Privacy policy
- Last updated October 30, 2026
What Handywright collects, why, who sees it, and how to ask us to change or delete it.
The Plain Works Co., Ltd. runs Handywright. For the information a Business keeps about its own customers, the Business decides what is collected and why, and we process it on its behalf. For account, billing, security and product-use information, we decide. Privacy team: hello@handywright.com.
1.What we collect
- Account information for the Business and its team: name, email, phone, business name and role.
- Customer records the Business enters or imports: names, phone numbers, emails, service addresses, job and visit details, notes and photos.
- Quotes, invoices, signatures (the drawn or typed signature image, the name typed and the time) and payment records.
- Payment details your customers enter go to the Business’s own Stripe account and are never stored on our servers; we keep the card brand, last four digits, amount, status and Stripe ids. If the Business connects Stripe with a restricted key, we store that key and its webhook signing secret encrypted and use them only to open Stripe’s payment page and confirm payments.
- Subscription billing details are entered into Paddle, which sells the Handywright plan as merchant of record; we receive the plan, its status and Paddle ids, never card numbers.
- Technical information needed to run and secure the service: device and browser type, IP address and error logs.
- Product-use analytics from the office app, not from customer link pages.
2.How we use it
To provide the service (show a customer their quote, take a payment, send a reminder), to keep it secure and prevent fraud, to give support, to manage the Business’s subscription (billed by Paddle), and to improve the product. We do not sell personal information and do not use customer records for advertising.
3.Who we share it with
| Provider | Role | Data |
|---|---|---|
| Business that sent the link | Our customer; decides the purpose | Everything on its own quotes, invoices, visits and payments |
| Cloudflare | Hosting and delivery | All service data in transit, request logs |
| Supabase | Database and sign-in | All service data, stored in the United States |
| PostHog | Product analytics in the office app | Usage events tied to a pseudonymous id |
| Resend | Transactional email | Recipient email, message content |
| Anthropic | Writes the suggested quotes, messages and replies the agents prepare for your approval (AI conversations) | The records and text a suggestion needs, such as job, quote and customer details; under its API terms it does not train on them |
| OpenAI | Backup writer, used only when Anthropic is unavailable | The same request; under its API terms it does not train on it |
| Paddle | Sells the subscription as merchant of record; controller of the billing payment data it collects | Billing name, email, country, payment details for the subscription |
| Stripe | The Business’s own payment processor: customer payments go to the Business’s Stripe account under Stripe’s agreement with the Business; Stripe’s privacy notice applies | Payment details, amount, Business and customer contact for the payment |
| None yet | Text messages are off. We will name the SMS provider here before any text is sent. | None |
We may also disclose information to comply with law or protect people and the service.
4.Customer link pages
Pages you reach from a link (/q, /i, /r, /v) use no advertising or tracking cookies, show only your own record, and are marked noindex so search engines skip them. The link itself is the key to the page; do not forward it.
5.How long we keep it
Records of quotes, invoices and payments are kept while the Business’s workspace is open and afterwards as long as tax, accounting or dispute rules require. When a workspace is deleted we delete or de-identify its data within 30 days, except what the law requires us to retain and backups, which expire on their normal cycle.
6.Your choices and rights
You can ask to see, correct, export or delete your information, or object to a use, by writing to hello@handywright.com. If you are a Business’s customer, we may route your request to that Business, which holds the record. State privacy laws (for example in California, Colorado, Virginia and Texas) give residents these rights and the right not to be treated worse for using them. We do not sell or share personal information for cross-context advertising. We answer verified requests within 45 days, and may extend once by another 45 days with notice. We verify your identity by matching your request to the email on the account, and may ask for more if needed. An authorized agent may write on your behalf with your written permission. If we decline a request, you can appeal by replying to our answer or writing to the same address with the word Appeal in the subject; we reply within 60 days. To delete a Business workspace, see the terms (Settings > Account > Delete your account). To stop texts reply STOP (see the SMS terms).
7.Cookies and local storage
The office app uses a session cookie and browser local storage to keep you signed in and remember settings, and product analytics from PostHog that use a pseudonymous id. Customer link pages use none of the analytics. We do not currently read the Global Privacy Control signal, because we do not sell or share personal information and use analytics only to run and improve the product.
8.Security and children
We use encryption in transit, access controls between businesses, and audit logs. No system is perfectly secure, and we will notify affected Businesses and individuals of a breach as the law requires. The service is not directed to children under 13 and we do not knowingly collect their information.
9.Changes and contact
We will post changes here and notify Businesses of material ones. Contact: hello@handywright.com.