Privacy Policy
Last updated: 3 July 2026
This policy explains what information Handover collects, why, where it is stored, and what rights you have over it. Plain English, no dark patterns.
Who we are
Handover is a service operated by Northern Tech Ltd, a company registered in Scotland. We are the data controller for the personal information described in this policy. You can reach us at hello@northerntechltd.com.
What we collect
- Account information: your email address, and (optionally) your name, business name, VAT number and phone number.
- Property information: the nickname, address and cleaning notes you enter for each property you add.
- Calendar data: the iCal URLs you paste in, and the checkout / check-in dates we read from them. We do not read or store guest names.
- Cleaner information: the name, email and phone number you enter for each cleaner. A random access token is generated so they can view their jobs without creating an account.
- Payment metadata: if you upgrade to a paid plan, Stripe stores your card details on our behalf. We only receive a customer identifier and subscription status.
- Technical logs: standard server access logs (IP address, timestamp, page requested) kept for up to 30 days for security and debugging.
Why we collect it
We use the information above to run the Handover service you signed up for: syncing your calendars, generating cleaning jobs, letting your cleaners see their schedule, and billing you if you upgrade. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)) for account and payment data; legitimate interest (Article 6(1)(f)) for security logs.
Where your data lives
Your account data and property data are stored in a Supabase Postgres database hosted in London (AWS eu-west-2). Your data never leaves the UK / EU for storage. Static files and server functions run on Vercel's edge network, which may terminate requests in your nearest region for performance.
Who else sees it
We use the following processors:
- Supabase (database and authentication) — data stored in London.
- Vercel (application hosting).
- Stripe (payment processing) — only used if you upgrade.
- Resend (transactional email delivery for magic-link sign-in).
We do not sell your data. We do not share it with advertisers. We do not train AI models on your data.
Cookies
We use one strictly-necessary cookie to keep you signed in. We do not run any advertising or analytics tracking cookies. That is why you do not see a cookie banner.
How long we keep it
- Account data: until you delete your account.
- Property, cleaner and job data: until you delete it or close your account.
- Server access logs: up to 30 days.
- Stripe records: retained by Stripe per their retention policy and UK financial-record rules (typically 7 years for tax purposes).
When you close your account we delete or fully anonymise all personal data within 30 days, except records we are legally required to keep.
Your rights
Under UK GDPR you have the right to:
- Access a copy of the data we hold about you.
- Correct anything that is inaccurate.
- Delete your account and its data.
- Export your data in a portable format.
- Object to any processing based on legitimate interest.
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Email hello@northerntechltd.com to exercise any of these rights. We reply within 30 days.
Changes
If we make a material change to this policy we will email active accounts. Minor edits will be reflected here with an updated “Last updated” date.
Contact
Questions? Reply to any email from us, or write to hello@northerntechltd.com.