Handback Privacy Notice

Effective: 1 August 2026 Last updated: 1 August 2026

This Privacy Notice explains how Handback collects, uses, discloses, and retains personal information. Handback is operated by an individual based in the United States (“Handback,” “we,” “us,” or “our”). The operator's legal name and address are available on request from support@tryhandback.com and will be published here once a business entity is registered.

1. Scope and our different privacy roles

This Notice applies to the Handback website, application, support communications, and related services.

Handback handles information in two different roles:

1. Account and service information. We determine how information about account holders, website visitors, and support contacts is used to operate, secure, and improve Handback. For that information, Handback generally acts as the business or controller where those legal terms apply.
2. Customer Content about tenants and properties. Landlords and property professionals decide what tenant and property information to upload and why. For that information, Handback generally acts as a service provider or processor on the customer's instructions, to the extent those legal terms apply. The customer remains responsible for its own notices, permissions, legal basis, and responses to tenants.

Our Data Processing Addendum provides more detail about Customer Content.

2. Information we collect

Information you provide directly

We may collect:

• Account information: name, email address, password or authentication information, organization or business name, and account preferences.
• Property and tenancy information: property and unit identifiers, addresses, tenancy dates, rent, deposit amounts, deadlines, and related records.
• Tenant information: names, email addresses, telephone numbers, tenancy dates, communications information, and other details entered by an account holder.
• Financial and operational records: rent records, deposit deductions, expenses, maintenance records, descriptions, estimates, and receipts. Handback does not collect rent or hold deposits.
• Photos and files: property-condition photographs, receipts, documents, and associated metadata.
• Generated content: statements, reports, calculations, notes, and records showing when an account holder says a document was sent.
• Support and feedback: messages, attachments, survey responses, and other information you send us.

Please do not upload unnecessary sensitive information or recognizable images of people. In particular, avoid Social Security numbers, government IDs, payment credentials, medical information, intimate material, information about protected characteristics, or photographs of children or other individuals.

Information collected automatically

When you use Handback, we may automatically receive:

• IP address;
• browser, device type, operating system, and app version;
• dates and times of access;
• pages or features used;
• referring page and general location inferred from IP address; and
• security, authentication, error, and activity logs.

Handback uses cookies or similar local-storage technologies that are necessary to authenticate users, maintain sessions, remember settings, prevent fraud, and secure the service. Handback uses no advertising cookies, no cross-site behavioral tracking, and no session-replay tools.

Sources

We receive information from account holders, their devices and browsers, people who contact us, and service providers that help operate Handback. Tenant information is ordinarily provided by the landlord or property professional using Handback, not by the tenant directly.

3. How we use information

We use personal information to:

• create and administer accounts;
• provide the features requested by account holders;
• store, organize, display, export, and delete Customer Content;
• generate documents, calculations, and reminders from user-provided information;
• authenticate users and protect accounts and the service;
• diagnose errors, maintain availability, and improve service quality;
• communicate about support, security, service changes, and legal matters;
• prevent fraud, abuse, discrimination, and unlawful activity;
• establish, exercise, or defend legal claims; and
• comply with applicable law and enforce our agreements.

We do not use tenant Customer Content to advertise to tenants, build advertising profiles, screen tenants, determine housing eligibility, or train a general-purpose artificial-intelligence model.

4. How we disclose information

We may disclose personal information in the following circumstances:

• At an account holder's direction: for example, when the user exports, downloads, prints, or shares a document.
• Service providers: vendors that provide hosting, storage, authentication, email delivery, monitoring, customer support, and security. They may process information only to provide contracted services and are required to protect it.
• Legal and safety reasons: when reasonably necessary to comply with law or legal process; protect rights, safety, accounts, and the service; investigate misuse; or establish, exercise, or defend legal claims.
• Business transaction: as part of a proposed or completed financing, reorganization, merger, acquisition, or sale of assets, subject to appropriate confidentiality and privacy protections.
• With permission: when the person responsible for the information directs or authorizes us to disclose it.

Our current operational service providers are:

• Hosting: Render Services, Inc. (Oregon, United States)
• Database and file storage: Render Services, Inc. — the database and every uploaded file sit on a Render persistent disk in the same region
• Authentication: built into the Handback application; no third-party identity provider
• Transactional email: Resend (Plus Five Five, Inc.), provisioned in Tokyo, Japan
• Monitoring and error reporting: none. Errors are detected inside the application and emailed to the operator through Resend
• Customer support: handled directly by Handback, by email

There are no analytics, advertising, or session-replay providers, no embedded third-party scripts, and no software development kits. The full list, with what each provider processes and where, is at tryhandback.com/subprocessors.

5. No sale or targeted advertising

Handback does not sell personal information for money. Handback does not sell or share Customer Content for cross-context behavioral advertising, and does not use tenant information for targeted advertising.

The website and the app contain no advertising pixels and no third-party analytics that use information across different businesses or services. If that changes, we will update this Notice and provide any legally required choices before enabling the new practice.

6. Retention

We retain account information and Customer Content while the account is open and as needed to provide Handback. Individual records may remain until the account holder deletes them or requests account closure.

Closing your account from Settings erases your records and your uploaded files from our active systems immediately. Where closure is instead requested by email, we act on it within 30 days of verifying the request. In either case we may retain limited information where reasonably necessary to:

• complete a requested transaction or export;
• maintain security, prevent fraud, or investigate misuse;
• comply with law or a valid legal process;
• maintain a record of a privacy request;
• resolve a dispute or enforce an agreement; or
• establish, exercise, or defend legal claims.

We keep a rolling set of 14 daily backups for disaster recovery, held on encrypted storage and reachable only by the operator. A deleted account therefore persists in those backups for about two weeks before the last copy ages out. Backups are never restored into a live account except to recover from a failure, and a deletion is reapplied if that happens.

When an account is deleted we keep one record of the deletion itself: the date, how many records and files were removed, and a one-way cryptographic hash of the email address. The hash lets us demonstrate that a particular deletion request was carried out; it is not reversible and the email address itself is not kept.

Handback writes no access logs of its own. Our hosting provider captures platform request logs on our behalf — the time, path, response status, and originating IP of each request — and discards them on a short rolling schedule set by that provider. Support emails are kept in the support mailbox for as long as needed to handle the matter and any follow-up. Records of legal or privacy requests are kept for as long as reasonably necessary to demonstrate compliance.

7. Security

We use administrative, technical, and organizational measures designed to protect personal information in light of its nature and the size of the service. In practice, these are:

• Encryption in transit. The site is served over HTTPS only, with HTTP redirected.
• Encryption at rest. The database and uploaded files sit on our hosting provider's encrypted storage.
• Password protection. Passwords are stored only as bcrypt hashes; we never see or store the password itself.
• Session security. Sessions are signed, HTTP-only cookies, marked secure in production.
• Separation between accounts. Every query and every file request is scoped to the signed-in account, and this is asserted by an automated test suite that runs before each release.
• Upload restrictions. Only image and PDF uploads are accepted, stored under randomly generated names outside the web root, and served only to the account that owns them.
• Rate limiting on sign-in, sign-up, and password-reset attempts.
• Location data removed. Photographs are re-encoded in your browser before upload, which discards GPS coordinates and other camera metadata.
• Daily backups, held on encrypted storage.
• Error alerts scrubbed of passwords, tokens, and cookies before they are sent.

We are a very small operation. There is no third-party analytics, advertising, or session-replay software anywhere in Handback, and no external script runs on the site.

No method of storage or transmission is completely secure. Users should use a unique password, protect their devices and accounts, and promptly notify us at support@tryhandback.com of suspected unauthorized access.

8. Your choices and privacy requests

Account holders may review or update certain information in the application. They may also request access, correction, a portable copy, or deletion of personal information associated with their account by emailing support@tryhandback.com.

We may need to verify the request using information reasonably related to the account. We will use verification information only to process the request. Authorized agents may make requests where permitted by law, subject to appropriate proof of authority and identity verification.

Because Handback does not sell or share personal information for cross-context behavioral advertising, we do not currently offer a sale/sharing opt-out. If our practices change, we will update this Notice and provide legally required choices before the change applies.

Depending on where you live and whether a particular law applies, you may have rights to access, correct, delete, or obtain a copy of personal information; receive information about its collection and disclosure; opt out of certain uses; limit certain uses of sensitive information; or appeal a denied request. You will not receive discriminatory treatment for exercising applicable privacy rights.

We aim to acknowledge and respond within the time required by applicable law. Where no particular statutory deadline applies, we aim to respond to a verified request within 45 days.

9. Requests from tenants and other people named in Customer Content

If a landlord entered your information into Handback, that landlord ordinarily determines why the information was collected and how it is used. Contact the landlord first to request access, correction, or deletion.

You may also contact us at support@tryhandback.com. We will attempt to identify the responsible account, explain our role, and either act on the account holder's instructions or direct the request to the account holder, as appropriate. We may be unable to disclose the identity of an account holder if we cannot verify the request or if disclosure would create a security, privacy, or legal risk.

Nothing in this section limits rights that apply directly against Handback under applicable law.

10. Children

Handback is not directed to children, and account holders must be at least 18. We do not knowingly collect personal information directly from children to create Handback accounts. Account holders must not upload recognizable images of children or information about minors unless strictly necessary, lawful, and permitted by these Terms. Contact support@tryhandback.com if you believe a child’s information was uploaded improperly.

11. United States service

Handback is currently designed for people managing residential rental property in the United States. Your account, your records, your uploaded photographs and our backups are stored in the United States (Oregon). One exception: the emails we send you are processed by our email provider in Japan, so the recipient address and the contents of those messages are handled there. If you access Handback from another country, your information may be transferred to and processed in that location, whose laws may differ from those where you live.

Do not use Handback for properties outside the United States unless we expressly state that the relevant jurisdiction is supported.

12. Changes to this Notice

We may update this Notice to reflect changes in the service, law, or our data practices. We will update the date above and provide reasonable notice of material changes. If a change materially expands how we use previously collected personal information, we will request consent where required rather than relying only on a posted update.

13. Contact us

Handback Privacy: support@tryhandback.com Support: support@tryhandback.com Security reports: support@tryhandback.com