What Handoro processes, why, who receives it and how long it is kept.
Which law applies. Handoro is operated from the United Kingdom, so this policy is written to the UK GDPR and the Data Protection Act 2018. Those are the laws we answer to, and the Information Commissioner's Office is our supervisory authority. Nothing in this policy asks you to give up a right the law gives you, and where a sentence here is narrower than the law, the law wins.
Where Handoro is offered. Handoro is offered in the United Kingdom only. That is the whole app rather than only the marketplace: the assistant for repairs you do yourself is offered there too, and we do not offer or market Handoro anywhere else. If you are outside the United Kingdom and have the app anyway, everything below still describes what we do with your data, and you can still write to us about any of it.
The article numbers below are those of the UK GDPR, the General Data Protection Regulation as it forms part of the law of the United Kingdom, defined in section 3(10) of the Data Protection Act 2018. They are the same numbers as in the EU Regulation, so if you have read a European privacy notice these will look familiar. The law being applied here is the United Kingdom one, and the regulator is the ICO.
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Email + user ID from Apple/Google | Account creation and security | Contract 6(1)(b) |
| DIY chat content | Answering your question | Contract 6(1)(b) |
| Photographs sent to the repair assistant, and still frames taken on your device from a video you choose | Diagnosing the fault you are asking about | Contract 6(1)(b) |
| Job description | Building the request you approve, and ranking suggestions | Contract 6(1)(b) |
| Photographs and one video attached to a job request | Showing the chosen tradesperson the fault so they can price it | Consent 6(1)(a), given separately at the moment of approval |
| The job's address, and the coarse area it is in | Letting a tradesperson quote, and reach you once you accept | Contract 6(1)(b) |
| Your device's location, if you tap "use my location" | Filling in that address for you, one reading at that moment | Consent 6(1)(a) |
| A tradesperson's listing: name, trades, service area, hourly/daily rates, rating | Letting customers find and compare them | Contract 6(1)(b) with the tradesperson |
| A tradesperson's phone number | Messaging them about jobs; releasing it to a customer who asks to contact them directly | Contract 6(1)(b), and consent 6(1)(a) for the WhatsApp channel specifically |
| Message transcript | Resolving a dispute about what was quoted | Contract 6(1)(b) |
| Agreed price and commission record | Charging the tradesperson our fee, and our own accounting | Contract 6(1)(b); legal obligation 6(1)(c) for the tax record |
| A tradesperson's identity and trade documents, as images or PDFs they upload | Checking they are who they say they are before the badge is shown to customers | Contract 6(1)(b) with the tradesperson; legal claims 6(1)(f) for keeping the outcome |
| A rating a customer leaves about a tradesperson: stars, optional comment, which job | Publishing an average on the listing, and ranking suggestions | Contract 6(1)(b) with both of them |
| A tradesperson's billing details: business name, address, country, tax number | Issuing a valid invoice and determining the correct tax treatment | Contract 6(1)(b); legal obligation 6(1)(c) |
| A reference to their saved payment method | Charging commission when a job is agreed | Contract 6(1)(b) |
| Disclosure record | Evidence the message was sent lawfully | Legal obligation / legal claims 6(1)(c), 6(1)(f) |
| Do-not-contact record | Ensuring that number is never messaged again | Legal obligation 6(1)(c) |
There are two separate paths and they are not the same, so they are described separately.
Sent to the repair assistant. Photographs you attach to a question go to the AI model that answers it, and nothing is stored: they are held in memory for the length of the request and the chat history keeps a count rather than the images. If you choose a video, the app takes a few still frames from it on your own phone and sends only those. The video itself and its sound never leave your device. That is deliberate: the model cannot read video at all, and a sound track recorded in a home carries other people's voices, which has nothing to do with a broken tap.
Attached to a job request. Up to two photographs and one video can be attached to a job request. These are different in three ways that matter. They are stored, in the same London region as everything else. They are sent to another person, the one tradesperson you chose, over WhatsApp. And that person is not our processor: they are a separate business who has been shown your photograph, and what they do with it afterwards is governed by our agreement with them and by law, not by an instruction from us.
Nothing is uploaded until you approve the request. Before you do, the app shows you what will be sent, names the person it will go to, and asks you to tick a box confirming it. The sentence you read is stored word for word alongside the media, in the language it was shown in, so what is on record afterwards is what you were actually told.
Delivery happens only after that tradesperson replies to the first message, never before.
Once delivered, media cannot be recalled. A copy exists on that person's phone, in WhatsApp's systems and in whatever backup their phone runs. We can delete our copy and we will, on request or when the job record expires. We cannot reach theirs. This is said here, and again on screen before anything is sent, because it is the one part of this product that no later decision of ours can undo.
Location metadata is stripped from every photograph at the moment you pick it. A picture taken inside a home carries that home's coordinates, and this product goes to some trouble to give a tradesperson a district rather than a door number until you accept a price.
Until 2026-08-28 a customer typed in the number of someone who had never heard of us, and we relied on legitimate interests to contact them. That is no longer how the app works. A tradesperson now signs up, gives their own number, and ticks a separate box agreeing to be messaged on WhatsApp, a box with its own visible sentence rather than a line buried in the terms. The exact wording they agreed to is stored with the consent.
Three controls survive that change, because consent can be withdrawn and because none of them depended on the old basis: the first message says it is an AI, it says how to stop it, and a reply of STOP blocks that number permanently and takes the listing down. Numbers in the block list are stored only as a keyed HMAC, so the list is not a list of phone numbers.
A customer may also ask for a tradesperson's number to ring them directly. It is not shown in the directory. It is released one at a time, and each release is logged, so a tradesperson asking "how did this person get my number" has an answer.
A tradesperson who wants the verified badge uploads documents, as photographs or PDFs: proof of identity, and where the trade requires it, a certificate or registration number. Only tradespeople do this. A customer never uploads a document of this kind and is never asked to.
They are not special-category data, because of what we do not do with them. We read the document to check a name and a date, with human eyes. We do not run facial recognition, we do not extract a biometric template, and we do not compare a face to a photograph. An identity document becomes Article 9 data when it is processed for the purpose of uniquely identifying someone biometrically, and that is a processing operation we do not perform.
No client can read them. Not another tradesperson, not a customer, not the app the tradesperson uploaded from. The storage rules deny every read on that path, because a readable path holding identity documents is one leaked token away from being an enumerable archive of them. What the tradesperson sees in their own account is the list of what they sent, when, and what state it reached, which is drawn from a separate record.
They are destroyed 30 days after the check is decided, automatically, by a job that runs every night. What survives is the outcome, meaning that the person was verified or was not, when, and which types of document were examined. That is the part with a continuing purpose: it is the evidence the badge on a public listing was earned. It contains no document.
Verification is a check of the documents we were given. It is not a guarantee to customers about anyone's work, and the app says so wherever the badge appears.
A tradesperson quoting for your job is told the district, not your street address. The full address is released to them only once you have accepted a price, and this is enforced rather than promised: it is stored in a separate record that our security rules will not hand over until the job's status says accepted.
If you tap "use my location", we read your position once to fill the address in, and you can then edit it. There is no background tracking, and we do not keep the coordinates. What is stored is the address text you confirmed.
Finding a tradesperson requires Handoro Pro or Handoro Premium. On a free account no suggestion is made, no listing is read and no model is called, so there is no processing to describe here at all. Until 15 September 2026 a free account was shown one tradesperson drawn at random, and the description was read to work out which trade the job needed; neither happens now.
On Handoro Pro and Handoro Premium, an AI model ranks the tradespeople who could do the job. The main parameters, in descending order of importance, are: how well the trade fits your description, their rating, whether they are verified, their price, how far they are from the job, and their availability. What reaches the model is your job description and the candidate listings. It is not given your name, your address or your contact details. Nobody pays to appear higher. If the model is unavailable the app orders the same list by the same parameters mechanically instead, and says so on screen.
The ranking decides the order in which names are shown to you. It decides nothing about you, it produces no score attached to your account, and nothing about it is kept as a profile once the suggestions have been shown.
If you rate a tradesperson after accepting a price, we store the stars, your optional comment, which job it refers to and which account left it. The lawful basis is our contract with you and with the tradesperson, Article 6(1)(b): a marketplace where nobody can say how the work went is not the service either of you agreed to.
The stars become part of a published average on that tradesperson's listing, shown with a count and with nothing that identifies who left it. The comment is not published: it can be read by that tradesperson and by us, and by nobody else.
If you delete your account, the link between you and any rating you left is erased and the stars stay in the average. That is a deliberate limit on erasure, and the reason is in the retention section below.
The negotiation agent is an AI system that interacts directly with a natural person, so that person is informed they are interacting with an AI before anything else is said. On WhatsApp that sentence sits inside the message template approved by the platform, so it cannot be varied per send. The disclosure is delivered verbatim from a fixed script that the model cannot rewrite, and the exact words delivered are recorded.
We sell nothing to anybody and we run no advertising, so this list is short and it is the whole of it.
Receiving data today:
europe-west2 (London, United Kingdom).Not receiving anything today, listed so the position is clear rather than discovered later:
Where the data sits. At rest it is in the United Kingdom. For users in the EEA that is a transfer out of the EEA, and it relies on the European Commission's adequacy decision for the United Kingdom.
Anthropic and RevenueCat process data in the United States, which is outside both the UK and the EEA. Those transfers are made under the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, as set out in each provider's data processing addendum.
One recipient is not a processor at all. A tradesperson you send photographs or video to receives them as a separate business making its own decisions, not as someone acting on our instructions. What they may do with them is set out in our agreement with them, and it is summarised for you above.
Every period below is enforced automatically rather than by somebody remembering to run something. Most are enforced by the database itself, which deletes the record when its date arrives. The two that are files rather than records, meaning job photographs and a tradesperson's documents, are enforced by a job that runs every night, because a stored file has no expiry date of its own to act on.
| What | How long | Why that long |
|---|---|---|
| Your job requests and negotiations | 1 year | Covers a normal warranty or complaint cycle |
| The message exchange with a tradesperson | 180 days | Long enough to settle a dispute about what was quoted, and the only place the exact words of an agreed figure exist |
| Photographs and video attached to a job request | Deleted with the request they belong to, so 1 year at most | They exist to show a tradesperson one fault |
| Conversations with the repair assistant | 90 days, or sooner if you delete them | Kept only for conversational context and to investigate a bad safety refusal. You can delete any chat, or all of them, in the app without waiting |
| A tradesperson's identity and trade documents | Destroyed 30 days after the check is decided | The check is over. What has a continuing purpose is the outcome, not the scan |
| Ratings a customer left | Kept, with the link to the customer erased if they delete their account | The stars are part of an average other customers have relied on, and cannot be quietly rewritten |
| Disclosure records | 10 years | The limitation period for a claim about the contact. Held as a keyed digest, never as a number |
| Do-not-contact records | Indefinitely | An expiring block is not a block |
| Commission records and invoices, and the billing details on them | As long as tax law requires | An accounting document. The period is not ours to choose |
Two things are kept for no time at all. Photographs you send to the repair assistant are never written to disk: they are held in memory for the length of the request and the chat history stores a count instead of the images. A video you show the repair assistant never leaves your phone in the first place, so there is nothing of it to keep.
Nothing records audio, so there is no recording retention period.
Deleting your account removes everything above except the rows whose reason in the right-hand column outlives the account: disclosure records, do-not-contact records, commission invoices, and ratings you left, which stay as stars in a tradesperson's average with the link to you erased.
Everything else goes, and it goes at once rather than waiting for its period to run out: your job requests and the addresses in them, the photographs and video you attached, your negotiations and the message exchanges inside them, your conversations with the repair assistant, and, if you listed yourself as a tradesperson, your listing and the documents you sent us for verification. The listing stops being visible to anyone in the same moment.
You have the right of access to the data we hold about you, and the rights to have it rectified, erased, its processing restricted or objected to, and to receive it in a portable form. Where we rely on legitimate interests you may object to that specifically.
Most of this is already in your hands and does not need us: Account in the app has Download my data and Delete my account, and both take effect immediately without review. For anything else, write to info@safeimai.com and we answer within one month. Asking costs nothing.
Withdrawing consent. Two things here run on consent rather than contract: the photographs and video you attach to a job request, and the single location reading when you tap "use my location". You can withdraw consent at any time and it is as easy to withdraw as it was to give. Withdrawing does not make what happened before it unlawful, and for media already delivered to a tradesperson it cannot reach their copy, which is why the app asks you to confirm that separately before anything is sent.
Decisions are yours, not the model's. An AI ranks tradespeople and conducts the negotiation, but it does not decide anything about you: no price is booked and no job is agreed until you approve it on screen. If you would like a person to look at how a suggestion or a figure came about, ask us and one will.
If you are a tradesperson. Reply STOP to any message. You will not be messaged again, your listing comes down at the same time, and it takes effect immediately. If you no longer have the message, email info@safeimai.com from any address with the number and we will do it for you. Three things survive: the disclosure record, because it is the evidence the contact was lawful (Art. 17(3)(e)); the do-not-contact entry itself, because deleting it would restart the messages; and commission invoices, which tax law requires us to keep. Removing your saved payment method is a separate action and takes effect immediately.
If you think we have got something wrong, tell us first. We would rather fix a mistake than argue about one. You can also complain to a supervisory authority without asking us first, and we will never make dealing with your complaint conditional on you not doing so. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk); in the EEA it is the authority where you live.
Handoro is not directed at anyone under 18.
The data controller is SAFEIM.AI LTD, a company registered in England and Wales under company number 17342838, with its registered office at 2nd Floor, College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom. We have not appointed a data protection officer, because the scale and nature of what we process does not require one under Article 37, and we have not appointed a representative outside the United Kingdom because the marketplace operates here only. Questions about anything in this policy, and every request described under "Your rights", go to info@safeimai.com and are answered by us directly rather than by an agent.
This version of the policy is dated 2026-09-16. We keep earlier versions and can send you the one that was in force on a particular date if you need it.