1. The short version
Handyout stores your account, content and analytics data in the European Union. Presentation processing runs on servers in the EU; AI generation and email delivery are handled by service providers in the United States (see section 7). Handyout is GDPR-by-default and built on the principle that the audience reading your handyout is not the product. We collect only what we need to run the service, and we do not sell, rent, or share personal data with advertisers.
Audience analytics are pseudonymous. Handyout's own audience analytics do not assign persistent identities to viewers across handyouts, and we do not run advertising or cross-site tracking scripts. Product analytics and session recordings with PostHog only run after consent in the cookie banner (see sections 3 and 12).
2. Who is the data controller
The controller of personal data processed through Handyout is Emanuel Höfling, Moselstraße 11, 91166 Georgensgmünd, Germany. For privacy questions, write to [email protected].
3. Data we collect
Account data — name and email address. Authentication is by magic-link email OTP or Google sign-in; we do not store passwords. Stored to authenticate you and contact you about service-related matters.
Google sign-in — if you choose "Sign in with Google", you are redirected to Google, which authenticates you and then returns you to Handyout. Google acts as an identity provider and transmits your email address and the basic profile information of your Google account (name and profile picture) to our authentication service Supabase, which stores it with your login record. Handyout uses the email address to identify your account. We do not receive your Google password. Purpose: signing you in with the method you chose. Legal basis: performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). Google processes the sign-in under its own privacy terms; see section 7 for transfers to the USA.
Content data — the presentations you upload and the handyouts you generate. Stored to provide the service to you and your audience.
Billing data — when you buy credits, Stripe processes payment details on our behalf. We retain transaction metadata (invoice number, amount, date) for accounting and tax purposes.
Audience engagement data — pseudonymous session signals collected when someone views a handyout: visited slides, dwell time, reactions, comments, browser bucket (Chrome / Safari / etc.), OS bucket, device type, and language. Stored in your analytics dashboard.
Product analytics and session recordings — only if you allow analytics cookies, PostHog (EU-hosted) records page views, clicks, click paths, heatmaps, errors, performance data and session recordings on the marketing website, in the presenter dashboard and in the handyout viewer. Signed-in users are linked to their Handyout user ID; we do not send names or email addresses to PostHog. In session recordings, input fields are masked, and in the dashboard the names, email addresses and comment and feedback texts of audience members are masked as well. Purpose: finding bugs and the places where people get stuck. Legal basis: your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG). Session recordings are deleted after 30 days. You can withdraw your consent at any time in the cookie settings (see section 12).
Operational logs — request logs and error traces needed to keep the service running and debug incidents. Retained for a limited period and then deleted.
4. Why we process this data
To operate Handyout: authenticate accounts, render handyouts, deliver analytics, and bill correctly.
To improve the product: understand how the website, editor and viewer are used and find bugs and the places where people get stuck, including through session recordings if you consent. We do not use this data for advertising.
To communicate with you: service emails, security notices, occasional product updates. You can opt out of non-essential emails at any time.
To meet our legal obligations: tax records, fraud prevention, response to lawful government requests.
5. Audience data — what we collect when someone scans a QR code
By scanning the QR code that points to a published handyout, the viewer enters a session controlled by Handyout and the presenter who created the handyout. Scanning the QR code constitutes informed consent (Art. 6 Abs. 1 lit. a DSGVO) to the data processing described in this section. The categories listed here are essential to the service the viewer is requesting by scanning the code and do not depend on the cookie banner. The cookie banner in the handyout viewer only asks for optional product analytics with PostHog (see section 12).
Session identifier — a pseudonymous cookie / localStorage entry scoped to the specific handyout. It does not follow the viewer to other Handyouts or across the open web.
Engagement signals — which slides were opened, how long the viewer stayed on each slide, scroll depth, the order of navigation, and whether they revisited later. These are aggregated into the presenter's analytics dashboard.
Reactions and interactions — emoji reactions, taps on interactive modules, expansion of comparison or table modules, and any other module-level signal we use to measure engagement.
Comments — if a viewer writes a comment, the comment text and any name or email they voluntarily attach are stored and shown to the presenter.
Feedback submissions — sliders for understanding, actionability, relevance, overall rating, plus free-text feedback and optional email. All fields are voluntary; we never require an email.
Device and environment bucket — browser family (e.g. Chrome / Safari), OS bucket (e.g. iOS / Android), device type, and language. We bucket rather than fingerprint.
We do not load Google Analytics, Facebook Pixel or any advertising or cross-site tracking on the viewer side. Only if the viewer allows analytics cookies, PostHog records product analytics and session recordings in the viewer to help us find bugs (see sections 3 and 12). Audience data is used only to power the presenter's analytics, to improve the handyout the viewer is currently looking at and, with consent, to improve Handyout itself.
6. Email notifications and Double-Opt-In
Presenters receive notification emails about their handyouts at the email address of their Handyout account: new comments, replies in comment threads, reported comments, new feedback, the status of a handyout (generation finished, generation failed, public link about to expire) and referral credits. Depending on the type, these emails contain the title of the handyout, the text of comments and replies with any name the commenter attached, the reason a comment was reported, the submitted ratings and written feedback, or the first name of the person who joined through a referral. The email address of a person who submits feedback is not included. Presenters can turn off each type of notification email in the notification settings in the dashboard or with the unsubscribe link included in every one of these emails. Legal basis: performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). The emails are delivered through SendGrid (see section 7).
If an audience viewer voluntarily enters an email address in the comment prompt and ticks the corresponding consent checkbox, we use that address to send reply-notification emails for the specific purpose disclosed on-screen. The exact consent text shown to the user at the moment of submission is stored alongside the subscription record as legal proof of what was agreed to (Art. 7 GDPR).
First-time submissions run through a Double-Opt-In flow: we email the address a confirmation link that expires after 7 days. The subscription only becomes active after the recipient clicks that link. If they do not click, we send nothing further and no active subscription is created.
If the address is already verified — either because the person has a Handyout account with the same email or because they have previously completed a Double-Opt-In for another mailing on our platform — we skip the confirmation email. Ownership of the address is already established, so the purpose-specific consent captured via the checkbox at the moment of submission is sufficient. This is a technical implementation detail: consent is still collected specifically and per purpose in every case. This behavior applies only within Handyout and does not transfer consent between different purposes (for example, a reply-notification confirmation does not imply consent for marketing communication).
Each subscription can be revoked at any time via the unsubscribe link included in every email we send for it, starting with the confirmation email, or by writing to [email protected]. Unsubscribing from the confirmation email also cancels the pending confirmation. Revocation is per-purpose: unsubscribing from reply notifications does not affect any other subscription you may have. The subscription record (consent text, time of consent, confirmation and revocation) is retained as proof of consent as required by Art. 7 Abs. 1 GDPR; if you subscribe again later, it is updated with your new consent.
7. Service providers and where data is processed
We use the following service providers (processors) to run Handyout. Each one processes personal data only on our instructions and only for the purpose listed below.
Hetzner — hosting of our backend, web application and cache. Region: EU.
Supabase — database, authentication and file storage. Holds account data, content data and audience engagement data. Region: EU.
Cloudflare — network delivery, DNS and the secure connection between visitors and our servers. Requests to Handyout pass through Cloudflare. Region: EU.
PostHog — product analytics and session recordings on the marketing website, in the presenter dashboard and in the handyout viewer, only with your consent to analytics cookies, as described in section 3. Region: EU (eu.i.posthog.com).
Google — identity provider for "Sign in with Google", used only if you choose this sign-in method, as described in section 3. Receives your sign-in request and returns your email address and basic profile information to Supabase. Region: USA.
Modal — processing pipelines that convert uploaded presentations into slide images and text and generate handyouts. Receives the uploaded presentation file and the content extracted from it, including slide text and speaker notes. Region: EU (processing runs on servers in the European Economic Area). Modal is a US company; job control data such as processing job identifiers is routed through its servers in the USA.
Anthropic (Claude) — AI models that analyze slide images, slide text and speaker notes to generate handyout modules, and that process the instructions you enter in the editor's AI chat. Region: USA. Under Anthropic's commercial API terms, content sent through the API is not used to train its models.
SendGrid (Twilio) — delivery of emails such as Double-Opt-In confirmations, referral invitations, notification emails including comment and feedback text, and messages submitted through the contact and feedback forms. Receives the recipient's email address, the sender or recipient name where provided, and the email content. Region: USA.
Stripe — payment processing when you buy credits. Stripe processes payment details under its own privacy terms.
Transfers to the USA: Anthropic and SendGrid process personal data in the United States, Google processes sign-in data in the United States when you use Google sign-in, and Modal routes job control data through the United States. These transfers rely on appropriate safeguards under Chapter V GDPR — the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR) where the provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses (Art. 46 Abs. 2 lit. c GDPR). You can request further information on these safeguards at [email protected].
We do not transfer other personal data to countries outside the EU/EEA without appropriate safeguards in place.
8. Retention
Account and content data: kept while your account is active. When you delete your account from the Danger Zone in the dashboard, the deletion is carried out at that moment: the files you uploaded (presentations, generated slide images and your profile picture) are removed from file storage, your login account is deleted, and the database records linked to your account, such as your profile, presentations and handyouts with their audience data, are deleted along with it. Residual copies in our providers' backups are removed according to their regular backup cycles.
Audience engagement data: retained per handyout for as long as the handyout itself is published. When you delete a handyout, the associated engagement data (sessions, comments, reactions, feedback) is deleted by cascade in the same transaction.
Billing records: retained for the duration required by applicable tax law (typically 10 years in Germany), independent of account state.
9. Referral program
Signed-in users can take part in our referral program in two ways: by sharing a personal referral link, or by entering the email address of a person they want to invite.
Referral link — each participating user receives a personal referral code, stored in their profile and included in their referral link. When someone opens a Handyout page through such a link, the code is stored in a cookie (handyout_referral_code) in their browser for up to 30 days. If that person creates an account and completes onboarding, the code is sent with the onboarding data and the cookie is deleted.
Email invitations — when a user invites someone by email, we store the invitee's email address, the inviting user's ID and the time of the invitation. We then send the invitee one invitation email on behalf of the inviting user through our email provider SendGrid (see section 7). The email is sent from Handyout and contains the inviting user's name as stored in their profile and their referral link. We do not send reminders. We check that the address does not belong to the inviting user and that no Handyout account exists for it yet; if one exists, no invitation is stored or sent. The inviting user sees the addresses they have invited in their referral dashboard until the invitee signs up.
Conversion and credit rewards — when a new user completes onboarding, we attribute the signup to a referrer using the referral code from the link or, if there is none, an open email invitation to the new user's address. We then store a referral record containing the referrer's user ID, the new user's user ID and the time of the signup; no credits are granted at this point. A matching email invitation is marked as converted and linked to the new account. When the new user makes their first paid purchase (a credit pack, pay-as-you-go slides or an analytics tier), we credit both accounts once: the referrer receives credits according to their reward tier at that time, and the new user receives a bonus. We add the time and the number of credits granted to the referral record, and each credit appears as an entry in the billing history of the account that received it. The referrer sees the new user's name and profile picture in their list of joined referrals, together with whether the referral has been credited yet, which shows the referrer whether the new user has made a first purchase.
Purpose and legal basis — we process this data to run the referral program, attribute signups correctly and grant the credits. For participating users, the legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). For invitees, the legal basis is our and the inviting user's legitimate interest in delivering the invitation the user requested and attributing a resulting signup (Art. 6 Abs. 1 lit. f DSGVO).
Retention — invitation and referral records are not deleted automatically after a fixed period. If your email address was entered as an invitee and you want the record removed, or if you want to object to the processing, write to [email protected] and we will delete it.
10. Your rights
Under the GDPR you have the right to access, correct, export, restrict, object to, and delete the personal data we hold about you. To exercise any of these, email [email protected] and we will respond within 30 days.
You also have the right to lodge a complaint with the supervisory authority for data protection. The competent authority for Handyout is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Audience users can withdraw consent for further data processing at any time by closing the handyout, clearing site data for the handyout origin, and writing to [email protected] to request deletion of data already collected. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
11. Security
Data is encrypted in transit (TLS) and encrypted at rest by our hosting providers. Access to production systems is restricted to authorized personnel.
If a breach affecting your personal data ever occurs, we will notify affected users without undue delay and report to the supervisory authority within the timeframes required by law.
13. Changes to this policy
We may update this policy over time. Material changes are communicated by email and announced on this page. Continued use of Handyout after the change takes effect constitutes acceptance of the updated policy.
