HandleHero Privacy Policy

1. Who This Policy Applies To

This Privacy Policy applies to:

• People with a HandleHero account, including Business Operators, Business Members, and Campaign Hosts.
• Businesses that use HandleHero, and agencies, consultants, or other service providers who work inside a Business on its behalf.
• Visitors to the HandleHero website.
• Website visitors, leads, and consumers who interact with a HandleHero-powered widget, chat, or form on a business’s website.
• Individuals whose business or professional information may appear in outbound Prospect Data.
• People who contact Coreva directly.

If you interact with a HandleHero-powered widget on a business’s website, that business may have its own privacy policy. Please review it, because that business may independently collect, use, or control your information.

2. How HandleHero Is Organized

A few terms help explain how information is organized in HandleHero:

• An Account is an individual person’s login. An Account is not a Business, and one Account may have access to several Businesses.
• A Business is a separate workspace with its own profile, knowledge, widget, campaigns, leads, and prospect data.
• The Business Operator is the Account that created and operates a Business. Business Members are Accounts the Business Operator has invited into that Business.
• A Campaign is an outbound prospecting campaign run for one Business. A Campaign Host is the Account responsible for paying for a paid Campaign.
• Inbound Leads are submitted to a Business through its widget, chat, or forms. Prospect Data is business and professional information HandleHero researches for a Business’s outbound prospecting.

3. Information We Collect

We collect information you provide, information collected automatically, and information we receive from customers, integrations, and service providers. The categories below depend on how you interact with HandleHero.

Account and user data

• Name and email address.
• Authentication and account information, including your password (stored in protected form), sign-in through providers such as Google or Apple where you choose them, email verification, and multi-factor authentication settings.
• The Businesses you operate or belong to, invitations you send or receive, and your role and permissions in each Business.
• Security and account activity, such as sign-ins, security events, and account changes.
• Billing and subscription metadata where you host a paid Campaign or make a purchase (see Section 11).
• Support requests and other messages you send us.

Business data

• Business name, profile, and website.
• Knowledge base content and service descriptions.
• Widget configuration and branding settings.
• Integration settings and webhook destinations.
• Campaign configuration and targeting information.

Inbound lead data

• Name, email address, and phone number.
• Chat messages, service requests, and project details.
• Appointment preferences, where the Business offers them.
• Lead status, score, or qualification details.
• Conversation summaries.
• The page where the widget was used, timestamps, and related interaction information.

Outbound prospect data

For Businesses that use outbound prospecting, we collect and generate business and professional information about companies and the people who work for them, such as:

• Company name, website or domain, location, and industry.
• Business contact names, professional roles or titles, business email addresses, and business or mobile phone numbers where offered.
• Business and professional profile URLs, such as LinkedIn.
• Other publicly available business information.
• Research, enrichment, and qualification results, scores, and statuses generated by HandleHero.

Information collected automatically

• IP address, browser type, device type, and operating system.
• Referring URLs, pages visited, and general usage activity.
• Log data and error data.
• Cookies or similar technologies, where applicable (see Section 12).

4. Sources of Outbound Prospect Information

HandleHero assembles outbound Prospect Data from sources that may include:

• Publicly available websites and other online sources.
• Companies’ own business websites.
• Publicly accessible business and professional information.
• Information our customers provide.
• Integrations our customers connect.
• Business-data and enrichment providers that license or supply business contact and company information to us.
• Mapping and public business-listing services used to discover businesses.
• Other service providers that help us research and verify information.

Not all of this information is public: some comes from licensed data providers. HandleHero applies automated checks, but we do not independently verify every underlying fact, and Prospect Data may be incomplete or out of date.

5. How We Use Information

We use information to operate, provide, secure, support, and improve HandleHero, including to:

• Create Accounts, authenticate users, and provide multi-factor authentication and other security features.
• Manage Business memberships and invitations.
• Operate Business workspaces and Campaigns.
• Discover, research, enrich, qualify, and score prospects for a Business.
• Maintain each Business’s prospect history to reduce duplicate prospect delivery within that Business.
• Capture, organize, and display Inbound Leads.
• Operate the website assistant, chat widget, and forms.
• Generate summaries, suggested messaging, and other AI-assisted features.
• Send notifications and deliver data to integrations and webhooks a Business configures.
• Process payments and manage paid Campaigns and purchases.
• Detect and prevent fraud, abuse, and security threats.
• Provide customer support.
• Monitor usage, performance, and reliability.
• Comply with legal, tax, accounting, and security obligations.

6. AI Processing

HandleHero uses artificial intelligence, including large language models, for outbound research, qualification and scoring, summaries, website assistant and chat responses, suggested messaging, automation, and related features. Information may be processed by AI service providers to operate these features.

AI output may be inaccurate, incomplete, outdated, or not applicable to a specific situation. Review and verify important information before relying on it.

Do not submit sensitive personal information, protected health information, financial account information, government identification numbers, or other highly sensitive information unless it is necessary and appropriate for your use of the service.

7. Business-Scoped Data and Access

HandleHero organizes information by Business. An Account may have access to several Businesses, but access to one Business does not authorize access to another Business’s Inbound Leads, Prospect Data, knowledge, Campaigns, conversations, configuration, or other data.

For example, a person invited into Business B can access what they are authorized to see in Business B. That does not merge Business B’s information with Business A’s, even if the same person also works in Business A.

Prospect Data is delivered to the specific Business it was researched for. We maintain prospect history per Business to reduce duplicate prospect delivery within that Business. This helps, but duplicate detection is not perfect.

Shared research caches: To avoid researching or buying the same information repeatedly, some research is stored once and reused across customers:

• Company research, stored by company website domain. This is information about a company gathered from its public website and other public sources, which can include the names, titles, and business email addresses of leaders or staff that the company’s own website lists.
• Business-data and enrichment provider responses, such as company lookups and people-search results (which can include names and titles). For reuse purposes, a response that found results is treated as expired after about 30 days, and a response that found nothing after about 14 days.

When a cached result is reused for another Business, that Business receives the research as part of its own Prospect Data. Information a Business supplies itself, such as its own notes and edits, ideal customer profile and targeting, Inbound Leads, knowledge, and Campaign configuration, is not placed in these shared caches and is not shared with other Businesses.

8. Business Operators and Members

The Business Operator can invite and remove Business Members and manage Business-level configuration. Authorized Business Members may be able to view and work with the information associated with that Business, including its Campaigns, Prospect Data, and Inbound Leads, according to their permissions.

Customers are responsible for inviting only appropriate people, managing their authorized users, and removing access when it is no longer appropriate. Business membership does not give anyone access to another person’s payment details.

9. How We Share Information

Authorized Business users: Information associated with a Business, including Inbound Leads submitted to it and Prospect Data generated for it, is available to that Business’s Operator and Members according to their permissions. We do not share one Business’s information with another Business merely because the same Account or person can access both.

Services a customer connects: When a Business connects HandleHero to a CRM, webhook, email platform, calendar, messaging or automation tool, or other system, information is sent to that system as the Business configures.

Service providers: We use service providers in these categories: AI and automation; data and enrichment; cloud hosting and database; payment processing; transactional email; mapping and public business data; authentication (optional sign-in); and infrastructure and security, including rate limiting and abuse prevention. They process information on our behalf only as necessary to provide their services to us. See our Subprocessors page.

Legal and safety purposes: We may disclose information if required by law, legal process, or government request, or where reasonably necessary for security investigations, fraud prevention, enforcing our terms, or protecting rights, safety, and property.

Business transfers: If Coreva is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred as part of that transaction.

10. Sale and Sharing of Personal Information

We do not sell personal information to advertisers.

As described in this policy, HandleHero makes business and professional Prospect Data available to our customers as part of our paid services, for their legitimate business purposes. Some privacy laws define “sale” or “sharing” of personal information broadly, and whether a particular disclosure falls within those definitions depends on the applicable law. Where a law that applies to you gives you the right to opt out of a sale or sharing, you may submit that request as described in Section 16.

11. Campaign Hosts, Payments, and Billing

Paid Campaigns and purchases are paid for by the Account that made them; for a paid Campaign, that is its Campaign Host. Payments are processed by a third-party payment processor. Coreva does not store complete payment card numbers on its own servers.

We and our payment processor may store billing metadata such as customer identifiers, subscription identifiers, the Campaign a subscription pays for, billing status, billing period, renewal and cancellation state, and transaction and accounting records. We use it to manage paid Campaigns and purchases, taxes, accounting, support, and legal obligations.

Business Operators and Members do not receive access to a Campaign Host’s payment details because they can access the Business or the Campaign.

12. Cookies and Similar Technologies

HandleHero uses a small number of cookies to keep you signed in and secure and to remember preferences. We do not currently use advertising cookies, analytics cookies, or third-party tracking pixels. The cookies we set are:

• Sign-in session and security cookies (NextAuth), which keep you signed in and protect sign-in forms against cross-site request forgery.
• Sign in with Apple handshake cookies (PKCE code verifier, state, and nonce), which are used only while an Apple sign-in is in progress.
• hh_business, which remembers the Business you last selected.
• hh_invite, which holds a pending Business invitation while you sign in or sign up (expires after one day).
• hh_tz, which stores your time zone so calendar times display correctly.

The HandleHero chat widget on a business’s website does not use tracking or advertising cookies; on that website it stores only a sound on/off (mute) preference in the browser’s local storage. The business operating that website may use its own cookies, which its own policies govern.

You can control cookies through your browser settings. Disabling cookies may prevent some features, including signing in, from working.

13. Account, Security, and Service Communications

We send transactional and operational messages that are needed to provide HandleHero, such as authentication messages, multi-factor authentication and security codes, password and account notices, Business invitations, billing notices, security notifications, and platform and lead notifications. These are part of the service and may be sent even if you opt out of marketing messages.

If we send marketing messages, you can opt out by following the unsubscribe instructions in the message or by contacting us. If you submit your contact details through a Business’s widget, that Business may contact you about your inquiry, and its own opt-out practices apply to its messages.

14. Data Security

We use technical and organizational measures designed to protect information from unauthorized access, loss, misuse, alteration, or disclosure. These include authentication controls, multi-factor authentication and security codes, access controls that separate Businesses, rate limiting, temporary lockouts after repeated failed attempts, session controls, and logging and monitoring.

No system is completely secure. We cannot guarantee that unauthorized access, data loss, downtime, or security incidents will never occur.

You are responsible for using a strong password, keeping your authentication codes and recovery methods secure, limiting who you invite into your Businesses, securing the systems you connect, and telling us promptly about suspected unauthorized activity.

15. Data Retention

We retain information for as long as needed to provide HandleHero and for the purposes described in this policy, and then delete, de-identify, or restrict it, subject to applicable law and valid deletion requests. Different events have different effects:

• A Campaign ending or its renewal being cancelled does not by itself delete that Campaign’s history, including its prospects, research, contacts, scores, statuses, and activity.
• Removal from a Business ends that person’s access but does not delete the Business’s information.
• Deleting a Business removes it from use; related records may be retained for the purposes below.
• Deleting an Account closes that Account. It does not delete Businesses the person was only a member of, and some records may be retained for the purposes below.

Where we keep information after these events, it is to provide historical records to the Business, maintain Business prospect history and duplicate prevention, meet legal, tax, and accounting obligations, prevent fraud and protect security, resolve disputes, enforce our agreements, and support legitimate business operations.

Shared research caches are described in Section 7. The reuse windows described there control when a cached provider response is no longer reused; they are not deletion schedules.

16. Your Privacy Rights

Depending on where you live and the law that applies, you may have the right to:

• Access personal information we hold about you.
• Correct inaccurate information.
• Request deletion.
• Obtain a copy of your information.
• Object to or restrict certain processing.
• Opt out of certain processing or communications, where applicable.
• Withdraw consent where processing is based on consent.

To make a privacy request, contact us at info@handlehero.io. We may need to verify your identity before acting on a request, and we will respond as required by applicable law.

Where we process information on behalf of a Business, such as an Inbound Lead submitted through that Business’s widget, we may direct you to that Business, because it decides how your information is used, and we will assist it as appropriate.

17. If Your Information Appears in Prospect Data

If your business or professional information appears in outbound Prospect Data, you can contact us at info@handlehero.io to ask about the information we hold, to correct it, to request deletion, or to object to its use for prospecting, as applicable law provides. We handle these requests ourselves rather than simply referring you to our customers. A Business that has already received your information and contacted you is also responsible for honoring your requests about its own outreach, such as an unsubscribe.

When we receive a deletion or objection request, we delete or anonymize your records across our systems, including our shared research caches. We then add a suppression record so you are not rediscovered or re-added later: suppressed people are excluded from prospect discovery, enrichment, delivery of new Prospect Data to Businesses, and mobile number lookups.

To honor a request not to be contacted or to have information removed, we keep this limited suppression record. It contains a one-way hash of identifiers such as your email address, LinkedIn profile URL, and phone number, rather than the identifiers themselves.

18. International Users

HandleHero is operated from the United States. If you use HandleHero or your information is processed from outside the United States, it may be transferred to, stored in, and processed in the United States and other countries where our service providers operate. Those countries may have data protection laws that differ from those where you live.

If you are in the European Economic Area or the United Kingdom, you may have rights under the GDPR or UK GDPR, including the rights described in Section 16, and the right to lodge a complaint with your local data protection authority. Contact us with any questions about how your information is handled.

19. US State Privacy Rights

Residents of some US states have rights under state privacy laws, which may include rights to know, access, correct, and delete personal information and to opt out of certain processing. Where a state law applies to our processing of your information, we will honor the rights it provides. You can make a request as described in Section 16, and we will not discriminate against you for exercising your rights.

20. Children’s Privacy

HandleHero is not intended for children under 16 years old. We do not knowingly collect personal information from children under 16.

If you believe a child has provided personal information through HandleHero, contact us so we can review and take appropriate action.

21. Responsibilities of Businesses Using HandleHero

Businesses using HandleHero are responsible for:

• Providing any required privacy notices on their websites and to their visitors, leads, and customers.
• Obtaining any legally required consents.
• Their own customer communications, marketing, and outreach, and complying with applicable marketing, email, telephone, text messaging, privacy, and data protection laws.
• Managing the people they authorize to access their Businesses.
• Managing the systems and integrations they connect.
• Using Prospect Data lawfully and as our Terms of Service allow.
• Responding to privacy requests where they decide how the information is used.

22. Relationship to Our Terms of Service

This Privacy Policy explains what information HandleHero collects, where it comes from, why it is processed, who receives it, and how it is retained and protected. The contractual rules for using HandleHero, including billing authority, acceptable use, and the restrictions on reselling or transferring Prospect Data between Businesses, are in our Terms of Service.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted here with a revised “Last updated” date, and where a change is material we will provide additional notice where required.

Your continued use of HandleHero after an updated Privacy Policy is posted means you acknowledge the updated policy.

24. Contact

If you have questions about this Privacy Policy or want to make a privacy request, contact: