Three commitments do most of the work here, and the rest of this document explains how we keep them:
Handy Partners is the controller for data about our own customers — the people who sign up, pay and administer courses. Our corporate and registration details are available on request at taras.kornichuk@handy.partners.
For data about students using an assistant, and for the course material itself, we act as a processor. The educator or institution that created the course is the controller and decides why the data is processed. We act on their documented instructions, which is what these terms and the product's settings amount to.
Institution customers who need a formal Data Processing Agreement should write to taras.kornichuk@handy.partners; we will sign one.
| Category | Examples | Why |
|---|---|---|
| Identity | Name, email, institution, role | Create and secure your account |
| Authentication | Sign-in identifiers, session tokens | Let you in and keep others out |
| Billing | Plan, invoices, partial card details held by our payment processor | Take payment, meet tax obligations |
| Usage | Courses created, documents uploaded, feature use | Operate the Service, plan capacity |
| Support | Messages you send us | Answer you, and improve what confused you |
| Technical | IP address, browser and device type, error traces | Security, abuse prevention, debugging |
We never see your full card number. Payments are handled by our payment processor, who is PCI-DSS compliant and named in our Data Processing Agreement.
Deliberately little. When a student uses an assistant we process:
Two points worth stating plainly. First, topic analytics shown to educators are aggregated — they report which topics generated questions and which questions found nothing, not who asked what. Second, a student's free text is their own: educators can see conversations in their course, so students should be told that, and we recommend saying so in your course introduction.
We ask that students not be encouraged to put sensitive personal information into the assistant. It is a tool for asking about course material.
Material you upload is stored, split into chunks, converted into embeddings and indexed for retrieval, all within your tenant. It is used to answer questions in your course and for nothing else.
If you upload documents containing personal data — a seminar transcript naming students, for instance — that data is processed as part of the material, and you are the controller for it. Please only upload what you have a lawful basis to upload.
Where the GDPR or UK GDPR applies, we rely on:
For student data we act on the controller's instructions; that controller determines the legal basis, typically public task or legitimate interests for an educational institution.
To generate an answer, the retrieved passages and the conversation are sent to the model provider selected for that course — Anthropic, OpenAI or Google — routed through OpenRouter.
You control which provider is used, per course, and can change it at any time.
| Sub-processor | Purpose | Region |
|---|---|---|
| OpenRouter | Routing answer requests to the model provider you selected | Named in our DPA |
| Anthropic | Answer generation, where you select a Claude model | Named in our DPA |
| OpenAI | Answer generation, where you select a GPT model | Named in our DPA |
| Answer generation, where you select a Gemini model | Named in our DPA | |
| Cloud hosting provider | Application and database hosting | Named in our DPA |
| Object storage provider | Storing the documents you upload | Named in our DPA |
| Payment processor | Subscriptions and invoicing | Named in our DPA |
| Transactional email provider | Account and notification email | Named in our DPA |
The current list, naming each provider and its processing region, is maintained in our Data Processing Agreement and sent on request to taras.kornichuk@handy.partners. We give at least 30 days' notice before adding a sub-processor that handles personal data, so you can object. Ask at the same address to join that notification list.
Our primary hosting region is stated in our Data Processing Agreement and confirmed on request. Some sub-processors operate outside it. Where personal data leaves the EEA or UK, we rely on adequacy decisions where they exist and otherwise on Standard Contractual Clauses with supplementary measures. A copy of the mechanism used for any given transfer is available on request.
Institution customers who require data residency in a specific region should raise it before signing — we can discuss it as part of the Institution plan.
| What | Kept for |
|---|---|
| Course material and its embeddings | Until you delete it or close the course |
| Conversations | Until the course is deleted, or a shorter period you set |
| Aggregated topic analytics | Retained after conversations are deleted; contains no free text |
| Account and billing records | Duration of the relationship, then 7 years for tax |
| Application logs | 30 days |
| Encrypted backups | 30 days, then overwritten |
The security page describes the isolation model in detail. In summary: encryption in transit and at rest, tenant scoping enforced on both the request path and inside every background job, scoped logging, least-privilege access for staff, and adversarial review of changes that touch isolation or grounding.
If your procurement process needs evidence beyond this — a completed security questionnaire, our DPA, or detail on a specific control — write to engineer@handy.partners and we will work through it with you.
Where data protection law applies you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where consent is the basis. You will not be treated worse for exercising any of these.
Write to taras.kornichuk@handy.partners and we will respond within 30 days. We may need to verify who you are first.
Students: if your request concerns a course assistant, please contact your educator or institution first — they are the controller for that data and we act on their instructions. If you cannot reach them, contact us and we will help route it.
You may also complain to your local supervisory authority. In Ukraine that is the Ombudsman's office; in the EU it is your national data protection authority.
This marketing site sets no cookies and runs no analytics. There is no consent banner because there is nothing to consent to. Your dark/light theme preference is kept in your browser's local storage and never leaves your device.
The application at app.handy.partners sets only what is strictly necessary: a session cookie to keep you signed in, and a CSRF token. Both are essential, neither tracks you across sites, and both expire when your session ends or shortly after.
The Service is built for higher education and professional training and is not directed at children under 16. If you intend to deploy it to under-16 learners, you are the controller for that decision and must have the appropriate consents and safeguarding measures in place under your local law. Tell us before you do, so we can confirm the configuration is appropriate.
If a personal data breach occurs that is likely to result in a risk to people's rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify affected customers without undue delay. Where we act as processor, we will notify the controller without undue delay so they can meet their own obligations.
Our notification will say what happened, what data was involved, what we have done, and what we recommend you do — in plain language, not a press release.
We will post material changes here with at least 30 days' notice and email account administrators. Every version is dated and archived.
Privacy questions and rights requests: taras.kornichuk@handy.partners. Our privacy contact is Taras Kornichuk. If you need a postal address for a formal request, ask at that email and we will provide it. For anything less formal, the contact form is quicker.
Upload your material, pick a model, share the link. Most courses are answering questions the same afternoon.