Privacy Policy

When you use BonHand as a professional, we hold:

• Account details: name, email address, username, password (stored only as a hash), and any passkey or two-factor credentials you register. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Practice settings: timezone, language, currency, country, working hours, professions, rates, locations and the content of your public page, if you publish one.
• Billing data: your plan, subscription status, invoices, and the billing name, address and country you give Stripe. We never see or store your card number.
• Content you create: your client records, sessions, notes, payment records, to-dos and any files you upload.
• Technical data: IP address, browser and device information, log and error records, and, if you enable notifications, a push subscription identifying your browser to its push service.
• How you found us: the campaign tags, referring website and landing page of your first and most recent visit in the 30 days before you signed up, from the attribution cookie described under Cookies.

You decide this, not us. In practice it usually includes a name, contact details, session history, what was paid and what is owed, notes you write, and any files you attach. Where you work with children, it may include information about a child, entered by the adult responsible for them.

We do not buy client data, we do not enrich it from other sources, and we do not read your client messages: BonHand has no way to receive incoming messages at all. The only exception to "you enter everything" is listed in the next two sections.

If you enable a portal link, your client can write exactly six things, and nothing else:

• A password for their own link, which they may also decline to set.
• Their own profile photo, which they may remove again.
• A payment they say they made, which stays pending and changes nothing until you confirm it.
• The language they want their portal in.
• Their timezone, so the times you quote them are right.
• Files they upload to you, only if you have turned client uploads on. Uploads are off by default.

A public page can be read without giving us anything. If a visitor sends an enquiry through the contact form, we collect the name, contact details and message they type, and pass them to the professional whose page it is.

We also process the sender's IP address and a Cloudflare Turnstile token to block automated submissions and enforce rate limits. An enquiry is a message from a stranger, never a client record: it does not enter anyone's timeline and does not affect any balance.

If you give a client an email address and enable their portal link, BonHand emails them when a notice you posted, or a file you shared with them, becomes visible in their portal. You can turn these emails off in your settings.

The email contains the text of the notice as you published it and the number of new files. It never contains file names or file contents, and it links to the portal only if the client has set a password on it. It is sent through our email provider, Resend, and replies to it are not read.

Every email has an unsubscribe link. A client who uses it stops getting these emails. You can see that they unsubscribed, but only they can undo it.

For the data where we are the controller:

• To provide the service, including your account, your data and your subscription. Basis: performance of our contract with you.
• To take payment and keep the records that go with it. Basis: contract, and legal obligation for tax and accounting records.
• To keep the service secure, which covers rate limits, bot defence, error logs and abuse investigation. Basis: our legitimate interest in a service that is not abused.
• To support and improve the product, using aggregate usage and error data. Basis: our legitimate interest in a product that works.
• To learn which of our marketing works, by counting signups by how people found us. Basis: our legitimate interest in spending on the marketing that brings people who use the product.
• To send service email such as verification, password resets, payment problems and material changes. Basis: contract. These are not marketing and cannot be switched off while your account is open.
• To send browser notifications, if you turn them on. Basis: your consent, which you can withdraw in your browser or in settings at any time.

We do not sell personal data, we do not share it with advertisers, and we do not use it to build profiles or take automated decisions that produce legal effects.

When you ask BonHand to summarise a client's history or draft a message, the content needed for that request is sent to an AI provider. That can include the client's name, session history and the notes you have written about them.

What this means in practice:

• Requests are sent with retention switched off, so the provider does not store them after the response and does not use them to train models.
• We use OpenAI as the primary provider and Anthropic as an automatic fallback when the first is unavailable. Both are listed as subprocessors below.
• The features are yours to use or not. If you do not use them, nothing about your clients is sent to an AI provider.
• Separately, the profession, focus and level names you type are reviewed by us with the help of Anthropic's Claude, to keep the shared list of suggestions tidy. They are sent without your name or any account details, and no client data is part of it.

BonHand sets six cookies of its own. Four keep the site working; the fifth remembers an invitation and only exists if you followed one; the sixth remembers how you found us. There are no advertising cookies, no tracking pixels and no third-party analytics, which is why you are not being asked to accept anything.

• A session cookie, which keeps you signed in.
• A CSRF token cookie, which stops other sites submitting forms as you.
• A language cookie, which remembers the language you chose.
• A sign-in flag cookie, which records only that someone is signed in on this device, so the home page can take you straight to your dashboard instead of the marketing page. It holds no name, no account number and nothing that identifies you, and it is removed as soon as you sign out.
• A referral cookie, set only if you arrived through an invite link, which includes the sign-up link on some professionals' public pages. It remembers who invited you for 30 days so they can be credited if you sign up, and it is read once at signup and then removed. It is first-party, it is not shared with anyone, and it is not used to track you.
• An attribution cookie, set when you visit our own pages (not a professional's public page). It records how you first found us and how you most recently came back: the campaign tags in the link you followed, the website that sent you, and the page you landed on. It lasts 30 days from your first visit, holds no name, email address or account number, and is read once if you sign up and then removed. It is first-party and not shared with anyone.

Cloudflare, the network that carries all traffic to BonHand, may also set a security cookie called __cf_bm. It helps tell people apart from automated traffic, expires after 30 minutes of inactivity, and is not used for advertising or analytics.

Paying for a subscription takes you to a page hosted by Stripe, and Stripe sets its own cookies there under its own privacy policy. If we ever add analytics, we will choose a tool that does not set cookies or track you across sites, and we will update this section before it goes live.

We share personal data only with the providers we need to run the service, listed below. Each is bound by contract to use it only for the service they provide us. We may also disclose data where the law requires it, and, if the business is ever sold or merged, to the acquirer, on notice to you.

BonHand is a global service and the providers below operate internationally, so personal data may be processed outside the country you are in, including in the United States and the European Union.

Where data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or an adequacy decision, as applicable to the provider concerned.

We keep your account and the data in it for as long as your account is open, because that is the point of it. After that:

• When you close your account, your data is deleted within 30 days, and encrypted backups holding it age out within a further 30 days.
• A free account that nobody signs in to for 12 months is closed and deleted the same way. We email you 30 days and 7 days before, and signing in before the date keeps it. Paid accounts are never closed for being unused.
• Some things outlast a closed account. If you answer the optional "Why are you leaving?" question, we keep that answer without your name or email. If you joined through a referral, we keep the referral record with a one-way hash of your email in place of the address, so the programme can tell a returning email from a new one. Your public page's link name is held back for 12 months, so nobody else can take over an address your clients may still have. Records of the account being closed, and of any change our staff made to it, are kept for accountability with your name and email removed. The closing record keeps a one-way hash of your email, so we can find it if you contact us, and your answer to "Why are you leaving?" is kept with it.
• Billing and tax records are kept for seven years, because the law requires it.
• Enquiries from a public page are kept until the professional deletes them, and are removed with the account.
• Files a client sends through their portal are deleted automatically: videos 30 days after they are sent, other files after 365 days. The professional can delete them sooner.
• Security and error logs are kept for up to 90 days.

You can delete individual client records at any time, with one exception that protects your own history: a session that has already been logged cannot be edited or deleted, because your record of what happened is meant to be reliable.

Everything travels over encrypted connections. Passwords are hashed and never stored in readable form, and card details never reach our servers at all. You can add two-factor authentication or a passkey to your account, and we recommend you do.

Access to production data is limited to the people who need it to operate and support the service. Portal links are unguessable tokens that you can revoke, and are revoked automatically when you archive a client. No system is perfectly secure, so please tell us at once if you suspect a problem.

Over the data where we are the controller, you may ask us to:

• Give you a copy of it, or a portable export of it.
• Correct it if it is wrong.
• Delete it, subject to the retention periods above.
• Restrict or object to a use of it that relies on our legitimate interests.
• Withdraw a consent you gave, without affecting what was done before you withdrew it.

Write to privacy@bonhand.com and we will respond within 30 days. You may also complain to the data protection authority where you live, or to the Information Commissioner's Office (ICO), which supervises us.

The records held about you were entered by your professional, who decides what they contain and how long they are kept. To see, correct or delete them, ask that professional directly. It is their decision to make, and they can act on it immediately.

If you cannot reach them, write to privacy@bonhand.com and we will help identify the right account and pass the request on. We cannot change another person's records for them without their instruction.

BonHand accounts are for adults, and we do not knowingly let anyone under 18 create one. A professional may hold records about a child, such as sessions an adult has booked on that child's behalf. In that case the professional is the controller and must have the consent of a parent or guardian.

If you believe a child's information is held in BonHand without that consent, write to privacy@bonhand.com.

When this policy changes we update the date at the top of the page. If a change materially affects how your data is used, we will tell you by email or in the app before it takes effect.