Who is responsible
The controller is the operator named in the imprint. You can reach us for every privacy question at the email address given there.
Your account
We store your email address to sign you in with codes, and what you publish: username, name, bio, images and links. Uploaded images are re-encoded, which removes embedded metadata such as location.
Sign-in sessions are kept in a cookie that only our API can read. It is strictly necessary and needs no consent. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Visits to profile pages
When someone opens a profile page or one of its links, we record the time, device type, browser and operating system (from the browser's User-Agent), the country (from the network edge) and the website the visitor came from. We do not store IP addresses and set no cookies for this.
To count unique visitors we compute a short code from the IP address, the User-Agent and the profile with a random key that changes every day and is then deleted, so visits cannot be linked across days or profiles. Legal basis: our legitimate interest and the profile owner's in reach statistics (Art. 6(1)(f) GDPR).
Only with your consent we also record your screen size class and how you use handle.plus's own pages. You can change this at any time under Privacy settings.
Payments
Paid plans are processed by Stripe, which acts as an independent controller for payment data. We receive the payment status, never your card details.
Service providers
Cloudflare (hosting of this website and network protection) and Scaleway (sending emails, France) process data on our behalf under data processing agreements. Our servers and database run in the EU.
How long we keep data
Account data until you delete your account. Visit records for 400 days, product usage records for 180 days. Consent decisions as long as your account exists, as proof of consent.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time with effect for the future. You may complain to a data protection supervisory authority.