Privacy statement
What we collect, why, how long we keep it, and who else touches it.
1. Who is responsible
Hands is a Kijko product operated by ProcesGroei, a sole proprietorship under Dutch law, registered with the Dutch Chamber of Commerce under number 97440515, VAT number NL005270665B95. Contact: [email protected]. Postal address: not published yet.
For your account and billing data, ProcesGroei is the controller. For the files and content inside your Hand's sandbox, ProcesGroei acts as a processor on your behalf: you decide what goes in there and why. See the data processing terms.
2. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Email address, and name if you give one | To create your account, sign you in, and send essential trial-expiry and service messages about your Hand | Performance of the contract |
| Email address submitted through the social-community waitlist | To send you an invitation or launch update when the Hands community opens | Your consent, which you can withdraw at any time |
| Password, stored as a scrypt hash with a per-user salt | To sign you in. The password itself is never stored. | Performance of the contract |
| Google account identifier, if you sign in with Google | To recognize you on your next visit | Performance of the contract |
| The name and avatar you give your Hand, and its machine name | To provision and find your sandbox | Performance of the contract |
| Your Hand's connector URL and access key | To let your AI reach your Hand, and only yours | Performance of the contract |
| Your encrypted Nango Environment API key, selected connection metadata and action allowlists, plus confirmation-proposal inputs and results, only if you enable Nango BYOK | To route actions from your Hand through the Nango account you own and execute an approved proposal exactly once | Performance of the contract and processed on your instructions |
| Whatever you or your Hand put on the sandbox | It is your workspace; we do not read it | Processed on your instructions |
| Subscription status and payment events from Stripe | To know whether your Hand should be running | Performance of the contract, and a legal obligation for invoicing |
| Server logs, kept short | To find faults and abuse | Legitimate interest in a service that works and is not misused |
There is no analytics, no advertising and no tracking. We do not build a profile of you, and there is no automated decision-making with legal effect.
3. Card details
We never receive them. When you open Stripe's hosted checkout or customer portal, card data goes straight to Stripe. We send Stripe your account name, email address and an internal account identifier, and receive the subscription identifiers, status and payment events needed to run your plan. The 30-day one-Hand trial does not require a payment method. Stripe receives card details only when you choose to activate a paid plan or add a second or third Hand.
4. Who else processes your data
Your Hand runs on Fly.io's Sprites platform, whose object storage sub-processor Tigris is located in the United States. Sprites are placed automatically in the nearest Fly.io region; there is currently no way to pin one to the EU, so we cannot promise that your data stays within it. If you enable Nango BYOK, your Hand sends the actions and data you request to Nango under the Nango account and agreement you control; Hands stores the Environment API key encrypted and never shows it again after submission. The full list, and the basis for those transfers, is on the sub-processors page.
5. How long we keep it
- While your subscription runs — your account, Hands and sandbox contents are kept.
- When you delete one Hand — its sandbox, files, checkpoints and stored connector credentials are removed immediately. Its Nango bindings and their confirmation proposals and results are removed too. Where supported, we also ask the provider to revoke the authorization.
- When you disconnect Nango BYOK — the encrypted Environment API key, all Nango bindings, and their confirmation proposals and results are removed from the central Hands account state immediately, and every Nango runtime capability is revoked immediately. Derived runtime configuration copies on individual Hands are removed during synchronization/reconciliation and are not guaranteed to disappear from every runtime instantly. Data retained by Nango remains governed by your own Nango account and agreement.
- Nango confirmation proposals — execution and replay expire 15 minutes after preparation. A locked cleanup pass removes their stored input and result after expiry; it runs every minute while the service is running and again at startup after an interruption. Removing the binding, rotating the Environment API key or disconnecting Nango removes them earlier. Evaluation usage counters contain counts only and remain for the active trial window when Nango is disconnected or reconnected.
- After a trial expires or paid access ends — access is blocked and the remaining Hand services are paused; their sandbox data stays stored. After a failed renewal, a 7-day payment grace period applies first.
- Until deletion — we keep remaining sandboxes and checkpoints until you delete each Hand or ask us to delete your account. There is currently no automatic deletion after a fixed period.
- When you permanently delete your account — your account and every remaining Hand, sandbox, file, checkpoint and stored connector credential are removed immediately. Invoicing records that we are legally required to keep remain restricted to that purpose.
- Social-community waitlist — kept until the community opens and for no more than three months after the first invitation. We remove it sooner whenever you ask.
- Invoicing data — kept for seven years, because Dutch tax law requires it.
- Server logs — kept short and then rotated away.
6. Cookies
One cookie, holding a signed session so you stay logged in. No tracking cookies. Details on the cookies page.
7. Your rights
You can ask for access, correction, deletion, restriction and portability, and you can object to processing based on legitimate interest. From the account view in your console you can download a portable copy of your account metadata or permanently delete your full account yourself.
For content inside your sandbox that we process on your instructions, ask us and we will act on it — but you are the one who decides what happens to it.
If you think we are getting this wrong, tell us first. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Security
Each Hand is a hardware-isolated virtual machine with its own access key; nothing is shared between customers. Passwords are hashed with scrypt. Sessions are signed and expire. Traffic is TLS-only.
If you find a hole, the contact page explains how to report it.
9. Changes
Material changes are announced by email before they take effect. The date at the top always reflects the current version.