Privacy policy

Inhands is a small product run by Daniel Stefan, an independent founder based in the European Union. This page explains, in plain language, what we collect and what we do with it. It’s a draft: we’ll publish a final version, with full company details, before paid plans start. Questions: hello@inhands.app.

Who is responsible

For this website and pilot sign-ups, Daniel Stefan is the data controller. For order data you send us during a pilot, you (your company) are the controller and Inhands processes it on your behalf. We’ll sign a simple data processing agreement (DPA) with any pilot customer who asks.

What we collect on this website

• Pilot sign-ups: the details you type into the form (name, email, company, website, team size, system, order volume and your note). We use them to set up your pilot and to reply to you.
• Supplier checker: the supplier names you check. If you ask us to email the report, we store your email address with the list of suppliers so we can send it.
• Analytics: we count page views and a few actions (demo opened, checker used, form sent) with our own first-party analytics. No cookies, no cross-site tracking, no advertising IDs, and we don’t store your IP address. We keep the page path and the referring website’s domain only. If your browser sends Do Not Track, we don’t record page views at all.

What we process when you use Inhands

• Order emails you forward or BCC to us. We read them to find purchase orders, proofs, ship dates and tracking numbers. By default we delete stored email content after 90 days; the order timeline built from it (dates, statuses, tracking numbers) stays until you delete it.
• Supplier API credentials (for example PromoStandards account IDs and passwords). They are encrypted at rest (AES-256-GCM), never written to logs, never shown back in the app, and used only to read your own order status and shipment data from that supplier. You can delete them at any time.
• Orders you upload as CSV or enter by hand.

We don’t connect to your mailbox, and we don’t sell or share your data for marketing.

AI processing

Inhands uses a large language model to classify emails and extract order details, and to draft follow-up emails. We use Anthropic’s API for this. Under Anthropic’s commercial terms, API inputs and outputs are not used to train their models. Only the content needed for a task is sent.

Emails drafted by AI are marked as AI-generated inside Inhands, and none of them is sent without a person on your team approving it.

Where data is stored and who else touches it

Data is stored in a PostgreSQL database on our hosting provider’s servers. We use a small number of processors to run the service: hosting, transactional email delivery, the Anthropic API, and (for tracking numbers) a parcel-tracking provider. We’ll list each one, with its location, in the final version of this policy and in the DPA.

How long we keep it

• Forwarded email content: 90 days by default.
• Order data and credentials: until you delete them or close your account.
• Pilot sign-ups and checker reports: up to 24 months, or until you ask us to delete them.
• Analytics events: aggregated, no personal data.

Your rights

Under the GDPR (and UK GDPR) you can ask to see, correct, export or delete your personal data, object to its use, or withdraw consent. Email hello@inhands.app and we’ll answer within 30 days. You can also complain to your local data protection authority.

Changes

We’ll update this page when something changes and note the date at the top. See also our terms.