# Privacy notice (GDPR)

Hands for Agents · your engineering s.r.o., company ID (IČO) 09738100. Version 2026-09-29. What personal data is processed, why, where and for how long. HTML: https://handsforagents.com/privacy.html

## 1. Controller

**your engineering s.r.o.**, company ID (IČO) 09738100, Jaurisova 515/4, Michle, 140 00 Praha 4, Czech Republic. Contact for data protection: legal@handsforagents.com. We have not appointed a data protection officer; we are not required to.

## 2. What we process, why, and for how long

| Data | Purpose | Legal basis (GDPR) | Kept for |
| --- | --- | --- | --- |
| Operator's e-mail and name or company name (both required for every request), optional country, optional VAT or tax id | Quote, contract, invoice | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (accounting law); Art. 6(1)(f) legitimate interest for the rest of the tax review period | Task record: 24 months after the task ends. Invoice and accounting records: 10 years |
| Content of the request, correspondence (including the messages we send you through the status API and by e-mail, and the messages you or your agent send us through the status API or by e-mail), input files | Performing and documenting the task | Art. 6(1)(b) contract | 24 months after the task ends |
| Delivery address, recipient name and phone | Shipping | Art. 6(1)(b) contract | 24 months after the task ends |
| Evidence package (photos, video, reports) | Proof of performance, disputes | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest in defending claims | 24 months after the task ends |
| Identity verification data for sensitive task categories | Preventing misuse | Art. 6(1)(f) legitimate interest in preventing fraud | 24 months after the task ends |
| Refused requests, including any files uploaded to them and messages sent about them (by us or by you) | Preventing repeated misuse for a short screening window | Art. 6(1)(f) legitimate interest | 7 days after the refusal, deleted from the live database and file storage. Database and file backups, made daily and before every deployment, are not deleted or rotated on a fixed schedule, so a copy can remain in a backup without a time limit. The e-mails notifying us of the request or of a message you sent, sent to our own mailbox, are not deleted by this. The access log and the application log entries about the request (which include the quote id, and for the application log the e-mail subject line, which can include your name) are not deleted by this either and follow the rows below instead: 30 days in active use, then archived for 3 years |
| Payment status, last four card digits, card country (from Stripe) | Matching payments to tasks, refunds | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (accounting law) | 10 years with the accounting records |
| Server access log: IP address, time, requested URL, user agent | Operating and securing the site; kept afterwards to establish, exercise or defend legal claims | Art. 6(1)(f) legitimate interest | 30 days in active use, then archived, with access restricted to the operator, for 3 years (the general limitation period) |
| Usage statistics of the MCP server and the API: time, host and path, the MCP method and tool name (never the tool's arguments or our replies), the name and version the client software reports about itself, user agent, country (from Cloudflare), a session marker, the identifiers of a quote or task created in the session, and a one-way hash of the IP address (salted with a secret that changes every month; the address itself is not stored in this record) | Finding out how many and what kind of AI agents use the service, and improving it | Art. 6(1)(f) legitimate interest | 90 days as detailed records, then only daily totals without any address or hash |
| Application log: for every e-mail the system sends about your request or task, the recipient address and subject line (which can include your name) | Confirming that a notification about a quote or task was actually sent; kept afterwards to establish, exercise or defend legal claims | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest | 30 days in active use, then archived, with access restricted to the operator, for 3 years (the general limitation period) |

Retention periods are the ones in the [terms of service](https://handsforagents.com/terms.html), section 14. Security measures, the same as in section 10 of the terms and in the data processing agreement: access limited to the persons doing the task; devices encrypted and protected by password; data stored in the EU.

We never receive or store full card numbers. We do not use personal data for marketing, profiling or automated decision-making. Every decision about a request is made by a human.

## 3. This website

Static HTML. No JavaScript is executed, no cookies are set, no analytics, no third-party requests, no images or fonts loaded from other servers. The payment page is hosted by Stripe on stripe.com and is subject to Stripe's own privacy policy and cookies.

## 4. Who receives the data

- Stripe Payments Europe, Limited (Ireland): payment processing.
- INTERNET CZ, a. s. (Forpsi), Czech Republic: web and e-mail hosting, in the EU.
- Carriers: recipient name, address and phone, for shipments only.
- Subcontractors: technical files needed to make a part, under a written confidentiality obligation. No client identity unless necessary.
- Our accountant: invoices.
- Czech and EU authorities, on a lawful request.

We store data in the EU. Stripe may transfer data outside the EU under the safeguards described in its privacy policy (EU–US Data Privacy Framework, standard contractual clauses). When we ship outside the EU, the carrier and the recipient's customs authority receive the shipping data.

## 5. Personal data inside tasks

If a task contains personal data of other people (for example a recipient's address, or a person who consented to being verified), you are the controller of that data and we process it for you under the [data processing agreement](https://handsforagents.com/dpa.html). Do not send us personal data the task does not need.

## 6. Your rights

You may ask for access, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interest. Write to legal@handsforagents.com; we answer within one month. You can complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, [uoou.gov.cz](https://uoou.gov.cz/), or to the authority in your EU country.

## 7. Version

Version 2026-09-29.