Third-party service providers that process data on our behalf
Effective date:
Last updated:
Handlet Subprocessors
Handlet uses third-party service providers to run, secure and support the service. This page lists the providers that may process personal data for Handlet, what they do, what data they receive and where they are based.
Not every provider is used for every workspace. Some only apply when you switch on a feature or connect an account.
Where a provider processes personal data outside the UK, UK GDPR requires the transfer to be covered by a safeguard, such as UK adequacy regulations (which cover the EEA), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. To ask about the safeguard for a particular provider, email privacy@handlet.ai.
The links in the table go to each provider's own published privacy or data protection pages, for information.
Provider list
Provider
Purpose
Data categories
Location
Supabase
Database, sign-in and file storage.
Account data, workspace data, customer messages and records, files, audit records.
Hosting and delivery of the Handlet website and app. Where you buy website hosting, it also hosts your website and its previews, runs your domain's DNS if you ask Handlet to, counts your website's visitors without cookies, and builds changes made by Handlet's AI in an isolated sandbox.
AI Assistance: Handlet uses AI for intent recognition and, where enabled, drafts, summaries, quote support, social content and call assistance. AI output can be wrong and should be checked before use. Learn More
Technical logs, request data, and data processed by the app while it runs. For a hosted website: its files and content, visitors' request data (such as IP address and browser) in hosting logs, page view counts, and your domain's DNS records.
USA company with a global network. International transfer. Privacy, DPA.
GitHub
Storing the code and change history of websites Handlet hosts, where you buy website hosting.
Your website's code and content, including the business details it shows, and the history of changes to it.
AI model provider used to prepare draft replies and suggestions, and to make changes you ask for to a website Handlet hosts.
Message and call content (minimised where possible), business context and AI outputs. For website changes: the change you asked for, with personal details removed before it is sent, and your website's files, including the business details it shows.
USA, and the location of the model provider used. International transfer. Privacy.
Vapi
Phone answering and call assistant, where switched on.
Call audio, recordings, transcripts, caller phone numbers and call details.
Global network. International transfer. Privacy, DPA.
Before certain AI processing, personal data is minimised or redacted on Handlet's own infrastructure.
Services you connect
Some services are not Handlet subprocessors because you choose them and connect them with your own account. Examples are Gmail, Outlook and Microsoft 365, WhatsApp, Facebook Pages and Google Business Profile. When you connect one, that provider processes data under its own terms and your authorisation.
Handlet helps you connect, sync and manage those accounts. You are responsible for following each provider's terms and for any notice you owe your own customers.
Connected CRM and job-management systems
If you connect a CRM or job-management system, Handlet reads the contact and job records you authorise so they can be matched to conversations and used to run your workspace. Where you choose, it also sends records to that system, as the table below says. You choose and authorise the provider, and data is exchanged under your authorisation and the provider's own terms.
CRM provider
Purpose
Data categories
Aworka, RoundPro, Squeegee
Reading your customers' contact and job records to match them to conversations. Where you choose, sending customers, accepted jobs, quote estimates, contact changes or payments you record to that CRM.
Customer names, email addresses, phone numbers, addresses, job and round details, quote estimates, payment records you enter (Aworka only).
These three connectors are available now. You can also import a file exported from Cleaner Planner; that file comes from you, not from Cleaner Planner. Get Soapy, Round Monster and Overture cannot be connected yet. A connector only runs when you connect it, and you can disconnect it at any time.
You are responsible for having a lawful basis to import your customers' data into Handlet and for any notice you owe them.
Copies of job records. Where a connector supports it, Handlet keeps its own copy of job records inside your workspace, so your history and reporting still work if the other system is offline, disconnected or deletes the record. Each record shows which system it came from. Once copied, it follows Handlet's retention rules and your deletion controls, set out in the Privacy Policy. Records copied from a connected system are used only within your own workspace. Apart from the records you choose to send, Handlet does not write its own figures, such as revenue attribution, back into the connected system.
Advertising, search and analytics accounts you connect
If you connect an advertising, search or analytics account using your own login, Handlet accesses it on your instruction. These platforms work under their own terms with you, not as Handlet subprocessors.
Platform
Purpose
Data categories
Google Ads
Reading campaign performance for the accounts you choose and, where you switch it on, sending offline conversions back to your own Google Ads account.
Campaign, ad and keyword identifiers and performance figures. For conversions: click identifier, conversion action, time, order reference and value. No names, emails, phone numbers or addresses, hashed or otherwise, are sent.
Google Search Console
Reading a short-lived search performance snapshot for your site.
Top search queries and pages, clicks, impressions and position.
Google Analytics 4
Reading summary reports for the property you choose.
Summary report figures. Connecting it adds no scripts or cookies to your site or to Handlet.
Meta (Facebook) advertising
Recognising Meta click identifiers in enquiry links, to show where an enquiry came from.
Click identifier and campaign labels in the link. Handlet does not install a Meta pixel or send conversions to Meta.
Google API Limited Use. Handlet's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs, and anything derived from it, is used only to provide or improve features in the workspace that granted access. It is not used for advertising, not passed to advertising platforms, data brokers or resellers, not used to train general AI models, and not used in any cross-customer benchmark.
Your responsibilities. You control measurement on your own website and your own platform accounts. You are responsible for the consent your website collects, the notice you give visitors and following each platform's terms. Handlet records the consent state it is given. If it is unknown, Handlet shows it as unknown and does not treat it as consent.
UK public data services
Some features use UK public registers. These are independent controllers working under their own terms, and data stays in the UK.
Service
Purpose
Data categories
Companies House
Company lookup during setup.
Company name, number and registered address (for sole traders this can include a personal name or address).
EPC Register
Energy performance details used in quotes, where switched on.
The property reference or postcode, and that property's energy performance data.
Energy performance data from the EPC Register contains public sector information licensed under the Open Government Licence v3.0.
Changes to this list
We update this page when we add or remove a provider, when a provider starts receiving a new type of personal data, or when a provider's location changes.
For a new or replacement subprocessor that will process your customer communication data, we will give at least 30 days' notice under the Data Processing Addendum, unless an urgent security, legal or service issue makes that impractical. You can object on reasonable data protection grounds using the process in the Data Processing Addendum.