Privacy Policy
Handled is a workplace tool: your employer (the company whose workspace you join) decides to use it and is the data controller for the work content inside it. Handled — operated by TON Creative Studios AB (org.nr 559029-8450), Västergatan 6D, 352 30 Växjö, Sweden — is the data processor for that workspace processing. It is separately controller for its business-contact administration, account security and applicable billing activities. A profile or directory record is not automatically repurposed for those separate activities.
What we store
- Account data: your name, email address, role, profile photo, and sign-in records.
- Several companies: one email address may hold a membership in more than one company. Each membership is a separate record inside its own company, and Handled stores no link between them. Which of your companies are signed in on a device is kept only on that device. When you sign in, the address is held for up to five minutes while you choose a company. Update emails name the company in the subject, and urgent phone notifications name it in the body, so that people in several companies can tell them apart; neither carries the text of the work.
- Work content: posts, replies, reactions, outcomes, attachments, and the subject map (subjects, owners, groups) of your company.
- Operational records: an audit log of actions (who invited, moved, completed what), delivery and notification records.
Why we may process it
For business-contact and account administration, and for protecting accounts and the service, the relevant basis is our legitimate interest in providing and securing Handled (Art. 6(1)(f)), subject to necessity and the individual’s rights and interests. This basis is limited to those purposes and does not cover unrelated uses. A contract with an employer does not by itself make its employees parties to that contract. Where an individual contracts directly with us, processing necessary for that contract may rely on Art. 6(1)(b). Records qualifying as Handled’s accounting information must be retained through the seventh year after the end of the calendar year in which the financial year ended, under Chapter 7, section 2 of the Swedish Bookkeeping Act (Art. 6(1)(c) GDPR). This does not extend that retention period to all workspace content. For workspace processing, your company determines the lawful basis and we act on its documented instructions.
Where it lives
The database and attachments are stored in the EU (Neon PostgreSQL and S3-compatible object storage). The web application is served by Vercel; the API runs on Railway in the EU (Netherlands), where it processes request content; until 22 September 2026 the API ran in the United States. Transactional and notification email is sent through SendGrid’s standard global service. Billing, where a company pays, is handled by Stripe, which processes the payer’s contact and payment details under its applicable payment and data-protection terms; we do not store full card numbers. Account-specific provider agreements and transfer safeguards remain under verification, as explained in the DPA. Public provider terms alone do not establish the arrangement applicable to our account. Ask for the available contractual information at hello@handledspace.com. See the sub-processor list.
We email you sign-in links, invitations, and — if enabled for you — update notifications. Update notifications contain workflow information and a link back to Handled, not post or reply text; every recipient is someone entitled to receive that update. Previously delivered emails are subject to the provider’s retention. Email subject lines never carry post content. You control update emails in Settings.
Connected services and AI
If your company connects Slack, Handled receives text explicitly submitted with /handled for a private preview. The sender chooses Public or Private before confirming creation and can request Urgent delivery under the existing service rules. Private posts are limited to their author and current subject owners; urgency does not expand access. Slack member emails match existing Handled members. Private routing confirmations link to the post; a completed request, question or decision can produce one generic private completion message to the original requester, subject to current access and an active connection. Handled stores the connected workspace credential encrypted. Administrators may also select channels for configured AI agents to retrieve limited recent messages for advisory notes on delivered Public Requests. Those notes follow the Handled item’s audience; Slack channel membership is not mirrored into their readership. Separately, a person may authorize their own Slack account and explicitly request research in Ask AI, optionally using a readable Handled item as context. This searches available older messages and limited thread context in administrator-approved channels that their Slack account can access. The personal credential is encrypted. Queries and retrieved excerpts may be processed by the configured AI provider to prepare private findings with source links. This personal research does not automatically post a reply or shared note; Handled saves questions, findings and supporting excerpts in the requester’s private encrypted research history for up to 30 days, with at most 50 saved searches per person and company. History is not company work or a shared search index. A person can explicitly review and share selected text into a request or reply; that shared text follows the work’s audience and retention rules. Existing automatic notes and agent execution records may retain excerpts. Provider processing and retention remain subject to the terms described in the DPA. No full Slack archive is imported and replies are not mirrored.
When enabled, Google Workspace and Microsoft 365 directory connections import profile information such as names, email addresses, department, status and source identifiers into a draft for administrator review. The directory connection does not import mailboxes or messages. Connection credentials are encrypted by the service. Applying setup and sending invitations are separate actions.
Ask AI can also retrieve bounded context from Handled work the requesting person is currently authorized to read. When separately configured and enabled, personal Microsoft research uses explicit read-only authorization: Outlook searches the connected person’s own work or school mailbox, and Teams research is limited by Handled to administrator-approved channels and the connected person’s access. Microsoft’s consent describes the provider permissions, which can be broader than the sources Handled uses. Directory authorization does not grant this content access. Research credentials are encrypted and are not supplied to model providers or background agents. Queries and authorized excerpts can be sent to the configured AI provider for private findings and suggested next steps. No email is sent, Teams message posted, or task completed by research. Completed searches are saved in private encrypted history for up to 30 days, with at most 50 searches per person and company. Only the requester can reopen or delete these searches. Current membership and source access are checked before saved content is returned; inaccessible or expired content is removed, and unverifiable content is withheld. Disconnecting removes the personal credential and invalidates associated saved research. Deactivation and account erasure remove the person’s research history. Content the person explicitly shares into Handled work follows that work’s normal audience and retention rules. These active-service controls do not change the DPA’s separate backup and provider-retention terms.
Optional subject-agent research
An administrator may permit sources for a subject agent, but each responsible person separately authorizes their own connected accounts for that agent and its displayed subjects. Eligible new work can then trigger bounded research using currently authorized subject context and connected-service excerpts. Configuring an agent or connecting an account does not authorize another person’s mailbox.
The resulting findings, supporting excerpts, source links and access metadata are encrypted and retained privately for that responsible person for up to 30 days. They are separate from ordinary Recent searches and shared agent execution records. The person’s export includes accessible preparation; company administrators do not receive another person’s private findings through company exports. Current ownership, consent and source access are checked before review and sharing. Revoking authorization, disconnecting or losing the required access invalidates preparation. A person can edit and explicitly share selected text into the request; that text then follows the request’s audience and normal work-record retention. Generic review notifications follow the person’s notification settings and contain no private findings. These active-service controls do not change the DPA’s separate backup and provider-retention terms.
Private preparation has a separate limit of 50 saved records. At capacity, older preparations already shared into work may be removed first. Minimal person, agent-run identifiers and timestamps prevent automatic repeat checks for the lifetime of the run; retry identifiers and fingerprints expire after 30 days. These operational records contain no source excerpts and are included in the person’s export and erasure controls.
Optional Outlook checks
Where available, you can separately enable scheduled checks of your own connected Outlook mailbox and choose a time, timezone and whether to receive a generic email when suggestions are ready. Connecting Outlook alone does not enable these checks. The service reads bounded recent Inbox and Sent Items content to identify possible commitments or requests for your review. Attachments are not downloaded. Relevant excerpts and message context are processed by the configured Anthropic model, including when you request a reply draft; the provider and transfer information below applies. These checks do not send mail from your mailbox, alter your mailbox or automatically create or complete company work.
These separately enabled checks store encrypted suggestion content, supporting excerpts, source links and identifiers so you can review them later. Suggestions are accessible only to the connected person within that company membership; company administrators do not receive another person’s mailbox suggestions through these tools. Pending suggestions expire after 30 days. Dismissal and expiry records use keyed fingerprints, without the message text, for up to 90 days to avoid repeating suggestions. Check records are retained for up to 90 days, and encrypted source cursors support later checks. You can pause checks, turn them off, or disconnect Outlook. Turning checks off removes pending suggestions, source cursors and dismissal fingerprints; disconnecting also removes the connection’s derived records. These are active-service controls; the DPA’s separate backup and provider-retention terms still apply.
You can export your own pending suggestions after source access is revalidated. Unverifiable evidence is omitted. Requested email drafts remain temporary unless you copy or save them yourself. Preparing a Handled request transfers only its suggested title to the normal composer: you review the text and audience before sending. Content you choose to publish becomes company work with that audience and the ordinary workspace retention rules. It is not removed when you disconnect Outlook.
Configured Anthropic processing can include routing, explicit conversation assistance, organization suggestions and hosted agent work. Routing sends the post text, subject names, aliases and brands, and recent human correction examples to one model call per post; the company can turn this off in Settings, after which post text is not sent to a model for routing. Separately requested assistance and research use the context described below. Model processing is currently in the United States under Anthropic’s terms, with no training on your data. Conversation assistance sends the readable conversation text for a summary or reply draft. Explicit organization suggestions send selected active profiles’ names, departments, status and reference IDs, and current subject names and aliases; email addresses are excluded from that model payload. Hosted agents receive scoped delegated context. Configured advisory notes may also use completed Public work in the same subject and approved recent Slack context. Explicit personal research sends the question and authorized retrieved excerpts for private findings and proposed next steps. See the AI purpose statement for boundaries and provider information.
What we never do
- No selling of personal data. No advertising inside the product, and nothing you write in Handled is ever shared for advertising.
- No tracking or third-party analytics of how you use the product. In the product we use only strictly necessary cookies and local storage to keep you signed in. The single exception is the sign-up signal described under “Advertising measurement” below.
- No reading of your company’s content by us except to operate the service, investigate abuse, or when you ask us to help.
Advertising measurement
Our public website, handledspace.com, uses the Meta pixel (Meta Platforms Ireland Ltd.) to measure which of our own advertisements lead to visits. It sets Meta advertising cookies and tells Meta that a page was viewed, that the sample on the page was tried, or that a sign-up link was clicked. It never passes on anything a visitor writes. Visitors in Europe are asked first and are not measured unless they agree; browsers that send Global Privacy Control or Do Not Track are not measured. If you then create a company in the web app, the web app tells Meta once that a sign-up was completed, and only if measuring was already allowed on the website for you. Nothing else from the product is reported: no page views, names, email addresses or content. The desktop and mobile apps never contact Meta.
Retention and your rights
Workspace personal data is deleted from the active Handled service within 30 days from account closure. An individual erasure request has a separate 7-day grace period before the erasure process runs. Removing access or deactivating a person does not itself delete company work. Routing learning examples expire after 90 days. Email sign-in links expire after 15 minutes; sessions expire after 30 days. Expiry ends their validity; scheduled cleanup removes expired link records after a further day and expired session records after a further seven days, subject to the cleanup job running. Handled-managed recovery archives have a separate 35-day limit after active-service erasure. Provider-held copies and operational records have category-specific periods: for example, SendGrid activity records have a published 37-day period, and ordinary Anthropic API inputs/outputs have a 30-day period with stated exceptions. See the DPA retention schedule for periods, triggers, exceptions and unresolved scope. There is no verified universal 35-day expiry across all providers. The new schedule applies to new agreements expressly accepting DPA version 3; publication does not amend previously accepted agreements or waive stronger rights. Services with unresolved retention scope require clarification before approval for new customer use involving real personal data.
Person erasure removes or replaces account identifiers and removes content covered by that process. Retained company work, including text supplied by other people, may still identify the person: it is not guaranteed to be anonymous. Your company must consider whether that personal data still needs to be retained. Contact your administrator or us for help with remaining content and applicable erasure instructions.
Authorized administrators can export records available to them as JSON from Settings. The export includes attachment metadata; attachment file contents require separate authorized downloads. Contact us if these tools do not fulfil an applicable access, return or portability request.
Handled responds to requests concerning data for which it is controller. For workspace processing, we forward requests to your company and assist under the DPA. You may request access, correction, erasure, restriction or portability, and object where the applicable conditions are met. Applicable response deadlines continue to apply: normally one month, with any permitted extension explained within that month. You may complain to a supervisory authority; in Sweden this is Integritetsskyddsmyndigheten (IMY). Contact hello@handledspace.com.
Your company is responsible for informing people about its workspace processing, including profiles obtained from a connected directory before an invitation. Handled provides information to support that notice. Required account details enable sign-in and workspace access; without them we cannot provide that account.
Security
Every company’s data is isolated with database row-level security. Sign-in tokens are single-use and stored only as hashes. Client connections use HTTPS, and the production database connection verifies TLS. Native saved workspace data uses authenticated encryption with keys held through the operating system vault. Browser storage is not encrypted by Handled at application level. Handled is not end-to-end encrypted.