Privacy Policy

HandyApp Ltd (“Handy”, “we”, “us”) is a company registered in England and Wales (company number 17153591). We operate the Handy platform at handyapp.ai and its subdomains.

Handy is a tax compliance marketplace. We connect individual clients with licensed tax professionals who provide reconciliation, preparation, and filing services across multiple jurisdictions. We do not provide tax advice ourselves.

For any questions about this policy or your data, contact us at hello@handytax.io.

We collect the following categories of personal data:

Account data

Name, email address, and phone number, collected at registration.

Tax profile data

Countries where you pay tax, types of income, tax years, and transaction volumes — collected during the assessment and onboarding.

Financial data

Transaction records, exchange exports, wallet addresses, and other documents you upload for reconciliation by your assigned expert.

Payment data

All payments are processed by Stripe. We do not store card numbers. We retain a record that a payment was made and the amount.

Communication data

Messages between you and your assigned expert sent through the platform.

Technical data

IP address, browser type, device information, and cookies used to provide a working session.

Usage data

Pages visited, features used, and session duration so we can identify and fix bugs.

We use personal data only for the following purposes:

• To deliver the tax compliance service you signed up for.
• To match you with appropriate tax experts based on jurisdiction, capability, and capacity.
• To process payments through Stripe.
• To send service-related transactional emails through Resend.
• To improve the platform, fix bugs, and maintain security.

We do not sell your data. We do not use your financial data for advertising. We do not use your data to train machine-learning models.

Under UK GDPR and EU GDPR Article 6, our legal bases for processing personal data are:

• Contract performance. Most processing is necessary to provide the service you signed up for.
• Legitimate interest. Platform improvement, security, and fraud prevention.
• Consent. Marketing communications (if any) and non-essential cookies.
• Legal obligation. Tax record retention requirements in your jurisdiction.

We share data only with:

• Your assigned tax expert, and only the data relevant to your engagement.
• Supabase, our database and authentication provider (EU region, Ireland).
• Stripe, our payment processor.
• Resend, our transactional email provider.
• Vercel, our website hosting provider.
• Google, if you choose to log in via Google OAuth.

We do not share data with advertisers or data brokers. We may disclose data if required by law, court order, or to protect our legal rights.

Some of our processors (notably Vercel and Stripe) may transfer data outside the UK and EEA. Where this happens, we rely on appropriate safeguards including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

Database hosting (Supabase) is in the EU region (Ireland), so most structured personal data stays within the EEA.

We use the following safeguards:

• TLS encryption on all connections to and from the platform.
• Row-level security in our database, so an expert can only see data for clients explicitly assigned to them.
• Authentication via Supabase Auth with secure session management and short-lived tokens.
• Regular review of access controls and security configuration.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at hello@handytax.io.

We retain personal data for the following periods:

• Account data: while your account is active, plus 6 years after deletion to satisfy tax record retention requirements.
• Financial and tax data: a minimum of 6 years to satisfy HMRC and equivalent tax authority requirements in your jurisdiction.
• Messages: while the engagement is active and for a reasonable period after for dispute resolution.
• Technical and usage data: 12 months.

You can request deletion at any time. We will delete what we are legally permitted to delete and retain only what statutory record retention obligations require.

Under UK GDPR and EU GDPR you have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Delete your data, subject to legal retention requirements.
• Restrict processing.
• Receive your data in a portable format.
• Object to processing carried out under legitimate interest.
• Withdraw consent at any time, where consent is the legal basis.
• Lodge a complaint with the UK Information Commissioner’s Office (ICO) or the supervisory authority in your country.

To exercise any of these rights, email hello@handytax.io. We will respond within one month.

The Handy platform is not intended for users under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this privacy policy from time to time. Material changes will be communicated to you by email and reflected in the “last updated” date at the top of this page.

For any questions about this policy or how we handle your data, contact us at hello@handytax.io.

ICO registration: [to be completed].