Data processing terms

Last updated 28 August 2026. Launch legal review is still pending.

Hands is a Kijko product operated by Kijko Labs B.V., a Dutch private limited company registered with the Chamber of Commerce under number 42159010, VAT ID NL869973484B01. Visiting address: Torenlaan 5 t/m 5B, 1402 AT Bussum, Netherlands. Contact: [email protected]. Phone: +31 970 065 33744.

1. Two roles, kept apart

There are two kinds of data here and they are governed differently.

Data	Our role	Governed by
Your account, subscription and billing	Controller — we decide why and how	Privacy statement
Whatever lives on your Hand's sandbox	Processor — you decide, we execute	This page

These terms form part of the terms of service and apply automatically. You do not need to sign anything separately.

2. Subject matter and duration

We provide one or more dedicated Sprite Linux runtimes and workspaces. Processing for an individual Hand ends when you delete it. Processing for remaining Hands continues while your account retains them, including while billing access is paused, and ends when you delete the Hands or ask us to delete the account.

3. Nature and purpose

Storing files, running the commands your AI issues, and taking checkpoints so the Hand can be restored. Hands does not use sandbox contents to train AI models. The service reads or processes content only when needed to carry out your instructions, such as displaying, moving or changing a file.

4. Categories of data and data subjects

Entirely your choice, and unknown to us in advance. Whatever you or your AI put there. You are responsible for having a lawful basis for it, and for not putting things there that do not belong in a general-purpose workspace.

Hands is not designed for special categories of personal data under Article 9 GDPR, nor for criminal-offence data. Do not use it for those.

5. Our obligations

• We process only on your documented instructions — using the service is the instruction.
• Everyone with access is bound to confidentiality.
• We keep appropriate technical and organizational measures in place (clause 7).
• We help you respond to requests from data subjects, and with your DPIA if you need one.
• We tell you without undue delay if we become aware of a personal data breach affecting your data.
• An individually deleted Hand is removed immediately; after full subscription termination, remaining sandboxes and checkpoints stay stored until you delete them or request full account deletion.
• We make available the information you need to demonstrate compliance.

6. Sub-processors

You give general authorization only for the parties in the “Confirmed Hands sub-processors” table on the sub-processors page. They are bound to equivalent obligations, and new confirmed sub-processors appear in that table before they begin processing. The separate optional-provider table is not included in this authorization.

Note in particular that your Hand's region is assigned automatically and its storage sub-processor is established in the United States. Transfers involving confirmed sub-processors rest on the standard contractual clauses in each confirmed sub-processor's data processing agreement. If a strict EU-only guarantee is what you need, Hands cannot give you that today.

7. Security measures

• Each Hand runs in its own Sprite Linux runtime and workspace; website-side ownership checks bind it to its account owner.
• Access requires a per-Hand key that you can rotate at any time.
• Public web and connector endpoints use HTTPS/TLS.
• Account passwords are stored as scrypt hashes with a per-user salt.
• Checkpoints belong to the Hand's Sprite workspace and restore into that Hand.

8. Audit

You may ask for the information needed to verify these obligations. Where an on-site audit is genuinely necessary, we will agree a reasonable time and scope. For the underlying platform we pass through what our providers publish.

9. Liability

The limits in clause 10 of the terms of service apply here too, except where the GDPR does not permit them.