Legal
Privacy Policy
Last updated 19 October 2026.
Handovha is operated by [Your name or business, country] ("we", "us"). This page explains what personal data we collect when you use Handovha, why, and what your rights are.
What we collect
- Account: your email address. We use magic-link sign-in — there's no password to store.
- Handover records: the object being handed over, its location, and both parties' names, email addresses, and (optionally) ID numbers — plus any photos and signature images you attach, and the date the handover was completed. For each signature we also keep, privately, the account that signed, its IP address and browser details, so a signature can be traced if it's ever disputed; none of this is shown on the certificate.
- Billing: if you buy handover credits, payment is handled entirely by PayPal, our payment processor — we never see or store your card or PayPal account details ourselves. Unlike a merchant-of-record provider, Handovha (not PayPal) is the seller of record for these purchases.
- Cookies: a session cookie and a CSRF token (both required for the site to work), a first-party visitor id (
hv_vid, kept up to a year, used only to count unique visits), and a first-touch marketing-attribution cookie (hv_attr, kept up to 90 days). We don't use third-party advertising or tracking cookies. - Basic analytics: page views, referrers, and a coarse country code resolved locally from your IP address at the moment of the request — we don't store your raw IP address.
Why we collect it
To let you create and share handover certificates, to email you (sign-in links, certificates, support replies), to process credit purchases, and to understand how the product is used so we can improve it. We don't sell your data, and we don't use it for advertising.
Who we share it with
Only the service providers that help us run Handovha: Mailgun (sends transactional email on our behalf) and PayPal (processes credit-purchase payments). We don't share your data with anyone else.
Who can see a completed certificate
The full certificate — object, location, names, ID numbers, signatures, photos and the PDF — is visible only to the people on the handover and the team that created it, once they sign in. The QR code on the PDF opens that same certificate, so it only works for those signed-in people; for anyone else it shows nothing.
How long we keep it
For as long as your account is active. Completed handovers are kept as a permanent record (that's their purpose — a certificate that could be quietly deleted wouldn't prove anything). Contact us if you'd like your account and its data removed.
Your rights
If you're in the EU/EEA or UK, you have the right to access, correct, export, or delete your personal data, and to object to how we process it, under the GDPR. To exercise any of these, email support@handovha.com.
Governing law
This policy is governed by the laws of [governing law / country].
Contact
Questions about this policy or your data: support@handovha.com.