign-up points and in product journeys.

5. Marketing, reviews and referrals

Handled includes tools for following up with a business's customers — recovering missed leads, requesting reviews, and running referral programs.

Promotional messaging on a business's behalf is not currently available. The Service will only send a message where it can evidence permission for that specific message, and today the single situation it can evidence is a reply on a conversation the customer themselves started with that business. An existing customer relationship, a completed job, or membership of a list is not treated as permission to begin a new promotional conversation, and the Service refuses to send on that basis. Reviews collected through Handled are not filtered by rating before a customer is asked.

6. Artificial intelligence

Handled uses artificial intelligence in parts of the Service: answering and conducting calls, drafting and sending SMS follow-ups after missed calls, conducting text-based lead intake, classifying urgency and intent, summarizing conversations, and — where a mailbox is connected — classifying email and drafting replies.

When those features are enabled, we send the relevant inputs to an AI provider that processes them on our behalf and returns a result. For email, that provider is OpenAI and the transfer is described precisely in §7.4.

• Human review before sending. AI-drafted email replies are held as drafts until a person at the business approves them. Autonomous email sending is a separate capability that is not enabled for any plan.
• We do not train models on your data. Handled does not use customer content to train models, and our AI provider does not use content submitted through its API to train its models under the standard API terms we operate under. We have not separately negotiated a zero-retention arrangement with that provider, and we do not claim one.
• AI output can be wrong. It may be inaccurate, incomplete or inappropriate for a given situation. You are responsible for reviewing AI-assisted communications before they reach your customers, and for ensuring your use complies with applicable law.

7. Connected mailboxes — Google and Microsoft

A business can connect its own Gmail or Microsoft 365 mailbox so that customer email appears alongside its calls and texts in one inbox. Connecting a mailbox is optional, is initiated by the business, and can be undone at any time.

7.1 What Google user data Handled accesses, and under which permissions

Handled requests only two Gmail permissions, and requests the second only when the business turns on sending from that mailbox:

• Read your email messages and settings (gmail.readonly) — to import and keep in sync the messages that appear in the Handled inbox, and to summarize, classify and draft replies to them.
• Send email on your behalf (gmail.send) — to send a reply that a person at the business has approved. Requested only when the mailbox is connected with sending enabled.

Through those permissions, Handled accesses:

• message headers — From, To, Cc, Subject, Message-ID, References and Date;
• message bodies, in plain text and HTML;
• attachments — filename, type and content;
• mailbox label names and identifiers, used to track what has been imported;
• the connected mailbox's own email address, used to label the connection;
• a synchronization cursor, so Handled imports only what is new rather than re-reading the mailbox.

Handled never requests permission to modify or delete your mail, to change mailbox settings, to access your mailbox over IMAP, or to access other people's mailboxes across a Google Workspace domain. Those permissions are refused in our code and the refusal is enforced by automated tests, not by policy alone.

7.2 Why each type is used

Every purpose is a feature the business connected the mailbox in order to receive: customer email appearing in the unified inbox against the right contact; a summary and urgency classification so the business can triage; a suggested reply a person reviews; and sending that reply once approved. Google user data is not used for any other purpose.

7.3 Where it is stored, and for how long

• Messages and headers are stored in our database, hosted by Supabase and encrypted at rest. Access is restricted at the database level so records are readable only within the organization that owns them.
• Attachments are stored in a private storage bucket with no public access. They are reachable only through a link that expires after 60 seconds and is issued only to an authorized member of that organization.
• Your Google refresh token is encrypted at rest with AES-256-GCM. If our encryption key were unavailable, connecting is refused rather than storing the credential unprotected. Credentials never reach a browser and are never written to logs.
• Retention. Imported mail is retained for as long as the organization exists, because the conversation history is the business's own record of its customers. It is deleted when the organization is deleted, and on request as described in §11. We do not currently apply a shorter fixed retention period to message bodies and attachments.

7.4 Transfers to service providers

Google user data reaches exactly three providers, and no others. It is not sent to our telephony, payments, analytics or error-monitoring providers, and message content is not written to our logs.

• Supabase — database and file storage, as described above.
• Vercel — the hosting platform our server code runs on, which the data passes through in transit.
• OpenAI — the AI provider. We send the message subject and body, truncated, together with basic business context such as the services the business offers. We do not send attachments, and we do not send the recipient list. This happens only for incoming messages, only when the business holds the AI email capability, and only within a monthly processing limit.

7.5 Human access

No Handled support tool exposes the contents of your email. Handled staff do not read messages from a connected mailbox except with your explicit permission, where necessary for security purposes, or to comply with applicable law.

7.6 Model training

Google user data is not used to develop, improve or train generalized or artificial-intelligence models. It is used only to provide and improve the specific user-facing features described in §7.2.

7.7 No sale, no advertising, no unrelated profiling

Handled does not sell Google user data, does not transfer it for advertising purposes, does not use it for credit-worthiness or lending decisions, and does not use it to build profiles for any purpose unrelated to the features above.

7.8 How to disconnect and revoke access

• In Handled. Open Settings, find the connected mailbox, and disconnect it. Handled revokes the token with Google first, then removes the stored credentials and stops all synchronization. Nothing further is read from your mailbox from that moment.
• At Google. You can independently remove Handled's access at any time from your Google Account's third-party connections page. Doing so revokes access immediately, and synchronization stops.
• Already-imported mail. Disconnecting stops future access; it does not by itself delete what was already imported, because that history is the business's own record. To delete it, delete the organization, or write to support@handleddesk.com and ask us to remove the imported mailbox data. See our account deletion page.

7.9 Google API Services User Data Policy

7.10 Microsoft mailboxes

A connected Microsoft 365 mailbox works the same way and is treated identically throughout this policy. Handled requests permission to read your mail, to create drafts, and — when sending is enabled — to send an approved reply. It never requests the organization-wide permissions that would grant access to every mailbox in a tenant. You can disconnect in Handled, or revoke access from your Microsoft account.

8. Scheduling and calendar connections

Handled manages booking requests and appointments. A business may connect Google Calendar or Microsoft Outlook Calendar so that availability reflects its real schedule and Handled bookings appear on it. Where connected, Handled reads and writes calendar events for that purpose only. Disconnecting deletes the stored credential and stops synchronization. For Google Calendar, Handled also asks Google to revoke the access it was granted. For Microsoft Outlook Calendar, Microsoft offers no equivalent revocation for this kind of access, so the consent remains listed in the Microsoft account until removed there.

9. Websites, website analytics and attribution

Handled builds and hosts a website for businesses that include one in their plan, and serves it on a Handled address or on the business's own custom domain.

• Visitor analytics. On those websites we record page views, calls-to-action clicked, phone and booking clicks, the referring site, and campaign parameters such as UTM tags and advertising click identifiers. This is used to show the business how its site is performing and which sources produce enquiries.
• Enquiries. When a visitor submits a booking or contact form, the details they enter are delivered to that business as a booking request.
• Attribution. Where available, we associate an enquiry with the campaign or referrer that produced the visit, so the business can tell which marketing works.

We do not use advertising retargeting pixels, cross-site behavioral tracking, fingerprinting or session-replay tools on the websites we host, and we do not sell website visitor data.

10. Mobile apps and notifications

Handled offers mobile apps for the businesses that use it. The apps are a companion to the web app: they do not create accounts and do not sell subscriptions. To deliver notifications about incoming calls, messages and bookings, we register your device with the platform's push notification service (Apple or Google) and store a device registration record. You can turn notifications off in your device settings, and the registration is removed when you sign out or delete your account.

11. Cookies, analytics and browser storage

Handled and the websites we provide use cookies, localStorage, sessionStorage and similar technologies to keep you signed in and maintain secure sessions, remember preferences, preserve partially completed forms and intake progress, and understand how visitors interact with pages.

Some cookies and browser storage are necessary for login, security, form progress and core functionality. Analytics information helps us improve the product and helps businesses understand how their online presence is used. You can control cookies through your browser settings; disabling them may prevent forms and preferences from persisting as expected.

12. Sharing and service providers

We do not sell personal information. We share it with the service providers below, each of which processes it on our behalf for the stated purpose, and we may disclose information where required by law or to protect rights, safety and integrity.

Where a business connects its own provider — its mailbox, its calendar — that provider receives and returns data at the business's direction under that provider's own terms.

13. Retention

We retain information for as long as the account exists and as needed to provide the Service, and then for the period required to meet legal, tax and accounting obligations, resolve disputes, and enforce our agreements. We do not currently apply a fixed shorter retention period to conversation content; where we introduce one, we will describe it here.

Some records survive deletion for specific reasons — administrative audit logs, payment and tax records, telecommunications records held by carriers, and security and abuse-prevention logs. Those exceptions are listed individually, with the reason for each, on our account deletion page.

14. Deletion and your choices

You can delete your account or your entire organization from Settings in the Handled web app, or by writing to support@handleddesk.com from the address on the account. Deletion is immediate and cannot be undone — there is no waiting period and no way to restore the data afterwards. The full description of what is removed, what is kept and why, and how long each path takes, is on our account deletion page, which is public and requires no sign-in.

Depending on your location and applicable law, you may have rights to access, correct, delete, port or restrict the processing of your information, and to object to certain processing. Contact us at support@handleddesk.com and we will respond consistent with applicable law. If you are a customer of a business that uses Handled, see the note at the top of this policy about which party to approach.

15. Security

We use administrative, technical and organizational measures designed to protect information, including encryption in transit and at rest, encryption of stored integration credentials, database-level isolation between organizations, and access controls on privileged operations with an audit record of administrative actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. Children's privacy

The Service is not directed to children under 13 (or the age required by local law), and we do not knowingly collect personal information from children.

17. Where information is processed

Handled operates from the United States and the providers listed in §12 process information in the United States and, in some cases, in other countries where they operate infrastructure. If you use the Service from outside the United States, you understand that your information will be processed in the United States.

18. Changes

We may update this policy. We will post the updated version on this page and update the "Last updated" date above. Where a change materially affects how we handle Google user data or any other category described here, we will describe the change rather than only restamping the date.

19. Contact

Questions about this policy, or a request about your information: support@handleddesk.com. You may also visit our contact page. See also our Terms of Service.