Third-party service providers that process data on our behalf
Effective date:
Last updated:
Handlet Subprocessors
Handlet uses third-party service providers to run, secure and support the service. This page lists the providers that may process personal data for Handlet, what they do, what data they receive and where they are based.
Not every provider is used for every workspace. Some only apply when you switch on a feature or connect an account.
Where a provider processes personal data outside the UK, UK GDPR requires the transfer to be covered by a safeguard, such as UK adequacy regulations (which cover the EEA), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. To ask about the safeguard for a particular provider, email [email protected].
The links in the table go to each provider's own published privacy or data protection pages, for information.
Provider list
Provider
Purpose
Data categories
Location
Supabase
Database, sign-in and file storage.
Account data, workspace data, customer messages and records, files, audit records.
Hosting and delivery of the Handlet website and app.
Technical logs, request data, and data processed by the app while it runs.
USA company with a global network. International transfer. , .
AI Assistance: Handlet uses AI for intent recognition and, where enabled, drafts, summaries, quote support, social content and call assistance. AI output can be wrong and should be checked before use. Learn More
Global network. International transfer. Privacy, DPA.
Before certain AI processing, personal data is minimised or redacted on Handlet's own infrastructure.
Services you connect
Some services are not Handlet subprocessors because you choose them and connect them with your own account. Examples are Gmail, Outlook and Microsoft 365, WhatsApp, Facebook Pages and Google Business Profile. When you connect one, that provider processes data under its own terms and your authorisation.
Handlet helps you connect, sync and manage those accounts. You are responsible for following each provider's terms and for any notice you owe your own customers.
Connected CRM and job-management systems
If you connect a CRM or job-management system, Handlet imports the contact and job records you authorise so they can be matched to conversations and used to run your workspace. You choose and authorise the provider, and data is exchanged under your authorisation and the provider's own terms.
CRM provider
Purpose
Data categories
Squeegee, Cleaner Planner, Aworka, Get Soapy, RoundPro, Round Monster, Overture
Importing your customers' contact and job records for matching and service delivery.
These connectors are available now. A connector only runs when you connect it, and you can disconnect it at any time.
You are responsible for having a lawful basis to import your customers' data into Handlet and for any notice you owe them.
Copies of job records. Where a connector supports it, Handlet keeps its own copy of job records inside your workspace, so your history and reporting still work if the other system is offline, disconnected or deletes the record. Each record shows which system it came from. Once copied, it follows Handlet's retention rules and your deletion controls, set out in the Privacy Policy. Records copied from a connected system are used only within your own workspace, and Handlet does not write its own figures back into the connected system.
Advertising, search and analytics accounts you connect
If you connect an advertising, search or analytics account using your own login, Handlet accesses it on your instruction. These platforms work under their own terms with you, not as Handlet subprocessors.
Platform
Purpose
Data categories
Google Ads
Reading campaign performance for the accounts you choose and, where you switch it on, sending offline conversions back to your own Google Ads account.
Campaign, ad and keyword identifiers and performance figures. For conversions: click identifier, conversion action, time, order reference and value. No names, emails, phone numbers or addresses, hashed or otherwise, are sent.
Google Search Console
Reading a short-lived search performance snapshot for your site.
Top search queries and pages, clicks, impressions and position.
Google Analytics 4
Reading summary reports for the property you choose.
Summary report figures. Connecting it adds no scripts or cookies to your site or to Handlet.
Meta (Facebook) advertising
Recognising Meta click identifiers in enquiry links, to show where an enquiry came from.
Click identifier and campaign labels in the link. Handlet does not install a Meta pixel or send conversions to Meta.
Google API Limited Use. Handlet's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs, and anything derived from it, is used only to provide or improve features in the workspace that granted access. It is not used for advertising, not passed to advertising platforms, data brokers or resellers, not used to train general AI models, and not used in any cross-customer benchmark.
Your responsibilities. You control measurement on your own website and your own platform accounts. You are responsible for the consent your website collects, the notice you give visitors and following each platform's terms. Handlet records the consent state it is given. If it is unknown, Handlet shows it as unknown and does not treat it as consent.
UK public data services
Some features use UK public registers. These are independent controllers working under their own terms, and data stays in the UK.
Service
Purpose
Data categories
Companies House
Company lookup during setup.
Company name, number and registered address (for sole traders this can include a personal name or address).
EPC Register
Energy performance details used in quotes, where switched on.
The property reference or postcode, and that property's energy performance data.
Energy performance data from the EPC Register contains public sector information licensed under the Open Government Licence v3.0.
Changes to this list
We update this page when we add or remove a provider, when a provider starts receiving a new type of personal data, or when a provider's location changes.
For a new or replacement subprocessor that will process your customer communication data, we will give at least 30 days' notice under the Data Processing Addendum, unless an urgent security, legal or service issue makes that impractical. You can object on reasonable data protection grounds using the process in the Data Processing Addendum.