Privacy Policy

Effective date: June 25, 2026

This Privacy Policy explains how Handles Itself ("we," "us," or "our"), operated by Handles Itself LLC, a California limited liability company, collects, uses, and protects information when you use handlesitself.com (the "Site"). We are based in the United States. We practice data minimalism: we do not use third-party analytics, advertising pixels, or behavioral-tracking services of any kind.

This policy is reviewed and updated at least once every twelve (12) months and whenever our practices change. The current version takes effect on the Effective Date shown above. If you have any questions or concerns about our privacy practices, email us at info@handlesitself.com.

Notice at Collection

This section is our California "Notice at Collection." It tells you, at the point you give us information, what we collect, why, and what we do with it. The full details appear in the sections that follow.

• What we collect: the contact-form information you provide (first name, last name, phone number, city, the service you select ("what you need"), and optionally your line of business), and limited marketing-attribution information captured when you submit the form (the page or section you submitted from, any marketing campaign tags in your link, and your browser's referrer, if provided). "Attribution" simply means understanding which of our pages or ads brought you to us.
• Why we collect it: to respond to your inquiry, to contact you about our services, to manage and follow up on your request, and to understand which of our pages and campaigns reached you.
• Sensitive personal information: we do not collect sensitive personal information (such as government identification numbers, financial account credentials, precise geolocation, health information, or biometric data).
• Sale or sharing: we do not sell your personal information and we do not share it for cross-context behavioral advertising (tracking you across other companies' websites to target ads), as those terms are defined under California law.
• Retention: We keep personal information for as long as needed to respond to and manage your inquiry, and then for up to 24 months after our last contact, after which we delete it, unless a longer period is required by law.

For the complete picture, please read the rest of this Privacy Policy below, including the Your California Privacy Rights (CCPA/CPRA) section.

1. Information we collect

We practice data minimalism. We do not use third-party analytics, advertising pixels, or behavioral-tracking services of any kind.

Information you give us through our contact form:

• First name (required)
• Last name (required)
• Phone number (required)
• City (required)
• The service you need (selected from a short list — for example automation, a website, private AI, or lead messaging)
• Line of business (optional)

Information automatically captured when you submit the form, used for attribution (understanding which of our pages and campaigns brought you to us): the page or section you submitted from ("source route," meaning where on our Site you were when you submitted); marketing campaign tags in the link you arrived through, if any (utm_source, utm_medium, utm_campaign); and the referring website address (referrer), if available — either from your browser or from the request your browser sends when you submit.

We do not store your IP address in our contact-form database, and we do not use IP addresses, geolocation, or device fingerprinting for analytics, advertising, profiling, or visitor tracking. (Our hosting and security providers may process IP addresses in their server logs as a normal part of operating and protecting the Site.) We do not collect any sensitive personal information.

2. How we use information

We use the information above to respond to your inquiry and contact you about our services, to manage and follow up on leads in our internal customer system, and to understand which marketing efforts are working (attribution, meaning which of our pages or ads brought you to us). We process this information to respond to a request you initiated and for our legitimate business interest in marketing attribution and lead management. We do not use your information for automated decision-making, and we do not profile you in a way that produces legal or similarly significant effects.

3. Cookies, local storage, and tracking technologies

We do not use tracking or advertising cookies, and there are no third-party analytics, advertising, or behavioral-tracking services on the Site. We rely only on limited infrastructure providers to host and operate the Site — Vercel, Supabase, and Google Fonts (see "Who we share information with"). We use the following first-party browser storage only:

• Local storage stores the marketing-attribution data (campaign tags and referrer) described above so that, if you submit our form, we can attribute your inquiry correctly. It also stores your accessibility preferences (such as larger text or reduced motion) if you use our on-page accessibility tools. This data stays in your browser; the attribution data is only sent to us when you submit the form. If your browser blocks it, the Site still works.
• Admin login session — when our own team signs in to the private admin area, the login session is stored in the browser's local storage by our authentication provider (Supabase). This applies only to our team's logins and is not created for ordinary visitors.

4. Do Not Track and Global Privacy Control (GPC)

Some browsers offer a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal. These signals are designed to let you opt out of the sale or sharing of your personal information and of cross-site tracking. Because we do not track visitors across third-party websites or over time, and we do not sell or share personal information, there is nothing for these signals to opt out of. We therefore do not currently change our behavior in response to DNT or GPC signals.

5. Who we share information with

We do not sell, rent, or share your personal information for advertising. We disclose it only to the infrastructure vendors that operate our Site, acting on our behalf as service providers under written agreements that limit them to providing services to us:

• Supabase — database and authentication hosting.
• Vercel — website hosting.
• Google Fonts — serves the typeface used on the Site. When your browser loads the font, it sends Google a standard web request (which includes your IP address and browser type) as a normal part of delivering the font. We do not use Google Fonts for analytics or advertising, and we send it none of your contact-form information.

We may also disclose information if required by law, to respond to lawful requests, to protect our legal rights, or in connection with a merger, acquisition, or sale of assets. We do not disclose your personal information to any third party for that third party's own marketing or advertising purposes.

6. Where data is stored and how long we keep it

Submitted information is stored in a Supabase (PostgreSQL) database in the United States. Access is restricted to authenticated members of our team through a password-protected admin system.

We keep personal information for as long as needed to respond to and manage your inquiry, and then for up to 24 months after our last contact, after which we delete it, unless a longer period is required by law. We do not retain personal information longer than is reasonably necessary for the purposes described in this policy. Attribution data held in your browser's local storage remains there until your form submission or until you clear it.

7. Data security

We use reasonable administrative and technical safeguards appropriate to the limited and non-sensitive nature of the information we collect. These include encryption in transit, access controls that restrict personal information to authenticated team members through a password-protected admin, and reliance on established infrastructure providers (Supabase and Vercel) for hosting and storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affecting your personal information occurs, we will notify affected individuals and the appropriate authorities as required by applicable law.

8. Your California Privacy Rights (CCPA/CPRA)

This section provides the disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), and applies to California residents. The rights and disclosures here supplement the rest of this policy.

Categories of personal information we collect. We collect the following statutory categories of personal information, all of which you provide or which is generated when you submit our contact form:

• Identifiers — your first name, last name, and phone number.
• Customer records / contact information — your city and, if you choose to provide it, your line of business.
• Commercial information — the service you selected on the form ("what you need") and the fact that you inquired about our services.
• Internet or other electronic network activity (limited), which reflects your interaction with our Site — the page or section you submitted from ("source route"), marketing campaign tags from your link (utm_source, utm_medium, utm_campaign), and your browser's referrer, if provided. We do not store your IP address in our contact-form database or use IP, geolocation, or a device fingerprint for analytics, advertising, profiling, or tracking (our hosting and security providers may process IP addresses in their server logs to operate and protect the Site).

We collect this information directly from you when you submit the contact form, and automatically (for the attribution items) at the moment you submit the form. We do not collect sensitive personal information. Because we do not use sensitive personal information beyond any purpose that would require it, we are not required to offer, and we do not offer, a separate "Limit the Use of My Sensitive Personal Information" option.

Business and commercial purposes. We collect and use each category above to: (1) respond to your inquiry and contact you about our services; (2) manage and follow up on your request as a lead in our internal customer system; and (3) understand which of our pages and marketing campaigns reached you (attribution, meaning which of our pages or ads brought you to us). We use the limited internet-activity information solely for attribution, not for advertising or cross-site tracking.

Disclosures for a business purpose. We disclose identifiers, customer records, commercial information, and the limited attribution information to our service providers (Supabase and Vercel) for the business purpose of hosting and operating the Site and storing personal information. These providers are contractually limited to acting on our behalf.

No sale and no sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising (tracking you across other companies' websites to target ads), as "sell" and "share" are defined under the CCPA, and have not done so. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. Because we do not sell or share personal information, we are not required to provide a "Do Not Sell or Share My Personal Information" link, and there is no sale or sharing for you to opt out of.

Your rights. Subject to the CCPA and its exceptions, California residents have the right to:

• Know / Access — request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclosed it.
• Delete — request that we delete personal information we collected from you, subject to legal exceptions. We will also direct our service providers to delete it where required.
• Correct — request that we correct inaccurate personal information we hold about you.
• Opt out of sale or sharing — although we do not sell or share personal information, this right is available to you as a matter of law.
• Non-discrimination — you will not receive discriminatory treatment for exercising any of these rights (see below).

How to exercise your rights. Because we operate exclusively online and have a direct relationship with you, you may submit a request to know, delete, or correct by emailing us at info@handlesitself.com. Please tell us which right you wish to exercise and provide enough detail for us to respond.

Verification. To protect your information, we will verify your identity before responding to a request to know, delete, or correct. We do this by matching the information in your request (such as your name and phone number) against the information we hold about you, and we may ask for additional information to confirm your identity. We will not use verification information for any purpose other than confirming your identity. If we cannot verify you or must deny a request, we will explain why; you may respond to that decision or appeal it by replying to our email, and we will reconsider in good faith.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof that you gave them signed, written permission to act for you, and we may require you to verify your own identity directly with us or to confirm that you authorized the agent. These additional steps do not apply where you have provided the agent with a valid power of attorney under California Probate Code sections 4000 to 4465.

Non-discrimination. We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you a different price, or provide you a different level or quality of service because you exercised your rights. We do not offer financial incentives in exchange for personal information.

Retention. The categories above are retained as described in "Where data is stored and how long we keep it": We keep personal information for as long as needed to respond to and manage your inquiry, and then for up to 24 months after our last contact, after which we delete it, unless a longer period is required by law.

9. Other U.S. state privacy rights

Residents of other U.S. states that have comprehensive privacy laws may have similar rights to access, delete, and correct their personal information, to obtain a copy of it, and to opt out of its sale or of targeted advertising. We do not sell personal information and do not use it for targeted advertising. To exercise any available right, or to appeal a decision on a request, email us at info@handlesitself.com, and we will respond as required by applicable law.

10. Your choices and requests

No matter where you live, you can reach us at info@handlesitself.com to ask about your information. See the sections above for the specific rights that apply to you.

11. Children

The Site is intended for businesses and is not directed to anyone under 16. We do not knowingly collect personal information from anyone under 16. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. If you believe a person under 16 has provided us with personal information, contact us at info@handlesitself.com and we will delete it.

12. Changes to this policy

We review this policy at least every 12 months. If we make material changes, we will post the updated policy on this page and update the Effective Date above. Significant changes will be reflected here before they take effect; we will not change these terms silently.

13. Contact

Handles Itself LLC — info@handlesitself.com. Please use this email address for any privacy question, to exercise a privacy right, or to appeal a decision on a request.

This Privacy Policy is provided for transparency about how we handle your information. It is not legal advice. If you have questions, want to exercise a privacy right, or need this policy in another format, contact Handles Itself LLC at info@handlesitself.com.