Privacy

Handled Locator is a store locator you embed on your own website. This page explains what we collect from two different groups of people: customers, who have an account with us, and visitors, who load a locator on a customer's site. The answers are very different.

If you are a visitor to a site using our locator

We do not set cookies on you, we do not track you across sites, and we do not build a profile of you. Loading a locator sends the request our public API needs to answer it: the site identifier of the locator, and the network-level information any web request carries.

If you search by place name, the text you type is sent to a geocoding service to turn it into coordinates. If you allow the browser's location prompt, your coordinates are used in your browser to sort results by distance. We do not store either.

The map itself is served by the site owner's own Mapbox or Google Maps account, under that provider's privacy policy rather than ours.

If you are a customer

We collect and store:

• Your account: email address, name, and the business details you enter.
• Your locations: everything you import or type. Addresses, coordinates, opening hours, contact details, categories and any custom fields.
• Your settings: layout, styling, labels and the map key you provide.
• Product usage: which setup steps you have completed and aggregate counts of how often your locator was loaded. Deliberately narrow: no page URLs, no raw referrers and no free-text campaign data reach your account record.

When you connect Google Sheets

Connecting Google Sheets is optional and separate from signing in to Handled Locator. Google asks you to choose a spreadsheet, and the permission is limited to files you deliberately select for use with Handled. We receive the selected file's identifier, its sheet names and the location data in the selected sheet so we can show a change preview and perform the sync you configure.

Handled requests Google's per-file drive.file permission. Although Google describes that permission as allowing management of selected files, Handled only reads the spreadsheet and never writes back to it. We do not browse other files in your Drive, use Google user data for advertising, or use it to train AI models.

We keep an encrypted Google refresh token for scheduled syncs. Disconnect Google in the Data page to revoke Google access and delete that token, the saved source connection and its synchronization history. Deleting your Google connection does not delete the locations that were already imported into your Handled account.

Handled Locator's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

When you connect an AI assistant

You can connect Handled Locator to an AI assistant such as Claude or ChatGPT, so you can manage your locator by chatting instead of using the dashboard. This is optional, off by default, and separate from signing in.

Connecting is a deliberate act with a consent screen: you sign in to Handled Locator, see which application is asking and which account it would reach, and approve it. Approving grants that one application access to that one locator, and nothing else. It cannot reach another account, your billing details, or your password.

Once connected, the assistant can:

• Read and change your locations: names, addresses, coordinates, opening hours, contact details, categories and custom fields.
• Read and change your locator's configuration: settings, colours, fonts, layouts and the visitor-facing wording on your site.
• Read your embed code and your public site identifier.

It cannot read your billing details, your team members, your map provider key, or anything belonging to another account.

The important consequence: whatever the assistant reads is sent to whoever operates it, and handled under their privacy policy rather than ours. If you connect Claude, your location and configuration data reaches Anthropic; if you connect ChatGPT, it reaches OpenAI. We are not told what you asked or what the assistant said back. Read the policy of the assistant you connect, because that is where your data goes.

We store the connection itself: which application you approved, which account it reaches, and when it was last used. We store a one-way hash of the access credentials rather than the credentials, so a copy of our database is not a working key to your locator.

Disconnect at any time, from the client's own settings or from Developer tools in your dashboard. Access stops on the next request. Disconnecting removes access only: your locations, settings and history are untouched.

Who else processes it

• Supabase: database, authentication and file storage.
• Amazon Web Services: hosting and content delivery.
• PostHog: marketing-page analytics, session replay of this marketing site, and the limited setup milestones described below. Dashboard contents and form values are excluded, and the dashboard itself is never replayed.
• tawk.to:the live chat on this marketing site. If you open it, the conversation and the page you were on are recorded and stored by tawk.to. It is not on the dashboard, and it is never loaded on a customer's own site.
• Square: subscription payments. Card details go to Square directly and we never receive or store them.
• Mapbox or Google Maps: maps and geocoding, on the key you supply.
• Google Workspace: authorization, file selection and read-only access to a Google Sheet you connect.
• Google Ads: measuring which adverts lead to a trial. It receives the click identifier from the advert you arrived on and a signal that a trial started. It does not receive your name, email address, or anything from your locator.

We do not sell your data and we do not use your locations to build anything other than your locator. We do share one thing with an advertising platform: if you reached us from a Google advert, Google Ads is told that the click led to a trial, so we can tell which adverts are worth paying for. That signal carries no personal detail and nothing from your locations.

How long we keep it

For as long as your account is open. A disconnected or expired assistant connection is marked revoked and stops working immediately; the record of it is kept as an audit trail and removed with the rest of your data when you close your account.

For as long as your account is open. Delete a location and it is soft-deleted first so you can undo the mistake, then removed. Close your account and we delete your data within 30 days, apart from what we have to keep for tax and accounting records.

Where it lives

Our servers and database are in the United States. If you are outside the US, using Handled Locator means your data is transferred there and handled under US law. Location data is public information about your business that you are publishing on your own website, but your account details are not, and this is where they sit.

How we protect it

Everything travels over HTTPS. Passwords are handled by Amazon Cognito and we never see them. API keys and assistant connections are stored as one-way hashes rather than as usable credentials, so a copy of our database is not a working key to anyone's locator. Access to production data is limited to what the application needs to answer a request.

We are a small team and we will not pretend to certifications we do not hold. No system is perfectly secure. If you find a problem, email hello@handledlocal.com and we will act on it.

When we would hand it over

We do not sell your data and we do not share it for anyone else's advertising. We would disclose it in three situations: when the law requires it and we are satisfied the request is valid, when it is necessary to protect someone's safety or our legal rights, and if Handled were ever acquired or merged, in which case your data would move with the service and we would tell you before it did.

Children

Handled Locator is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email us and we will delete it.

If this policy changes

We will change the date at the top and, for anything that materially affects what we do with your data, email account holders before it takes effect rather than relying on you to re-read this page.

What you can ask for

Export your locations at any time from the dashboard, as the CSV you put in. You can also ask us for a copy of everything we hold, ask us to correct it, or ask us to delete it. Email hello@handledlocal.com and we will action it within 30 days.

If you are in the UK or the EEA, the lawful bases we rely on are straightforward: we process your account and location data to perform the contract you have with us, we process the narrow product usage described above under legitimate interests in keeping the service working, and anything optional, connecting Google Sheets or an AI assistant, rests on the consent you give when you connect it and withdraw when you disconnect. You can also complain to your local supervisory authority.

Cookies

On the dashboard we set the cookies needed to keep you signed in. On this marketing site we use privacy-preserving analytics to count visits and call-to-action clicks. If you create an account, an anonymous account identifier joins that marketing journey to setup milestones such as importing locations and installing the widget, so we can understand which campaigns produce working locators rather than just clicks. We also record replays of visits to this marketing site: the pages you saw and where you clicked and scrolled, so we can see where the site is confusing. Anything you type is masked before it leaves your browser and never reaches us, including searches you run in the locator demos. The signed-in dashboard is not replayed at all, its page contents and form values are not captured, and our own analytics does not follow you to other websites. Since we began advertising, Google's advertising tag also runs on both sites and sets its own cookies, which is how a click on an advert can be matched to the trial it produced. We use it for that measurement only; we do not run remarketing, and we do not build audiences from your visit.

The live chat on this marketing site is provided by tawk.to and sets its own cookies so a conversation survives you moving between pages. It loads after the page is interactive, so it cannot slow the page down, and it is not present on the dashboard. If you never open the chat, you never send tawk.to a message; if you do open it, treat what you type as recorded, because it is.

Contact

Questions about any of this go to hello@handledlocal.com.