Privacy statement
What we collect, why, how long we keep it, and who else touches it.
1. Who is responsible
Hands is a Kijko product operated by Kijko Labs B.V., a Dutch private limited company registered with the Chamber of Commerce under number 42159010, VAT ID NL869973484B01. Visiting address: Torenlaan 5 t/m 5B, 1402 AT Bussum, Netherlands. Contact: [email protected]. Phone: +31 970 065 33744.
For your account and billing data, Kijko Labs B.V. is the controller. For the files and content inside your Hand's sandbox, Kijko Labs B.V. acts as a processor on your behalf: you decide what goes in there and why. See the data processing terms.
2. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Email address, and name if you give one | To create your account, sign you in, and send essential trial-expiry and service messages about your Hand | Performance of the contract |
| Country of residence or establishment, customer type, and the legal organization name for business or public-sector accounts | To apply the current Hands launch-geography, sanctions and export-control admission policy after authentication and before service access or provisioning a Hand | Performance of the contract and compliance with applicable legal obligations |
| Email address submitted through the social-community waitlist | To send you an invitation or launch update when the Hands community opens | Your consent, which you can withdraw at any time |
| Password, stored as a scrypt hash with a per-user salt | To sign you in. The password itself is never stored. | Performance of the contract |
| Google account identifier, if you sign in with Google | To recognize you on your next visit | Performance of the contract |
| Privacy-limited Google Analytics events on approved public pages and named signup and activation milestones, only after you allow analytics | To understand acquisition and whether users reach the key activation stages up to a first useful output | Your consent, which you can refuse or withdraw at any time |
| The name and avatar you give your Hand, and its machine name | To provision and find your sandbox | Performance of the contract |
| Your Hand's connector URL and access key | To let your AI reach your Hand, and only yours | Performance of the contract |
| Your encrypted Nango Environment API key, selected connection metadata and action allowlists, plus confirmation-proposal inputs and results, only if you enable Nango BYOK | To route actions from your Hand through the Nango account you own and execute an approved proposal exactly once | Performance of the contract and processed on your instructions |
| Your Firecrawl OAuth authorization and connection metadata, plus the search query, public target URL, domain or path filters, crawl settings, and returned URL or page data processed when you use the optional Firecrawl connector | To authenticate the Firecrawl account you selected and execute only the fixed Search, Scrape, Map and reviewed Crawl actions through the central Hands broker | Performance of the contract and processed on your instructions |
| Whatever you or your Hand put on the sandbox | It is your workspace; we do not read it | Processed on your instructions |
| Subscription status and payment events from Stripe | To know whether your Hand should be running | Performance of the contract, and a legal obligation for invoicing |
| Server logs, kept short | To find faults and abuse | Legitimate interest in a service that works and is not misused |
With your analytics consent, Hands uses Google Analytics 4 to understand acquisition on approved
public pages and a narrow signup and activation funnel. The only product milestones eligible for
Analytics are signup_started, account_created, hand_ready,
ai_connected and first_useful_output, on the routes where they are
explicitly allowed. There is no general product-navigation or console page-view tracking.
Hands does not send query strings or URL fragments, page referrer/title, email, account or Hand identifiers/names, secrets/tokens or free-form text to Google Analytics. Google necessarily receives technical network and browser data needed to process an Analytics request; for EU, UK and Swiss traffic Google states that IP addresses are used for geolocation and discarded before they are logged. Google Signals, user-provided data collection and advertising personalization are not enabled. We do not use Analytics for automated decision-making with legal effect.
3. Card details
We never receive them. When you open Stripe's hosted checkout or customer portal, card data goes straight to Stripe. We send Stripe your account name, email address and an internal account identifier, and receive the subscription identifiers, status and payment events needed to run your plan. The 7-day one-Hand base trial and the one-time 7-day referral extension do not require a payment method. Stripe receives card details only when you choose to activate a paid plan or add a second or third Hand.
4. Who else processes your data
Your Hand runs on Fly.io Sprites. The Sprites create/get contract used by Hands does not currently expose a region selector or region field, and a live blank-Sprite check did not expose a runtime region variable. Hands therefore does not promise EU-only runtime or data residency. Provider confirmation about compute placement, storage, checkpoints and recovery is pending.
If you allow analytics, approved measurement data is sent to Google Analytics 4 under the privacy boundary described above. Google is listed on our sub-processors page.
If you enable Nango BYOK, your Hand sends the actions and data you request to Nango under the Nango account and agreement you control; Hands stores the Environment API key encrypted and never shows it again after submission. The full list, and the basis for those transfers, is on the sub-processors page.
If you connect Firecrawl, Hands' central broker sends the action data you request — search queries, public target URLs, filters and crawl settings — to Firecrawl under the terms and account agreement applicable to the Firecrawl account or workspace you select, and returns the results to your Hand. Firecrawl states that its servers and stored data are in the United States. Hands asks Firecrawl not to place Scrape and Crawl page data in its index or cache, and Map bypasses Firecrawl's sitemap cache. Search does not request Firecrawl's enterprise zero-data-retention options, so this connector does not promise zero data retention.
5. How long we keep it
- While your subscription runs — your account, Hands and sandbox contents are kept.
- When you delete one Hand — its sandbox, files, checkpoints and stored connector credentials are removed immediately. Its Nango bindings and their confirmation proposals and results are removed too. Where supported, we also ask the provider to revoke the authorization.
- When you disconnect Nango BYOK — the encrypted Environment API key, all Nango bindings, and their confirmation proposals and results are removed from the central Hands account state immediately, and every Nango runtime capability is revoked immediately. Derived runtime configuration copies on individual Hands are removed during synchronization/reconciliation and are not guaranteed to disappear from every runtime instantly. Data retained by Nango remains governed by your own Nango account and agreement.
- When you disconnect Firecrawl — Hands withdraws the Hand's runtime authority, removes the centrally held OAuth authorization and requests provider revocation. That operation does not promise deletion of data Firecrawl may already retain; provider-held data remains governed by the terms and account agreement applicable to your Firecrawl account or workspace and Firecrawl's deletion process.
- Nango confirmation proposals — execution and replay expire 15 minutes after preparation. A locked cleanup pass removes their stored input and result after expiry; it runs every minute while the service is running and again at startup after an interruption. Removing the binding, rotating the Environment API key or disconnecting Nango removes them earlier. Evaluation usage counters contain counts only and remain for the active trial window when Nango is disconnected or reconnected.
- After a trial expires or paid access ends — access is blocked and the remaining Hand services are paused; their sandbox data stays stored. After a failed renewal, a 7-day payment grace period applies first.
- Until deletion — we keep remaining sandboxes and checkpoints until you delete each Hand or ask us to delete your account. There is currently no automatic deletion after a fixed period.
- When you permanently delete your account — your account and every remaining Hand, sandbox, file, checkpoint and stored connector credential are removed immediately. Invoicing records that we are legally required to keep remain restricted to that purpose.
- Social-community waitlist — active contact details are kept for the community-launch purpose until you withdraw or the launch purpose ends. Withdrawal removes the address from marketing eligibility immediately. If a marketing message was sent, we may keep the minimum consent, send and suppression evidence needed to demonstrate that earlier authority for five years after that send; that retained proof is not permission to contact you again.
- Analytics event and user-level data — configured for a two-month retention window in Google Analytics. Withdrawing consent stops new measurement immediately; Analytics cookies are removed from this site when you withdraw through Analytics preferences.
- Invoicing data — kept for seven years, because Dutch tax law requires it.
- Server logs — kept short and then rotated away.
6. Cookies and analytics consent
Hands always uses the strictly necessary signed session cookie that keeps you logged in. Google Analytics cookies are optional and are used only after you allow analytics. You can continue without analytics and change or withdraw your choice at any time through Analytics preferences. Details are on the cookies page.
7. Your rights
You can ask for access, correction, deletion, restriction and portability, and you can object to processing based on legitimate interest. From the account view in your console you can download a portable copy of your account metadata or permanently delete your full account yourself.
For content inside your sandbox that we process on your instructions, ask us and we will act on it — but you are the one who decides what happens to it.
If you think we are getting this wrong, tell us first. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Security
Each Hand runs in its own Sprite Linux runtime and workspace with a per-Hand access key. Website-side ownership checks bind that Hand to its account owner. Passwords are hashed with scrypt. Sessions are signed and expire. Public web and connector endpoints use HTTPS/TLS.
If you find a hole, the contact page explains how to report it.
9. Changes
Material changes are announced by email before they take effect. The date at the top always reflects the current version.