HandelOS Visit WerkOS

Legal

Privacy

Last updated 2026-10-22

This notice explains what personal data the HandelOS website (handelos.io) processes, why, and what rights you have. It is written for visitors in India (Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025) and in the EU/EEA (General Data Protection Regulation, GDPR, and German law).

1. Short version

  • This website sets no cookies and stores nothing in your browser (no localStorage or sessionStorage).
  • It runs no analytics, advertising or tracking, embeds no videos, maps or social widgets, and has no contact form.
  • Fonts, styles, scripts and images are all served from our own domain. Your browser does not contact any third party while you read this site.
  • Because nothing non-essential is stored or read on your device, there is no cookie banner.
  • Personal data reaches us only if you email us or book a call, and through the hosting provider's technical logs.

2. Who is responsible (controller / Data Fiduciary)

[TODO: legal name of the person or company running HandelOS (e.g. sole proprietor name, or company name and legal form)]
[TODO: postal address that can receive legal mail]
Email: handelos.io@gmail.com

Grievance Officer / privacy contact (India, DPDP): [TODO: name of the person handling privacy requests and grievances], handelos.io@gmail.com. We acknowledge requests promptly and resolve grievances within the period set by the DPDP Rules (at most 90 days).

EU representative (GDPR Art. 27): [TODO: only if HandelOS is not established in the EU and Art. 27 applies; otherwise remove this line]. A data protection officer is not appointed; the size and type of processing does not require one.

3. What we process, why, and on what basis

a) Visiting the website: hosting logs

Data: IP address, date and time, the page requested, the referrer, browser and device type (user agent), and the response status.
Purpose: to deliver the website and keep it secure and working.
Legal basis: GDPR Art. 6(1)(f), our legitimate interest in running a secure website. In India, a legitimate use under section 7 of the DPDP Act, as far as it applies to this technical processing.
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which hosts the site and processes these logs on our behalf.
Retention: as set by Vercel's log retention for our plan [TODO: confirm the log retention period for this Vercel plan]; we do not export or combine these logs.

Storage on your device (TDDDG §25): none. The site does not store information on, or read information from, your device beyond what your browser needs to load the page.

b) Emailing us

Data: your email address, name and anything you write.
Purpose: to reply and to discuss a possible project or product.
Legal basis: GDPR Art. 6(1)(b) (steps before a contract) or Art. 6(1)(f) (answering your enquiry). In India, the consent you give by writing to us (DPDP Act section 6), which you can withdraw at any time by emailing us.
Provider: our mailbox is a Google Gmail account (Google LLC / Google Ireland Ltd.).
Retention: for as long as the conversation or the resulting business relationship lasts, then deleted within [TODO: e.g. 12 months], unless tax or commercial law requires us to keep business letters longer.

c) Booking a call on Cal.com

The “Book a call” links open Cal.com, which runs on its own domain. Nothing is sent to Cal.com until you open the link.
Data: the details you enter there, usually your name, email, the chosen time and an optional note.
Purpose: to schedule and hold the call.
Legal basis: GDPR Art. 6(1)(b); in India, your consent given when you book.
Provider: Cal.com, Inc. (USA), which processes booking data for us. Cal.com's own privacy notice applies to its site.
Retention: booking records are deleted within [TODO: e.g. 12 months] after the call unless a business relationship follows.

d) Links to other sites

Links to our product demos (for example SafarOS, PetraOS, WohnOS, GigOS), client sites and LinkedIn open separate websites. Their own privacy notices apply once you open them.

4. Recipients and transfers outside India or the EU

Recipients are limited to the providers named above: Vercel (hosting), Google (email) and Cal.com (booking). They may process data in the United States. For transfers from the EU, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (GDPR Art. 45/46). [TODO: confirm each provider's DPF certification or SCCs and that a data processing agreement is in place] We do not sell personal data and do not use it for advertising or automated decision-making or profiling.

5. Your rights

India (DPDP Act, sections 11-14): access a summary of your data, correction, completion, updating and erasure, grievance redressal, and nominating another person to act for you. You can withdraw consent as easily as you gave it, by emailing handelos.io@gmail.com. If our answer does not resolve your grievance, you can complain to the Data Protection Board of India.

EU/EEA (GDPR Art. 15-21): access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interest. You can withdraw any consent at any time. Withdrawal does not affect earlier processing. You can complain to a data protection supervisory authority, for example the one where you live, or [TODO: the authority responsible for HandelOS's establishment, if any in the EU].

To use any right, email handelos.io@gmail.com. We may ask you to confirm your identity.

6. Do you have to give us data?

No. You can read the whole website without giving us anything. Your email or booking details are needed only if you want us to reply or to hold a call.

7. Our products

This notice covers the handelos.io website only. Each product (for example WerkOS) has its own privacy notice and terms, agreed before use.

8. Changes

We update this notice when the website changes. The date at the top shows the current version.