Privacy policy

Last updated 17 October 2026

This policy explains how Pure Digital Limited, a company registered in Ireland (company number 772956) with its registered office at 108 Ash House, Red Arches Drive, Dublin 13, D13 X2KD, Ireland ("we", "us") handles personal data when you visit www.handl.ie, use Handl on the web or in the Handl mobile apps, or contact us. We keep it short and specific to what Handl actually does.

1. Who we are and our two roles

• Controller for your account data. We are the controller for personal data about you as a Handl user: your account, billing, support conversations and how you use the Service.
• Processor for your customers' data. The details you put into Handl about your own customers, sites and staff belong to you. You are the controller and we process them on your behalf under the data processing terms in section 8 of our terms of service. If you're one of our users' customers, please contact the business you dealt with about your data.

Contact for privacy questions and requests: info@puredigital.ie, or write to Pure Digital Limited, 108 Ash House, Red Arches Drive, Dublin 13, D13 X2KD, Ireland.

2. What we collect and why

We don't sell personal data, we don't use it for advertising, and we don't make decisions about you based solely on automated processing.

The mobile apps use the camera and photo library only when you choose to add a photo, and don't request your location.

3. Cookies and similar technologies

We don't use analytics, advertising or tracking cookies. We use only what's strictly necessary to run the Service:

• Sign-in session stored in your browser's local storage by our authentication provider, so you stay signed in.
• handl_app cookie (value "1", kept for up to a year): tells our website that this browser has a Handl session, so www.handl.ie opens the app instead of the home page. It contains no personal data.
• Small preferences such as light or dark mode, stored in local storage.

Because these are strictly necessary, we don't ask for consent. If we ever add optional analytics, we'll update this policy and ask first where required.

3a. Service providers (sub-processors)

We use these providers to run Handl. Each processes data only on our instructions under a data processing agreement.

• Supabase: database, sign-in and file storage. Data is stored in the EU (AWS Ireland region).
• Vercel: hosting for the website and application servers. Application requests are processed in the EU (Dublin, Ireland region); the website is delivered through Vercel's global network.
• Stripe: subscription billing and card payments, including payments you take from your customers through Stripe Connect.
• Resend: sending service emails and the quotes, invoices and documents you choose to email.
• Xero: only if you connect your Xero account, to sync contacts and invoices you choose to send.
• OpenAI: only when you use an AI feature on the Master plan. SmartRead sends the bill or receipt photo you choose to scan, and SmartWrite and AI service reports send the text and job details needed to draft the wording. OpenAI processes this through its API on our behalf and doesn't use it to train its models.

If we add a provider, we'll update this list before it processes your data.

4. International transfers

Your stored data stays in the EU, and our application servers run in Ireland. Some providers, such as Stripe, Resend and OpenAI, and Vercel for support and network operations, may process data in the United States or elsewhere outside the European Economic Area. Where they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as provided in those providers' data processing terms.

5. How long we keep data

• While your account exists, including if it becomes read-only after a trial or cancellation, we keep your account and content so you can come back to it.
• When you delete your account, your account, content and uploaded files are deleted straight away, your sign-in is removed and any subscription is cancelled. Copies in backups are overwritten within our providers' backup cycles.
• Billing records (invoices and payment records held by Stripe and in our accounts) are kept for six years, as Irish tax law requires.
• Server logs and crash reports are kept only as long as needed for security and fixing problems, normally no more than 90 days.
• Support messages are kept for up to two years after the conversation ends.

6. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting and storage providers. Access to each account's data is limited to that account, staff access is restricted to what's needed for support and operations, and private customer links (quote and handover portals) use unguessable tokens. No system is perfectly secure; if a breach affects your data, we'll tell you and the Data Protection Commission where the law requires.

7. Your rights

Under the GDPR you can ask us for access to your personal data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. You can delete your account yourself at any time on the delete account page or in the mobile app, and export your client list from Handl. To make any other request, email info@puredigital.ie; we'll reply within one month.

You can complain to the Data Protection Commission (www.dataprotection.ie), 21 Fitzwilliam Square South, Dublin 2, D02 RD28. We'd appreciate the chance to sort it out first.

8. Children

Handl is a business service for people aged 18 and over. We don't knowingly collect data about children as users.

9. Changes

We'll update this page when how we handle data changes, and change the date at the top. For significant changes we'll also tell users by email or in Handl.