Privacy Policy

Data Controller

MyHandler.ai is operated by Tery Emilson ("we", "us", "our"), based in Ontario, Canada. For questions about how your data is handled, or to reach our privacy contact, email: privacy@myhandler.ai

Our role. For individual consumer accounts, we act as the data controller of your personal data. Where MyHandler is deployed by an organization (for example, a firm that provisions accounts for its staff and whose clients' data flows through the Service), we act as a data processor on that organization's behalf, and that organization is the controller. When we act as a processor, we do so only under a written Data Processing Agreement (DPA) that governs the processing; a DPA is required before any organizational deployment. If we process your data as a processor, please direct data-rights requests to the controlling organization in the first instance; we will support them in responding.

Our Commitment

MyHandler.ai is an AI gatekeeper — it reads your messages so you don't have to. That means our AI processes your message content, but MyHandler personnel do not read your messages in the ordinary course of operating the Service.

We believe privacy is built through architecture, not promises. MyHandler is local-first: the lasting copy of your data lives in an encrypted database on your own device, and our servers hold as little as possible. Every design decision — from that encrypted on-device database to our default use of a Zero Data Retention AI provider — exists to protect your information while delivering the intelligence you need.

We do not train AI models on your data. We do not use your data — whether identified, de-identified, or aggregated — to train, fine-tune, or improve any AI model, and we do not permit our AI providers to do so. Your messages exist to serve you, not to build a model.

A note on AI sub-processors. Our default AI provider operates under Zero Data Retention and does not store your content. If you select an optional provider (Anthropic), it may briefly retain inputs for safety and abuse-monitoring purposes under its own terms (up to 30 days), which can involve limited human review of content flagged by its automated systems. We describe each provider and its retention below.

What We Collect and Why

When messages arrive through your connected channels, MyHandler processes:

• Message content — held encrypted on our servers only long enough to relay it to your device, where it is stored and where importance classification and drafting happen (see "Where Your Data Lives"). MyHandler personnel do not access your messages in the ordinary course of operating the Service.
• Message metadata — sender, subject line, timestamps, channel of origin.
• Calendar data — event titles, times, attendees, and location (when you connect Microsoft or Google Calendar).
• Contact information — sender identifiers, communication patterns, and relationship context derived from message history.
• Account information — your name, email address, timezone, and authentication credentials.
• Payment information — processed by Stripe. We do not store your credit card number — only your Stripe customer ID and subscription status.
• Meeting transcripts — meetings are transcribed and stored on your device by the MyHandler Desktop app (see "MyHandler Desktop" below); they are not stored on our servers.
• Support correspondence — if you contact us for support or send feedback, we keep your message and our reply so we can help you and improve the Service.

Legal Basis for Processing

We process your data under the following legal bases:

Special-category (sensitive) data. The content of your messages, documents, and meeting transcripts may incidentally contain special-category data under GDPR Article 9 (for example, information about health, or political or religious views) that you or your correspondents have chosen to include. We do not solicit this data and we process it only as user-directed content, solely to deliver the Service. Where a condition under Article 9 is required, we rely on your explicit request to process the content in question and/or on the fact that the content was manifestly made available to you by the sender for that purpose. We do not use this content to infer characteristics about you and never for advertising.

Automated Processing and AI-Assisted Decisions

MyHandler uses AI to classify the importance of your messages, generate summaries, and draft replies. These features are assistive tools. MyHandler does not make automated decisions that produce legal effects or similarly significant effects concerning you, and no automated output is treated as final without your involvement — you decide what to read, what to send, and what to act on. Nothing is sent on your behalf without your explicit approval.

To the extent any processing constitutes automated decision-making under applicable law (including GDPR Article 22 and the California CPRA's rules on automated decision-making technology), you have the right to request human review, to express your point of view, and to contest the outcome. To exercise these rights, contact privacy@myhandler.ai.

Where required by law, we will clearly indicate when you are interacting with AI-generated content.

Accuracy of AI Outputs

Importance classifications, summaries, drafts, and other outputs are generated by AI and may contain errors or omissions. They are intended to assist you, not to replace your own judgment. You should review AI outputs before relying on or acting on them. MyHandler is not responsible for decisions made solely in reliance on AI-generated output.

Where Your Data Lives

MyHandler is local-first. The authoritative, lasting copy of your data lives on your own device, and we keep as little as possible on our servers.

MyHandler Desktop — On-Device Screen & File Intelligence

The MyHandler Desktop app for Windows builds your ambient memory locally, on your own device. Here is what it captures and where that data lives:

• On-screen text — to surface what you would otherwise forget, the desktop app reads the text visible in your active windows, primarily through Windows accessibility APIs (the same layer screen readers use). When a window does not expose its text — a map, a remote-desktop session, or an app that draws its own text — the app reads a momentary on-device snapshot, extracts the words from it with on-device OCR, and then discards the image; only the text is kept, after the same secret redaction runs. The snapshots used for this are never saved to disk. Keeping the images themselves is a separate, opt-in feature (below) that is off unless you turn it on; when enabled, those images are encrypted and stored on your own device alongside the rest of your vault, are never sent to us, and can be deleted like any other captured data.
• Optional screen memory (off by default) — you may separately opt in to a screen-memory feature that saves images of your screen so you can look back at them. It is off unless you turn it on and acknowledge it. Full-resolution frames are saved as individual encrypted files (AES-256-GCM) on your computer, and their thumbnails are stored in a separate encrypted database; both are encrypted with a key derived from your device vault key. Screen images are never uploaded to our servers. If you never enable it, no screen images are stored — the momentary snapshots used to read on-screen text (above) are discarded immediately and never written to disk.
• Indexed files — when you opt in and choose specific folders, the desktop app indexes the text of supported documents so you can search and recall them. Indexing stays off until you turn it on and pick the folders yourself.
• Dictation history — when you dictate, the resulting text is saved to a searchable history in the encrypted on-device store, so you can find and re-copy something you dictated earlier. It is never synced to our servers. You can delete individual entries or clear the entire history from the Dictation page at any time.
• The encrypted on-device store — screen text, the file index, meeting transcripts, and your local memory live in an encrypted local database (SQLite/SQLCipher, AES-256) on your computer, with the key held in the Windows Credential Manager. Optional screen images are stored as encrypted files alongside it. This content is never uploaded to our servers.
• A local copy of your synced data — the desktop app also keeps an encrypted local copy of your synced messages, calendar, and contacts in that same on-device store, so it keeps working even when Cloud AI is turned off.
• Secret redaction (best effort) — before captured text is stored, the app automatically detects and strips common secrets and financial identifiers — passwords, card numbers, API keys, private keys, and similar — using pattern and checksum matching. This reduces exposure but cannot guarantee that every secret is caught. The same redaction runs on text read from a momentary snapshot before it is stored, and that snapshot is discarded. For optional stored screen images, the app does not scrub the pixels; instead it skips saving a frame whenever the accompanying text capture contained a detected secret. The app also skips password fields, private or incognito windows, and any apps or websites you exclude.
• You stay in control — you can pause capture at any time and add apps or domains to your exclusion list.
• Cloud AI is opt-in — if you turn on Cloud AI in Desktop settings, short text snippets (with detected secrets stripped as described above) may be sent to our AI provider under Zero Data Retention to answer your requests. With Cloud AI off, screen and file processing stays entirely on your device.

What We Don't Store on Our Servers

We have built MyHandler to keep sensitive data off our servers wherever possible. As a rule, we don't store:

• Credit card numbers or full payment credentials (Stripe handles these)
• Plaintext passwords
• Your messages, summaries, memories, contact dossiers, meeting transcripts, or embeddings on a lasting basis — these live in the encrypted store on your device (message content is only a transient relay copy, deleted after your device syncs it)
• Your on-screen activity, any optional screen images, or the text of files you index — these never leave your device

How AI Processes Your Data

MyHandler splits AI work between our servers and the MyHandler Desktop app on your device.

MyHandler personnel do not review your messages in the ordinary course of operating the Service. All routine processing is automated. (Some AI sub-processors may conduct limited safety review of flagged content under their own terms — see "AI Providers.")

AI Providers

Encryption

We encrypt sensitive data at rest: on our servers using AES-256-GCM column-level encryption, and on your device using an AES-256 encrypted database (SQLCipher) plus AES-256-GCM encrypted files for optional screen images. Encrypted categories include, but are not limited to:

• Message content, subjects, and body previews
• Contact details and relationship data
• Behavioral patterns and preferences
• OAuth tokens and authentication credentials
• Phone-call metadata and caller information
• Voice profile samples and writing style data
• Draft correction history
• Calendar event titles, attendees, and locations
• Financial event details
• Meeting transcripts (encrypted on your device)

Sender identifiers use one-way keyed hashing (HMAC-SHA256) for database lookups, ensuring we can match contacts without storing their addresses in plaintext.

Note: Your login email address and display name are stored unencrypted in the user account table, as required by the authentication system for login and password recovery. All other personal data is encrypted at rest.

Data Retention

Account deletion triggers a complete and permanent wipe of the data we hold about you — server-side records and, when you remove the app, your on-device store — including messages, contacts, memories, classification feedback, phone-call metadata, analytics, AI-generated content, subscriptions, and preferences. The exception is a limited set of records we are legally required to keep (for example, billing and tax records) or that are strictly necessary to establish, exercise, or defend legal claims or to prevent fraud; those are retained only for as long as the law requires and are then deleted. An anonymized audit-log entry recording that a deletion occurred is also retained.

Third-Party Services

We use the following third-party services to deliver MyHandler's functionality:

We disclose personal data to these providers only as needed to deliver the Service; we do not sell it.

These providers act on our instructions only. They are contractually barred from using your data for their own purposes, and their access is limited to what each needs to perform its function.

Our Service may link to third-party websites we do not control. This policy does not apply to them; review their own privacy policies before providing data.

International Data Transfers

MyHandler.ai is operated from Ontario, Canada, and is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Server-side data is hosted on Microsoft Azure in the United States and processed by AI providers based in the United States (Groq, Anthropic, and ElevenLabs for voice calls).

Data captured and stored by the MyHandler Desktop app — on-screen text, any optional screen images, indexed files, meeting transcripts, and your local memory — stays on your device and is not part of these transfers. If you opt into Cloud AI, only short, redacted text snippets are sent to our US-based AI provider under Zero Data Retention.

For users in the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data-transfer restrictions:

• Canada benefits from an adequacy decision by the European Commission for personal data transferred from the EEA under GDPR.
• For onward transfers to the United States, we rely on the appropriate safeguards required by applicable law. Our AI providers (Groq and Anthropic) transfer under Standard Contractual Clauses (SCCs). Our hosting, payments, email, and voice sub-processors (including Microsoft Azure, Stripe, Postmark, Twilio, and ElevenLabs) are certified under the EU-US Data Privacy Framework and its UK Extension. We keep SCCs in place as a fallback for all US sub-processors, and rely on the UK International Data Transfer Addendum for transfers of UK data.
• We ensure that all sub-processors maintain appropriate safeguards for cross-border data transfers, and we will make details of the mechanism relied on for a given transfer available on request.

We operate from Canada and do not maintain an establishment in the EEA or United Kingdom. EEA and UK users may exercise their rights and contact us directly at privacy@myhandler.ai.

Cookies & Local Storage

MyHandler uses minimal cookies and browser storage:

• Authentication tokens — JWT stored in memory and refresh tokens in secure storage. Essential for login.
• No advertising or ad-tracking — no advertising cookies, no Facebook Pixel, and no cross-site ad-targeting tools.
• Consent-based analytics — we use Google Analytics 4 to measure site usage. It runs in Consent Mode, denied by default, only activates if you opt in, and is disabled when Global Privacy Control is detected.

You can review or change your choices any time via the "Manage Cookies" link in the footer. See our Cookie Policy for the full list.

Usage and Diagnostic Data

The MyHandler Desktop app contains no product analytics and no usage tracking. It does not report what you do in the app, what it captures, or how often you use any feature. Three narrow operational signals do exist, and we describe them here in full:

• Server request diagnostics — our API is hosted on Microsoft Azure and uses Azure Application Insights to record technical details of requests made to it: IP address, user agent, the endpoint called, response time, and error diagnostics. We use this only to keep the Service secure, available, and debuggable. It contains no message content. Retained for 90 days, then automatically deleted.
• Desktop build version — while you are signed in, the desktop app includes its build number with the requests it already makes. We store that build number and the time it was last seen on your account record, so we can tell which version you are running when you contact support and can identify installs stuck on an outdated build. No usage or behavioural data is attached.
• Uninstall signal — if you uninstall the desktop app, the uninstaller sends a single message containing only a random per-install identifier, so we can tell an uninstall apart from an account that has merely gone quiet. It carries no usage data and no content, it fires only on an explicit uninstall (never on an app update), and it is cleared if you install again. If you choose to delete application data during uninstall, the identifier is deleted along with everything else.

Website analytics are covered separately under "Cookies & Local Storage" and are consent-based.

Your Rights

Depending on your jurisdiction, you have the right to:

• Access — request a copy of all data we hold about you.
• Correction — update or correct your personal information.
• Deletion — permanently delete your account and all associated data, subject to the limited legal-retention exceptions described under Data Retention.
• Export / Portability — receive your data in a portable format.
• Restriction — limit how we process your data while keeping your account active.
• Objection — object to processing based on legitimate interest, including our building of contact profiles. We will cease that processing unless we demonstrate compelling legitimate grounds that override your interests.
• Withdraw Consent — where processing is based on consent (e.g., push notifications), you can withdraw consent at any time without affecting prior processing.
• Human review of automated processing — request human review of, and contest, AI-assisted outputs as described in the Automated Processing section above.
• Lodge a Complaint — you have the right to lodge a complaint with a supervisory authority. In Canada, that is the Office of the Privacy Commissioner of Canada (OPC). In the EEA or UK, you may complain to your local data protection authority. California residents may contact the California Privacy Protection Agency or the California Attorney General.

To exercise any of these rights, contact us at privacy@myhandler.ai. You may use an authorized agent to submit a request on your behalf where the law permits. We will respond within 30 days (or within 45 days for CCPA/CPRA requests, extendable as the law allows, and sooner where required).

Data Breach Notification

In the event of a data breach affecting your personal data, we will:

• Notify the relevant supervisory authority without undue delay, and where feasible within 72 hours of becoming aware, where required by GDPR (Article 33) or other applicable law.
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34), and as otherwise required under PIPEDA (which requires notification to the OPC and to affected individuals as soon as feasible where the breach creates a real risk of significant harm) and other applicable law.
• Provide details of the breach, the data affected, and the steps we are taking to mitigate it.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know — you may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom it is disclosed.
• Right to Delete — you may request deletion of your personal information. Account deletion removes all your data as described above, subject to legally required retention.
• Right to Correct — you may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale/Sharing — we do not sell or share your personal information as defined by the CCPA/CPRA. We have never sold user data.
• Right to Limit Use of Sensitive Personal Information — you may request that we limit the use of sensitive personal information. See the note below.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights.

You may use an authorized agent to submit these requests, and we will respond within the CCPA's 45-day timeframe (extendable as permitted).

Categories of personal information we collect, sources, and disclosures:

• Identifiers (name, email address, phone number) — collected from you; disclosed to hosting, payments, and communications sub-processors as needed.
• Commercial information (subscription tier, billing history) — collected from you and Stripe; disclosed to Stripe.
• Internet or electronic network activity (message metadata, channel connections) — collected from you and your connected channels; hosted on Azure.
• Communications content (message bodies) — collected from your connected channels; relayed to your device and disclosed to AI sub-processors only when you request a draft or enable Cloud AI.
• Inferences (AI classifications, relationship assessments, behavioral patterns) — generated by MyHandler, primarily on your device; not sold or shared.

We retain each category only as described in Data Retention, and no longer than necessary for the purposes above.

Sensitive personal information. Because MyHandler processes the content of your messages and documents, that content may incidentally contain sensitive personal information (for example, health, financial, or precise-location details) that you or your correspondents have included. We do not solicit this information, and we process it only as user-directed content, for the sole purpose of delivering the Service you have asked for — never to infer characteristics about you and never for advertising. We do not sell or share sensitive personal information.

Meeting and Call Participants

If you use MyHandler to transcribe a meeting or to take a voice call, other participants and callers may be recorded or transcribed. You are responsible for obtaining any consent required by the laws that apply to you and the other participants (some jurisdictions require all-party consent). Where MyHandler transcribes a meeting, it does so at your direction and on your device, and we process any resulting third-party data only to provide the Service to you.

Where meeting transcription runs with Cloud AI on, the meeting audio — including other participants' voices — is relayed to our speech-to-text provider for transcription under Zero Data Retention, and is not stored there. With Cloud AI off, meeting transcription runs entirely on your device and no audio is sent anywhere. Either way, the transcript is stored only on your device.

Children's Privacy

MyHandler is not intended for use by anyone under the age of 18, and we do not knowingly collect personal information from children. We rely on self-attestation at sign-up rather than an age-verification mechanism. If we discover that we have collected data from a person under 18, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email and/or an in-app notification at least 30 days before those changes take effect, except where a change must take effect sooner to comply with law or to address a security issue. The "Last updated" date at the top of this policy reflects when the most recent changes took effect. Continued use of MyHandler after the effective date constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

Tery Emilson, operating as MyHandler.ai
Ontario, Canada
privacy@myhandler.ai