Privacy Policy

Last updated 2 September 2026

Handler is a social media manager whose primary user is an AI agent. This policy describes what it collects, why, who it goes to, and how long it is kept. It is written against what the software actually does rather than against a template.

Who we are

Handler is operated by Sidejar. For any privacy question, or to exercise any right described below, email privacy@handler.social.

What we collect

Your account

Your email address and authentication details, handled by Supabase Auth. We do not store your password — authentication is delegated to Supabase.

Connected social accounts

When you connect an account, we store its handle, display name, platform user ID, profile picture URL, and the access and refresh tokens the platform issues. Tokens are encrypted at rest with AES-256-GCM under a key we hold separately from the database, and each token is cryptographically bound to the profile it belongs to. Token values are never returned to the browser and never shown in the interface.

Content you and your agent create

Draft and published post text, any images you attach, scheduling times, and a record of who approved each post and when. Approval records exist to make the review queue auditable — see the Terms for why every post has one.

Public social media content (the listening feature)

This is the part worth reading carefully. When you add a keyword, Handler searches public posts on supported platforms and stores those that match. For each matching public post or comment we store the author’s public handle and display name, their public follower count, their public profile picture, the text of the post, its URL, its public engagement counts, and its cover image. We store the images as files rather than as links, because the platforms’ own image URLs expire after about 48 hours.

This means Handler holds information about people who are not its users— the people talking publicly about your brand. We only ever collect content that was already public at the time we saw it, we never collect private messages or content from private accounts, and we do not attempt to identify anyone beyond the public profile the platform already shows. If you are one of those people and want your content removed from a customer’s Handler workspace, email us and we will remove it.

Technical records

API keys (stored only as a hash — the key itself is shown once and never again), connector authorisations, rate-limiting counters, an audit log of security-relevant actions such as token decryption and post approval, and ordinary server logs.

Why we collect it

To publish the posts you approve, to show you what people are saying about your brand, to keep your account secure, and to let an AI agent you have authorised operate the product on your behalf. We do not sell personal data, we do not share it with advertisers, and we do not use it to train AI models.

Who we share it with

These are our subprocessors. Each receives only what its job requires.

When you connect an AI assistant such as Claude as a connector, that assistant can read and write through Handler within the permissions shown on the consent screen. What it does with that data afterwards is governed by that assistant’s own privacy policy, not this one.

How long we keep it

Account data and connected profiles are kept until you delete them or close your account. Posts and their approval records are kept for as long as the workspace exists, because they are the audit trail. Collected public posts are kept until you delete them or close your account. Rate-limiting counters and short-lived authorisation codes are discarded automatically within days. When you disconnect a social account, its tokens are revoked and deleted.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. If you are in the UK, EU, or another region with equivalent law, you also have the right to object to processing, to restrict it, and to complain to your data protection authority. Email privacy@handler.social and we will respond within 30 days.

Security

Social media tokens are encrypted at rest. API keys are stored as hashes, so a database copy does not yield a working key. Every workspace’s data is isolated at the database level. Requests that fetch remote images are restricted to known content networks and are blocked from reaching internal addresses. No system is perfect; if you find a vulnerability, please email security@handler.social.

Where data is processed

Handler runs on infrastructure in the United States and the European Union. If you are outside those regions, your data will be transferred to them.

Children

Handler is not intended for anyone under 18, and we do not knowingly collect their data.

Changes

If we change this policy in a way that materially affects you, we will tell you by email before it takes effect. The date at the top always reflects the current version.