Handy Circle Privacy Policy

1. Introduction & Scope

This Policy applies to personal information we process about: (a) Customers who create an account, post a Job, request or receive a quote, book a Pro, or make a payment; (b) Pros who register, complete verification, offer or perform services, and receive payouts; and (c) visitors to our website and prospective users who browse, contact us, request an estimate, or subscribe to our communications.

Although our marketplace serves only the Commonwealth of Massachusetts, our website is accessible from anywhere in the United States. Accordingly, the state-specific privacy rights described in the "U.S. State Privacy Rights" and "Do Not Sell or Share" sections extend to every U.S. resident whose personal information we process — including nationwide website visitors and prospective users — to the extent that person is covered by an applicable state privacy law, regardless of the state in which they reside. There is no contradiction between our Massachusetts-only service area and these broader privacy rights.

Because our website and our apps operate on distinct technical systems, our processing spans two separate data environments, and this Policy covers both: (1) our primary application backend and database (hosted on Neon Postgres and served through Render), which powers the Customer app, the Pro app, and the website's booking funnel; and (2) a separate backend used by our marketing website (hosted on Supabase and Netlify), which independently stores certain account, professional-registration, and booking information. When you exercise a privacy right (such as deletion or access), we take steps to address your information across both environments where applicable.

This Policy does not apply to the practices of third parties that we do not own or control, including the independent Pros you engage and the third-party service providers described below, each of which handles data under its own privacy policy. Where this Policy conflicts with a mandatory provision of applicable law, that law controls.

The "Effective Date" and "Last Updated" date of this Policy is July 17, 2026.

2. Who We Are / Controller

The entity responsible for your personal information — the "controller" or "business" under applicable U.S. state privacy laws — is:

• Handy Circle, Inc.
• 56 Broad St STE 14252, Boston, MA 02109, USA
• Email: hello@handy-circle.com
• Phone: (857) 214-8626
• Website: https://www.handy-circle.com

For questions about this Policy or to exercise your privacy rights, contact us using the information above or as described in the "Contact Us / How to Exercise Rights" section. When we process personal information solely on behalf of and under the instructions of another party (for example, a Pro who separately handles a Customer's information for their own purposes after a Job), that party is a separate controller responsible for its own practices.

3. Information We Collect

We collect personal information that you provide directly, information generated automatically through your use of the Services, and information we receive from third parties. The specific information we collect depends on whether you are a Customer, a Pro, or a website visitor, and on how you interact with the Services.

a. Information You Provide to Us

Customer account and profile information: your name, email address, mobile phone number, ZIP code, a password (which we store only as a cryptographic hash, never in plain text), and — if you choose Sign in with Apple — an Apple-provided identifier. You may add an optional profile photo. If you do not add one, we display your initials.

Job and booking information: the details you provide when you post a Job or request a quote, including a free-text description of the work, the service category, the service address, scheduling preferences, and any photos of the project you upload. By default, a Job's street address is hidden from Pros until the Job is booked.

Payment information: to pay for a Job, you enter your payment card details directly on a payment page hosted by our payment processor, Stripe. We do not receive or store your full card number or security code. We retain only a payment-processor customer identifier and limited card metadata for cards you save — specifically the card brand, the last four digits, the expiration date, and a payment-method token.

Pro registration and verification information: your name, email address, mobile phone number, password hash, business type (individual or business) and business name, the trades and services you offer, your service area, hourly rate and price range, self-reported years of experience, a professional bio, and a required profile photo. As part of identity verification, our processor (Stripe Identity) captures an image of your government-issued identification and a selfie for a matching check; when verification succeeds, your display name is set to the legal name returned from your government ID. If you register as a business, our processor also collects and verifies business legal details, an Employer Identification Number, and an owner/representative's government ID. For certain licensed trades (electrical, plumbing, and HVAC), you upload a photo of your trade license along with the license number, type, issuing state, and expiration date; that license image is stored by us and may contain sensitive details, so we treat it as sensitive information.

Payout information: to receive payouts, Pros complete onboarding with Stripe Connect. Bank-account, tax (Form W-9), and related payout details are collected and held by Stripe, not by us; we retain a connected-account identifier and payout-eligibility status.

Communications and content: messages you send through in-app chat, reviews and ratings you write, before/after and other photos, dispute submissions and their detail and photos, support inquiries, referral entries, and any other content you submit. To keep transactions on-platform, we automatically detect and redact email addresses and phone numbers from Job descriptions, quote messages, and chat when they are written and displayed.

Marketing and contact information: if you subscribe to our newsletter or request information, we collect your email address and the source of the signup. If you contact us or use website support chat, we collect the information you choose to share.

b. Information We Collect Automatically

When you use the Services, we and our providers may automatically collect: device and technical information (device type, operating system, app version, and identifiers); log and usage information (pages and screens viewed, features used, actions taken, timestamps, and referring pages); approximate location derived from your device or address entries; and, for the live-tracking feature described below, precise device geolocation from a Pro's device while a Pro is en route to or performing a Job.

On our website only, we and our providers use cookies, pixels, software development kits, and similar technologies to collect analytics and advertising information, as described in the "Cookies & Tracking Technologies" section. Our native mobile apps do not run website advertising or analytics trackers.

We also generate records about your activity, including notifications sent to you, push-notification device tokens, an append-only log of Job lifecycle events, ratings you give and receive, and — where you use our AI features — a ledger of the input text and output text of each AI request associated with your account and, where relevant, the Job.

c. Information We Receive from Third Parties

We receive information from the service providers that support the Services, including: from Stripe, the status and outputs of identity verification, payment and payout status, and limited card metadata; from Apple, an identifier when you use Sign in with Apple; from our SMS verification provider (Twilio), the result of a one-time-passcode phone verification; and from referrers, the fact that you were referred and any associated reward status. We do not purchase marketing lists to build user profiles.

Note on verification and screening: To the extent Handy Circle conducts any verification or screening of Pros, it is limited and does not guarantee the safety, quality, legality, or suitability of any Pro. Our verification consists of processor-run identity verification (Stripe Identity), a manual review of self-uploaded trade licenses for electrical, plumbing, and HVAC trades, and review of self-reported registration information, together with reviews, ratings, and ongoing monitoring. We do not represent that any particular criminal, driving, employment, or other background check has been performed.

d. Categories of Personal Information (U.S. State-Law Mapping)

For purposes of the California Consumer Privacy Act, as amended ("CCPA/CPRA"), and similar state laws, we collect the following statutory categories of personal information:

• Identifiers: name, email address, phone number, ZIP code, account and device identifiers, IP address, and Apple/processor identifiers.
• Customer records / commercial information: service address, Jobs posted, bookings, quotes, purchases, payment-card metadata, account credits, referral data, and transaction history.
• Internet or network activity: usage, log, app-interaction, and analytics information.
• Geolocation data: approximate location and, for the live-tracking feature, precise geolocation of a Pro's device during an active Job.
• Audio, visual, or similar information: profile, Job, before/after, review, and dispute photos; and, for Pros, a government-ID image and selfie processed by Stripe Identity and a trade-license image stored by us.
• Professional or employment-related information (Pros): trade, services, business name, hourly rate, years of experience, license details, and payout eligibility.
• Sensitive personal information: precise geolocation (live tracking); account log-in credentials (password hash); and, for Pros, government identification and, for licensed trades, a license image and number.
• Inferences: preferences and characteristics derived from the above to match Jobs, personalize the Services, and support fraud prevention.

We do not knowingly collect Social Security numbers, financial-account numbers, or health information from Customers through the Services; Pro tax and bank details are collected and held by Stripe, not by us.

4. How We Use Information (Purposes)

We use personal information for the following purposes:

• Provide and operate the Services: create and manage accounts, post Jobs, match Customers with Pros, facilitate quotes, scheduling, in-app messaging, completion, and reviews.
• Process payments and payouts: charge Customers the Pro's quoted price plus our service fee, hold funds pending completion, release Pro payouts, apply account credits and referral rewards, and process refunds, cancellations, and disputes, through Stripe.
• Verify identity and support trust and safety: run processor-based identity verification, review trade licenses for licensed trades, detect and prevent fraud, enforce our policies, moderate content, investigate disputes, and block or remove accounts that violate our terms.
• Communicate with you: send transactional and lifecycle messages (such as account, verification, booking, receipt, password-reset, and milestone notices) by email, SMS, and push notification, and — with any required consent — marketing communications.
• Provide AI-assisted features: generate improved Job descriptions and Pro-facing summaries and provide service triage, as described in the "AI Processing" section.
• Enable live tracking and estimated arrival times using precise geolocation during an active Job.
• Personalize and improve the Services: understand usage, develop features, and (on our website) measure and optimize marketing.
• Comply with law and protect rights: meet legal, tax, and regulatory obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We may de-identify or aggregate personal information and use it for any lawful business purpose; when we do, we maintain and use such information in de-identified form and do not attempt to re-identify it except as permitted by law.

5. How We Share Information

We share personal information in the following ways. We do not sell personal information for money. Certain uses of website advertising and analytics technologies may constitute a "sale" or "sharing" under state privacy laws, as described in the sections below.

a. Between Customers and Pros

Because we operate a marketplace, we share information between Customers and Pros as needed to quote, book, and perform a Job. When a Job is booked, we share the Customer's name, relevant contact information, service address, and Job details with the assigned Pro; and we share the Pro's profile, name, ratings, and, during an active Job, live location with the Customer. Address details are withheld from Pros until a Job is booked. Reviews and ratings you submit are shared and may be displayed publicly with your name or initials.

b. Service Providers and Processors

We share personal information with vendors that perform services for us under contract, limited to what each needs to perform its function. Our current providers include those listed in the "Third-Party Processors" table below (Stripe, Twilio, Resend, OpenPhone, Anthropic, Google, Meta, Expo, Apple, Cloudflare R2, Neon, Supabase, Render, Netlify, and Tidio).

c. Legal, Safety, and Compliance

We may disclose information to comply with applicable law, regulation, legal process, or governmental request; to enforce our terms and policies; to detect, prevent, or address fraud, security, or technical issues; and to protect the rights, property, or safety of Handy Circle, our users, or others.

d. Business Transfers

If Handy Circle is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy.

e. Aggregated or De-Identified Information

We may share information that has been aggregated or de-identified and that cannot reasonably be used to identify you.

Third-Party Processors

The processors below reflect the providers actually used to operate the Services as of the Effective Date. Each is engaged under contract and receives only the information needed for its function.

• Stripe — payments (hosted checkout), fund holds, Stripe Connect payouts, Stripe Identity verification, coupons, and refunds. Receives Customer name/email and transaction data, and Pro identity/business and payout details. Card, bank, and tax details are entered on and held by Stripe.
• Twilio — SMS one-time-passcode phone verification. Receives phone number and verification code.
• Resend — transactional and lifecycle email delivery. Receives recipient email, name, and message content.
• OpenPhone — outbound SMS/MMS notifications tied to in-app chat. Receives a masked phone number and message content.
• Anthropic (Claude) — AI features (description improvement, Pro-facing summaries, and service triage). Receives Job free-text and, for triage, photos; contact details are redacted from text before sending.
• Google — Places API (address autocomplete) and Distance Matrix (arrival-time estimates); and, on the website only, Google Analytics 4. Receives partial address text, location, and website usage/event data.
• Meta (Facebook Pixel) — website advertising conversion measurement only, loaded only after you affirmatively accept cookies. Receives website event data.
• Expo — push-notification delivery. Receives device push tokens.
• Apple — App Store distribution and Sign in with Apple. Receives an Apple identifier.
• Cloudflare R2 — image storage (profile, Job, review, dispute, and license images).
• Neon — primary database hosting for app and web-booking data.
• Supabase — separate database, authentication, and functions for the marketing website, including a copy of certain Pro-registration and booking data.
• Render — hosting for the primary application backend.
• Netlify — hosting for the marketing website.
• Tidio — website live-support chat. Receives whatever a visitor types into the chat widget.

Some features are enabled only where the relevant provider is configured; if a provider is not enabled for your deployment, the associated processing does not occur. This does not expand the list above — we do not engage processors other than those actually in use as described here.

6. Cookies & Tracking Technologies

On our website (not in our native mobile apps), we and our providers use cookies, pixels, tags, and similar technologies for functionality, analytics, and advertising. You can control these through our cookie consent banner and your browser settings.

Our website displays a cookie consent banner with "Accept" and "Decline" options; your choice is stored on your device. We detect and honor an opt-out preference signal, such as the Global Privacy Control (GPC), on first page load — before any consent interaction — and we do not load advertising technologies, and we treat sale/sharing as opted out, for any browser that transmits such a signal. The two principal website technologies are:

• Google Analytics 4 (GA4) — used to measure website and booking-funnel usage. GA4 runs by default only in a privacy-protective analytics configuration with advertising features (such as Google Signals and advertising-personalization data sharing) disabled, and it is fully disabled when you select "Decline" or when we detect a GPC or similar opt-out signal. Any advertising-classified GA4 signals are loaded only if you affirmatively select "Accept."
• Meta (Facebook) Pixel — used to measure advertising conversions. The Pixel operates strictly on an opt-in basis: it loads only after you affirmatively select "Accept," and it is not loaded for a browser transmitting a GPC or similar opt-out signal.

We use certain cookies that are strictly necessary for the website to function, which do not require consent. You can also manage cookies through your browser controls and, for GA4, through Google's opt-out tools. Because these technologies can involve disclosing identifiers to third parties for cross-context behavioral advertising or analytics, our use of the Meta Pixel and certain GA4 advertising signals may constitute a "sale" or "sharing" of personal information under state privacy laws. See the "Do Not Sell or Share" section for how to opt out, including our automatic honoring of the Global Privacy Control (GPC) browser signal.

7. SMS / A2P Messaging & TCPA

With your consent, we send text messages related to the Services. These include: verification messages (one-time passcodes to confirm your phone number), transactional and account messages, and notifications tied to in-app chat and Job activity. Message and data rates may apply, and message frequency varies based on your activity.

You may opt out of non-essential text messages at any time by replying STOP to any message, and you can reply HELP for help. Opting out of certain transactional messages may affect your ability to receive time-sensitive Job or verification notices. Consent to receive marketing text messages, where applicable, is not a condition of purchasing any goods or services. Carriers are not liable for delayed or undelivered messages.

8. AI Processing

We use automated, AI-assisted processing to help you use the Services more easily. Specifically, we use a third-party model provider (Anthropic's Claude) to: (a) rewrite or improve a Job description you have drafted; (b) generate a concise summary or brief of a Job for the assigned Pro; and (c) provide service triage, in which you describe (and optionally photograph) an issue and receive a suggested service category and a drafted Job to review.

When you use these features, the relevant text — and, for triage, any photo you submit — is sent to the model provider to generate a response. Before text is sent, we automatically redact detected email addresses and phone numbers. We retain a ledger of the input and output text of each AI request, associated with your account and, where relevant, the Job, to operate and improve the features and for safety and quality.

These features are assistive only. They do not make solely automated decisions that produce legal or similarly significant effects about you; suggestions are presented for your review, and a human (you) decides whether to post a Job, and our team is involved in decisions such as license review and dispute resolution. The AI features degrade gracefully and are skipped if the provider is unavailable.

9. Precise Geolocation

Our live-tracking feature uses precise device geolocation. When a Pro is en route to or performing an active Job, the Pro app — with the Pro's device-level location permission — periodically broadcasts the Pro's precise location so the Customer can view the Pro's approach and estimated arrival time on a map. This precise-location sharing occurs only in connection with an active Job.

We also use approximate location, such as reverse-geocoding an address you enter, to prefill and validate service addresses within Massachusetts. Precise geolocation is treated as sensitive personal information under applicable state laws, and we use it solely to provide the live-tracking feature you request and related support and safety purposes — not for advertising or profiling.

You can control location collection through your device's operating-system settings. Disabling location permission will limit or disable live tracking and may affect related features. Customers do not broadcast continuous precise location; the live-tracking broadcast is a feature of the Pro app during active Jobs.

10. Payment Data

Payments are processed by Stripe. When you pay, you enter your card details on a payment page hosted by Stripe. We do not receive or store your full card number or card security code. For cards you choose to save, we retain only limited metadata — the card brand, the last four digits, the expiration date, and a payment-method token — so that you can reuse a saved card.

Pro payouts are handled through Stripe Connect, and identity verification through Stripe Identity. Bank-account, tax, government-ID, and business legal details used for payouts and verification are collected and held by Stripe. Stripe processes this information as an independent controller under its own privacy policy, which we encourage you to review at https://stripe.com/privacy.

11. Biometric Information Note

We do not collect, store, or use biometric identifiers. If you enable Face ID or Touch ID to unlock our apps, that authentication happens entirely on your device through your operating system; our app receives only a yes/no result and never receives, reads, or stores any face, fingerprint, or other biometric template or image.

For Pros, identity verification is performed by Stripe Identity, which captures a government-ID image and a selfie for a matching check. That process is handled by Stripe under its own privacy practices; we do not receive or store the underlying ID image or selfie. Although Massachusetts does not have a dedicated biometric-privacy statute, we provide this disclosure for transparency and for users in states with such laws.

12. Data Retention

We retain personal information for as long as necessary to provide the Services and to fulfill the purposes described in this Policy, and thereafter as required to meet our legal, tax, accounting, dispute-resolution, fraud-prevention, and record-keeping obligations. The criteria we use to determine retention periods include the nature and sensitivity of the information, the duration of your relationship with us, whether there is an active or potential transaction, dispute, or legal obligation, and applicable limitation periods.

Representative Retention Periods

The following representative periods illustrate how we apply those criteria to principal categories of information. Actual periods may vary where a longer or shorter period is required or permitted by law, or where records are subject to a legal hold:

• Account and profile information: retained for the life of your account and anonymized promptly after account deletion (see below), subject to the exceptions in this section.
• Job, booking, payment, payout, refund, and other financial-transaction records: retained for approximately seven (7) years following the transaction to meet tax, accounting, audit, and legal obligations.
• Pro identity-verification status and trade-license records: retained for the life of the account and for up to seven (7) years thereafter for compliance and dispute purposes; underlying government-ID images and selfies are held by Stripe, not by us.
• Reviews and ratings: retained for as long as they remain relevant to the marketplace, and may persist in anonymized form after account deletion.
• AI request ledger (input and output text): retained for up to twenty-four (24) months, then deleted or de-identified.
• Support communications and dispute records: retained for up to three (3) years after resolution, or longer if needed for a legal claim.
• Marketing and newsletter data: retained until you unsubscribe, after which we keep a minimal suppression record to honor your opt-out.
• Precise geolocation from live tracking: retained only for the duration of the active Job and a short period afterward (generally up to thirty (30) days) for support and dispute purposes, then deleted or de-identified.
• Website analytics and cookie data: retained according to the applicable provider's settings (for example, GA4 event data is generally retained for up to fourteen (14) months).
• Saved-card metadata and push-notification device tokens: deleted upon account deletion or when the card or token is removed or invalidated.

When you delete your account (or we delete it at your request), we anonymize your information rather than performing an immediate hard deletion of all records: we remove or overwrite identifying fields (for example, replacing your name and email with non-identifying tombstone values and clearing your phone number, ZIP code, profile photo, credits, saved-card metadata, and device tokens) and disable log-in, while retaining certain shared transactional records (such as Job and payment history and reviews) in a form needed for the other party's records, legal compliance, and financial integrity. Saved-card metadata and push-notification tokens are hard-deleted.

For financial-integrity reasons, we cannot complete a deletion while you have money in flight — for example, a held payout, an active Job in progress, or a pending refund. In those cases, deletion is completed after the transaction resolves. Deletion requests are addressed across both our primary database and the separate website database where applicable.

13. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, hashing of passwords, access controls, redaction of contact details in user content, signed and access-controlled image storage, idempotency and server-side computation for financial operations, and audit logging of administrative actions.

NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE, AND WE CANNOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR INFORMATION. You are responsible for keeping your account credentials confidential and for the security of your own devices. If we become aware of a security incident affecting your personal information, we will notify you and applicable authorities as required by law.

14. Your Choices

You have choices about how we process your personal information:

• Account information: review and update your profile and account details within the app.
• Marketing email: unsubscribe using the link in any marketing message or by contacting us; we will still send transactional and account messages.
• Text messages: reply STOP to opt out of non-essential SMS, and HELP for help.
• Push notifications: control push notifications through your device settings.
• Location: control precise and approximate location collection through your device's operating-system settings.
• Cookies and web tracking: use our website cookie banner, your browser controls, and the Global Privacy Control signal; and use our "Do Not Sell or Share My Personal Information" link for advertising/analytics.
• Account deletion: request deletion in the app or by contacting us, subject to the money-in-flight and anonymization rules described above.

15. U.S. State Privacy Rights

Depending on your state of residence, you may have specific rights regarding your personal information. We honor the rights described below for residents of states with applicable comprehensive privacy laws — including nationwide website visitors and prospective users covered by such a law — and we do not discriminate against you for exercising them.

a. California (CCPA/CPRA)

California residents have the right to: know and access the categories and specific pieces of personal information we have collected; know the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it; correct inaccurate personal information; delete personal information, subject to exceptions; opt out of the "sale" or "sharing" of personal information; and limit the use and disclosure of sensitive personal information. The categories we collect, disclose for a business purpose, and may "share" (for cross-context behavioral advertising via the website Meta Pixel and certain GA4 signals) are described in the "Information We Collect" and "How We Share Information" sections. We do not sell personal information for monetary consideration, and we do not knowingly sell or share the personal information of consumers under 16. You may use an authorized agent to submit requests, and we will verify your identity before responding.

b. Virginia, Colorado, Connecticut, Utah, and Other States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have the right, subject to that state's law and exceptions, to: confirm whether we process their personal information and access it; correct inaccuracies; delete personal information; obtain a portable copy; and opt out of targeted advertising, the sale of personal information, and certain profiling. If we decline a request, you may appeal our decision by contacting us at hello@handy-circle.com with the subject line "Privacy Appeal"; we will respond within the timeframe required by your state's law. If your appeal is denied, you may contact your state Attorney General.

c. How to Submit a Request

You may submit a privacy request by emailing hello@handy-circle.com, by writing to us at 56 Broad St STE 14252, Boston, MA 02109, or by calling (857) 214-8626. To protect your information, we will take steps to verify your identity before fulfilling a request, generally by matching information you provide against information in our records; sensitive or high-risk requests may require additional verification. We will respond within the timeframes required by applicable law. Requests are addressed across both our primary and website data environments where applicable.

16. Do Not Sell or Share My Personal Information / Limit Sensitive PI

We do not sell your personal information for money. However, our use of website advertising and analytics technologies — principally the Meta (Facebook) Pixel and certain Google Analytics advertising signals — may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA and similar state laws.

Our website provides clear, clickable controls to exercise these rights. A "Do Not Sell or Share My Personal Information" link and a "Limit the Use of My Sensitive Personal Information" link are available in the website footer, alongside our cookie banner. In addition, we automatically detect and honor the Global Privacy Control (GPC) signal on first page load as a valid opt-out of sale/sharing for the browser from which it is sent, without requiring any further action from you. These links and the GPC auto-honoring are implemented as functioning controls on the website itself, not merely described in this Policy.

To opt out, you may: (a) use the "Do Not Sell or Share My Personal Information" link, or select "Decline" on our cookie banner, which prevents advertising technologies from loading and disables GA4; (b) simply refrain from selecting "Accept," so that the advertising Pixel and advertising-classified signals do not load; or (c) enable a Global Privacy Control (GPC) signal in a supported browser or extension, which we detect and honor on first page load. You may also submit a request to us using the contact methods above.

You may also request that we limit the use and disclosure of your sensitive personal information to the uses permitted under Cal. Civ. Code § 1798.121 and similar laws. As a matter of practice, we already use and disclose sensitive personal information — precise geolocation (used solely to provide the live-tracking feature you request), account log-in credentials, and, for Pros, government-identification and trade-license information (used solely for identity verification, payments, licensing review, safety, and fraud prevention) — only to perform the Services you request, to ensure security and integrity, to prevent fraud, and to comply with law, and not to infer characteristics about you and not for advertising or profiling. Because our handling already conforms to the permitted purposes, we do not need to change our practices in response to a limitation request, and we do not use sensitive personal information for the additional purposes that this right would restrict. Where sensitive personal information is necessary to deliver a feature — for example, precise geolocation is required for live tracking — you can prevent its collection at any time through your device's operating-system settings, which will disable that feature. To make a limitation request or ask questions, contact us using the information above.

17. Notice of Financial Incentives

Two of our voluntary programs — our referral program and our newsletter — may be considered "financial incentives" under the CCPA/CPRA (Cal. Civ. Code § 1798.125) because they offer a benefit that is reasonably related to the collection or use of personal information. We disclose their material terms below. Participation is entirely optional, and you may withdraw at any time without penalty.

a. Referral Program

Our referral program lets an existing user invite another person to Handy Circle. When a person you refer completes and pays for their first Job, you (the referring user) receive a ten-dollar ($10) account credit, and the person you referred receives a ten-dollar ($10) discount toward their first Job. To operate the program, we collect and use identifiers such as your name and email address and, for the referred person, the account and transaction information needed to confirm eligibility. One reward is available per referred person, credits have real monetary value and are redeemable toward Services, and rewards are subject to our anti-abuse rules and may be withheld or reversed for fraud or abuse.

b. Newsletter

If you subscribe to our newsletter, we collect your email address and the source of your signup so we can send you seasonal Massachusetts home-maintenance tips and Handy Circle offers. We do not pay you or provide any monetary reward for subscribing.

c. Material Terms, Value, and Right to Withdraw

The material terms of each program are stated above and where the program is presented to you. For the referral program, we make a good-faith estimate of the value of the personal information involved based on the expense we incur to fund the incentive — up to ten dollars ($10) per successful referral reward — which is a reasonable approximation of the value of the related data to our business, calculated by reference to that expense. For the newsletter, we do not provide monetary compensation and assign no monetary value to enrollment; we consider the value of the related personal information to be de minimis. We offer these incentives in the good-faith belief that any difference in treatment is reasonably related to the value the associated data provides to us and is permitted under applicable law.

Participation is voluntary and you may withdraw at any time without penalty: for the referral program, simply stop referring or participating; for the newsletter, unsubscribe using the link in any newsletter email or by contacting us. Withdrawing does not affect any credit or discount already validly earned. Enrolling in these programs is not a condition of using the Services, and we do not deny you services, charge you a different price, or provide a different level or quality of Services because you decline to participate, other than the incentive benefits themselves as described above.

18. Children's Privacy

The Services are intended only for individuals who are eighteen (18) years of age or older. We do not knowingly collect personal information from anyone under 18, and we do not direct the Services to children. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us personal information, please contact us at hello@handy-circle.com.

19. Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting. There is no consistent industry standard for how to respond to DNT signals, and we do not currently respond to browser DNT signals. We do, however, automatically honor the Global Privacy Control (GPC) signal as an opt-out of the sale/sharing of personal information, as described in the "Do Not Sell or Share" section.

20. Third-Party Links & Services

The Services may link to or integrate third-party websites, services, and processors, including those identified in this Policy. We are not responsible for the privacy practices or content of those third parties, and their processing of your information is governed by their own privacy policies. We encourage you to review the privacy policies of any third party before providing them with your information.

21. International Users / U.S.-Only Service

The Services are intended for use only within the Commonwealth of Massachusetts, United States, and our operations and data storage are based in the United States. We do not offer the Services to individuals outside the United States, and this Policy is drafted to address U.S. federal and state law. If you access the Services from outside the United States, you do so at your own initiative and are responsible for compliance with local law, and you understand that your information will be processed in the United States.

22. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this Policy and, for material changes, provide additional notice as required by law, such as by email or an in-app or on-site notice. Your continued use of the Services after an update becomes effective constitutes your acknowledgment of the revised Policy, except where a change requires your consent under applicable law.

23. Contact Us / How to Exercise Rights

If you have questions about this Policy or wish to exercise your privacy rights, contact us:

• Handy Circle, Inc.
• Attn: Privacy
• 56 Broad St STE 14252, Boston, MA 02109, USA
• Email: hello@handy-circle.com
• Phone: (857) 214-8626
• Website: https://www.handy-circle.com

We will respond to your inquiry or request as required by applicable law. To help us respond efficiently, please tell us the nature of your request and the state in which you reside.