This policy explains what data Handpay collects, why, and what you can do about it. Plain language. No dark patterns. If anything here is unclear, email us and we'll fix the policy.
Who we are.
Handpay is a product of MarkD Limited, a company registered in England and Wales. When this policy says "we", "us", or "Handpay", we mean MarkD Limited.
We are the data controller for the personal data described in this policy. If you want to contact our data controller directly, email privacy@handpayapp.com.
What we collect.
Until the Handpay iOS app ships, this website is effectively the whole product. The only personal data we actively collect is the email address you submit to the launch waitlist.
Website
- Your email address, when you submit it to the launch waitlist.
- Standard request logs kept by our hosting provider (Vercel) for security and reliability. These include IP address, user agent, and timestamps.
- If you consent via the cookie banner: aggregated analytics from Google Analytics 4 — pages viewed, approximate location (country/region), device type, and referrer. IP anonymised. Off by default. See the Cookie policy for full detail and to change your mind.
Handpay iOS app (once launched)
When the app ships, it will collect the data you enter about your slot sessions: machines, casinos, amounts, bonus events, session times, and photos you take. It will also collect the usual things any app needs: your account identifier, device model, OS version, and app version.
Photos you take through the app stay on your device unless the on-device OCR is not confident. In that case, the single photo is sent to our server OCR for a second pass, then retained to improve the machine-recognition model. You can opt out of this in Settings.
How we use it.
We do not sell your data. We do not share it with advertisers. We do not trade it with casinos or operators.
- To send you the one email we promised on launch day, and nothing else.
- To operate the app and keep your data available on the devices you sign in on.
- To improve the machine-recognition model using photos that were sent to server OCR. These photos are not tied to your account for training purposes.
- To investigate abuse, debug crashes, and keep the service online.
- To meet legal obligations, including UK tax and company law.
Your rights.
Under UK GDPR, you have rights over your personal data. You can exercise any of these by emailing privacy@handpayapp.com. We will respond within 30 days.
- Access a copy of the data we hold about you.
- Correct inaccurate data.
- Erase your data (subject to legal exceptions).
- Restrict how we use it.
- Port your data to another service.
- Object to processing based on legitimate interests.
- Withdraw consent where we relied on it.
- Complain to the Information Commissioner's Office (ICO) if you are unhappy with how we handle your data. ico.org.uk.
International transfers.
Some of our processors are based in the United States (Vercel, FormSubmit, Google, Apple). When your data is transferred outside the UK, we rely on the UK International Data Transfer Agreement, Standard Contractual Clauses, or the UK-US Data Bridge, whichever is appropriate.
Retention.
- Waitlist email: until the app launches, plus 30 days. Then deleted.
- App account data: for as long as your account exists, then 30 days after deletion.
- Server OCR photos: retained to improve the model until you ask us to delete them.
- Request logs: 30 days.
- Google Analytics events: 2 months. User-scoped data: 14 months, then deleted.
- Financial and tax records: 7 years, as required by UK law.
Security.
We protect your data with reasonable technical and organisational measures: encrypted in transit, encrypted at rest, access limited to staff who need it, and incident response drills. No internet service is perfectly secure. If we become aware of a breach that is likely to cause you harm, we will tell you and the ICO within 72 hours.
Children.
Handpay is for adults only. You must be 18 or older to use the app or submit your email to the waitlist. If we learn that we hold data about someone under 18, we will delete it.
Changes to this policy.
We will update this policy when we change how we handle data, or when the law changes. Material changes will be announced at the top of this page with a new effective date. If you are on the waitlist or have an account, we will email you about changes that affect you.
Contact.
Email privacy@handpayapp.com for any privacy question, correction, or UK GDPR request.
Postal address: MarkD Limited, Birmingham, UK. Full address available on request.