Draft, not in force. This document is with counsel and does not yet apply.

inhand privacy policy

Part 1. The inhand privacy policy

Draft, not in force. [Version 1.0, effective 08/10/2026 if counsel approves it by 07/10/2026. Published at useinhand.com/privacy and linked from inhand's home page, the sign-in and connect screens and the Google and Microsoft consent screens.]

1.1 About this policy

This policy explains how Hire Space handles personal data in inhand, its system for running an event venue: enquiries, the diary, proposals, payments, calls and events. It is for:

people who use inhand at a venue ("venue users"), such as sales, events and finance staff;
a venue's clients, callers, guests and suppliers, whose details reach inhand because the venue uses it;
visitors to inhand's website and to a venue's inhand booking pages.

"We", "us" and "Hire Space" mean Hire Space Website Ltd. "The venue" means the business that uses inhand. "You" means whoever is reading.

1.2 Who we are

Hire Space Website Ltd, a company registered in England and Wales, number 07828456. Registered office: 40 Ashley Gardens, Ambrosden Avenue, London, SW1P 1QE. It trades as Hire Space and provides inhand ("inhand by Hire Space"). [Confirm that this company, not a new one, provides inhand: §4.1, Q1.]
Data Protection Officer: [name], Hire Space, 40 Ashley Gardens, Ambrosden Avenue, London, SW1P 1QE, or [privacy@inhand domain].
ICO registration number: Z3074185, Hire Space's registration as its live privacy policy gives it [HS-PP]. [Confirm it covers inhand: §4.1, Q1.]

1.3 Our two roles

The law gives each organisation that handles personal data a role:

a controller decides why and how data is used, and answers for it;
a processor handles data for a controller, only on the controller's instructions.

Hire Space has both roles in inhand.

Data	Hire Space's role	Who decides how it is used
Venue users' accounts, sign-in, devices, security records, support and inhand's own billing	Controller	Hire Space
The venue's clients, callers, guests and suppliers: mail, messages, calls, bookings, payment records and documents	Processor	The venue
Figures about the venue's own staff that the venue's managers see (per-person reporting)	Processor	The venue, as employer
Turning venue data into pooled, anonymised statistics, and Hire Space's own use of them (§1.6)	Controller	Hire Space
What Hire Space receives through the Hire Space exchange (§1.7)	Controller, under Hire Space's own privacy policy	Hire Space
Keeping inhand secure, preventing fraud and meeting legal duties	Controller	Hire Space

Where we are the venue's processor, the venue's own privacy notice tells you how it uses your data, and your rights run first to the venue (§1.14).

1.4 What we collect, and where it comes from

inhand collects what it needs to run the venue's enquiries, diary, bookings, payments, calls and events, and to keep them safe.

1.4.1 Venue users' accounts

Your name, work email address, role and which venues you can see.
The Google or Microsoft account you sign in with, through Hire Space's sign-in service (Auth0). We never see your Google or Microsoft password.
Your second factor, if you add one: a passkey or an authenticator app. The passkey's secret stays on your device.
A verified mobile number, if you add one, for security notices, text replies and calling clients back.
Your devices: the phone app's push token, app version and notification settings.
What you do in inhand: a log of the changes you make, kept for security and audit.
Your work figures, such as reply times and sales activity. Per-person figures are on by default, and the venue's Owner can switch them to team-only. The venue tells its staff what is measured and who sees it.
Support conversations with Hire Space's team.
For inhand's own plans: the venue's billing contact, and Stripe's customer and subscription ids.

1.4.2 Mailboxes, through Google and Microsoft

When a venue user connects a mailbox, inhand reads it from then on. At the start it reads up to 18 months of past mail, so last year's season is in view (ONBOARDING_MAIL_MONTHS=18).

Every message gets a quick look at its headers and the first 500 characters of its own text, with quoted history and signatures removed, to decide whether it is about an event. Addresses, phone numbers and card numbers are replaced with tokens first.
Mail that isn't about an event is dropped: personal mail, HR, newsletters and spam. inhand keeps only a fingerprint (a one-way code that can't be turned back into the message) and the verdict, never the words. The mail stays untouched in the mailbox.
Event mail is kept: its messages, attachments and thread, with the facts read from them, such as dates, guest numbers, what was quoted and what was agreed.
Card numbers typed into an email are removed before anything is stored, and the raw copy is deleted.

Each permission inhand asks for, and why:

Provider	Permission (scope)	What inhand does with it
Google	`openid`, `email`	Knows which account connected
Google	`gmail.modify`	Reads mail, and applies and reads inhand's labels, such as `inhand/Needs you`. A label the venue applies, such as `inhand/Won`, is an instruction
Google	`gmail.compose`	Writes reply drafts into the venue's own threads, and sends a draft when the venue approves it in inhand or an agent sends it
Google	`calendar.events`	Writes holds, bookings and viewings to the calendars the venue maps to its spaces, and reads their events so a date isn't offered twice
Google	`calendar.events.freebusy`	Reads only whether colleagues are free or busy, so viewings are offered when a host can take them
Google	`drive.file`	Opens only the spreadsheet a user picks, to import an old diary
Google, send-only route	`openid`, `email`, `gmail.send`, `calendar.events`, `calendar.events.freebusy`, `drive.file`	For venues that don't grant reading: sends the replies approved in inhand. No mail is read
Google, the Gmail add-on	`gmail.addons.execute`, `gmail.addons.current.message.metadata`, `userinfo.email`	Shows the enquiry beside the email that is open, from the message's details only
Microsoft	`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Mail.ReadWrite.Shared`, `Mail.Send.Shared`, `Calendars.ReadWrite`, `Calendars.ReadWrite.Shared`	The same as Google's, for Microsoft 365 and Outlook.com, shared mailboxes and room calendars included. Delegated permissions only: inhand never takes permissions over a whole organisation
Microsoft, the Outlook add-in	`access_as_user`, `openid`, `profile`	Knows who is using the sidebar. No mail permission

Other ways in: a mail server with a password (IMAP and SMTP, the password encrypted), forwarding to an inhand address and uploaded mail archives. [App. F.2 is the full list. The scope manifest in code fails any request outside it.]

The tokens that let inhand reach a mailbox are encrypted in a vault that only the parts of inhand that sync and send mail can open.

1.4.3 Calendars

The calendars the venue maps to its spaces: inhand reads their events and writes its own holds, bookings and viewings.
Colleagues' calendars: busy or free times only, so inhand offers viewings when the team can host them. Google's calendar.events.freebusy and Microsoft's getSchedule read busy and free times only, never the events themselves.
Calendar feeds (ICS) the venue shares show what is booked, never who, unless an Admin turns names on.

1.4.4 Calls, which are recorded

inhand's phone agents answer the calls that reach the venue's inhand number, for example when the venue's own line is busy or unanswered.

Every call is recorded. At the start of each call the agent says, in its own words, that it is an AI assistant and that the call is recorded. It is never a pre-recorded announcement.
What we keep: the caller's number, the time and length of the call, the recording, a written transcript, a summary and the outcome, such as an enquiry, a viewing, a provisional hold, a message or a transfer. The venue sees every call in the inhand web app.
Card numbers are never taken on a call. Payment is always a secure Stripe link. If a caller starts to read out a card number, the recording pauses, and a call where that happened keeps no recording.
Transfers. When the agent passes a call to the venue's staff, the recording continues, and the member of staff is told as the call comes through.
Calling back. When staff call a client back from the venue's inhand number, the call is recorded the same way, and the client is told.
Texts after a call: a brochure, the venue's table-booking link or a link to confirm a hold, sent once to the number that called.

The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 let a business record calls on its system for business purposes, such as establishing facts, only if "the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted" (regs. 3 and 4(1)(c)) [IPR-2018]. The venue, as the controller of its calls and the system controller, is responsible for this; the agent's words at the start of each call, the venue's own notices (§3.10) and this policy support it. For call recordings Hire Space acts only as the venue's processor.

1.4.5 Texts, WhatsApp, Instagram and Messenger

Texts to and from the venue's inhand number, and messages on the WhatsApp Business, Instagram and Messenger accounts the venue connects: the sender's number or handle, the message, attachments and times.
STOP, START and HELP replies, which change what a number may be sent.
Text replies from the venue's own staff from their verified numbers, such as an arrival or a note.

Meta runs WhatsApp, Instagram and Messenger under its own terms, and is responsible for what it does with messages on its platforms.

This covers:

the booking widget on the venue's own website;
the venue's forms, chat and request-to-book;
its public availability and viewing bookings; and
the client portal, where clients see proposals, sign, pay and send final details.

inhand collects:

What a client types: name, email, phone, the event's details and any dietary or access needs.
A one-time code sent to prove an email address, before a request or a viewing is placed.
The page and campaign that brought the client: the page the widget sits on, the referrer, campaign tags (UTM) and Google's click id (gclid), so the venue knows where its enquiries come from.
Checks that the person isn't a bot: Vercel BotID and a signed form token.
What the client does in the portal: pages viewed, documents signed and payments made.

The widget stores nothing of its own on the client's device. At the pay step, Stripe's payment fields run Stripe's fraud checks, which may store information on the device [which cookies: to confirm] (booking-and-modules.md §11). The venue's booking link on Google is a tracked link on its Google Business Profile, and inhand records only that an enquiry came from Google.

1.4.7 Hire Space

Enquiries Hire Space sends the venue, which arrive by email, and their Hire Space reference.
The venue's Hire Space record: its profile and spaces, and the commission terms on it, which inhand shows (§3.5).
The venue's similar-venue features from its Hire Space listing: location, venue types, suitable events, vibes and luxury level. They place the venue in a pooled group (§1.6).
Hire Space's demand: the number of searches, briefs and booking-line quotes on Hire Space, with the budgets and amounts in them, by area, event type and guest numbers. No person or client is in these figures. Hire Space's own privacy policy tells its bookers about this feed [HS-PP-D].
Opportunities: Hire Space briefs that fit the venue, shown as Hire Space's venues app shows them today. They are Hire Space's data, shared under Hire Space's own terms.

1.4.8 Payments, through Stripe

The venue's own payments. The venue is the merchant, on its own Stripe account. Card details go only to Stripe's pages, never to inhand. inhand keeps Stripe's ids, amounts and status, the card's brand, last four digits and expiry date, saved cards and Direct Debit mandates, refunds and disputes. For a dispute, inhand gathers the booking's own records into one file for the venue to check and upload in its Stripe account.
inhand's own plans. The venue pays Hire Space for inhand through Stripe Billing.

Stripe handles card data under its own terms and the card industry's security standard (PCI DSS).

1.4.9 Documents

Attachments to event mail: PDF, Word, Excel and PowerPoint. Scanned pages are read with Amazon Textract in London.
Contracts signed through Signature API, with the signed copy and its completion certificate.
Documents inhand makes: proposals, invoices, credit notes, function sheets and kitchen sheets.
Files uploaded or imported from the venue's old systems.

Every file is scanned for malware before anything reads it.

Sensitive details. Dietary needs, allergies, access needs and anything else about a person's health are special category data under the law. inhand seals them with the venue's own encryption key, uses them only to plan the event and prints allergens on kitchen sheets.

1.4.10 The phone app and devices

The staff phone app keeps an encrypted copy of what it shows (Needs you, the diary, today's briefs and two weeks of the inbox), so it works without a signal. The copy is wiped when you sign out, when you are removed and after 30 days unused.
Voice notes are transcribed on the phone where it can. Otherwise the audio is transcribed in OpenAI's EU region, with nothing kept there, and inhand deletes it once the facts are confirmed, within 30 days.
Photos have their location and camera details removed on the phone before they upload.
inhand never tracks where you are.

1.4.11 Services the venue connects

A venue can connect its Xero (or QuickBooks), its Mailchimp audience, its Google Ads and Meta ad accounts, its till, its CRM and, for a group, its own data warehouse.

inhand sends invoices, credit notes and payments to the venue's own ledger.
It reads bill totals from the venue's till (Square or Epos Now, and Lightspeed, Toast or Zonal once each is connected) to record an event's final spend, and sends the till nothing.
For a group that asks, it sends a scheduled feed of the group's own figures to the group's own warehouse, such as Power BI, Snowflake or BigQuery. The group chooses which of its venues and figures go in, and is the controller of its copy (§3.11). Each day inhand writes the figures as files in its own storage in London, and the group's own cloud account reads them from there. The feed carries figures and record ids only: no client's or staff member's name or contact details, nothing pooled and no figures per person (management-reporting.md §9.6).
It syncs to Mailchimp only the contacts the venue may market to, each with the reason it may, and brings opt-outs back.
It reads the venue's ad spend, as amounts only.
If the venue connects its CRM (such as HubSpot or Salesforce), inhand keeps the venue's contacts, enquiries and bookings in step with it, in both directions, for the records and fields the venue chooses to sync. This can include details inhand took from a mailbox the venue connected, a Gmail mailbox included (§1.15), such as an enquirer's name, contact details and event requirements. The venue chooses to connect it, can see what has been synced, and can stop it at any time by disconnecting. The CRM is the venue's own service, so what happens to the data there is between the venue and its CRM provider (§3.11).

1.4.12 Public sources

Companies House. When a client's own email or document shows a company number, inhand looks up the company's legal form on the public register, and a person at the venue confirms the match. It tells inhand whether the marketing rules for individuals apply (§1.8).
Public calendars: bank holidays, school terms and public events, for pricing.

1.5 How we use it

Use	What happens	Our role
Drafting	inhand drafts replies in the venue's own mail threads. Code fills every date, figure, link and payment detail from the venue's accepted records. A model checks each draft for invented or contradicted figures, and fixed checks protect who receives it	Processor
Agents	The venue's agents answer, follow up, place holds, book viewings and chase payments within what the venue allows (§1.8)	Processor
Learning	inhand learns the venue's spaces, rates, menus, rules and ways of working from its mail, as suggestions. The venue reviews them, or lets low-risk ones apply themselves with a badge and one-tap undo. The deeper read of the venue's older mail runs in batches on DeepSeek-V4.1-Flash, through our AI model providers listed on our sub-processor page, because speed doesn't matter there (§1.10)	Processor
Running the venue	The diary and holds, proposals, contracts, payments, function sheets and event-day notes	Processor
Calls and messages	Answering, recording, transcribing and summarising calls, and handling texts and messages	Processor
Reports	The venue's own figures, per person and per agent, and the owner's weekly letter	Processor
Pricing intelligence	A nightly run suggests rate changes for each venue from its own records, public dates, pooled rates and demand from Hire Space and inhand (§1.6). The venue chooses whether a person approves every change (Supervised), low-risk changes apply themselves (Auto, the default) or all changes do (YOLO). If the venue opts in to "Prove it pays", inhand holds back 1 in 10 eligible suggestions to measure what they earn	Processor, using pooled data we control
The Hire Space exchange	§1.7	Processor for the venue. Hire Space controls what it receives
Pooled data	§1.6	Controller
Product improvement	We measure quality from counts and scores, such as drafts approved without edits, changes undone and checks that failed, and from synthetic test data. Where a venue's Owner opts in, decisions made on its Microsoft 365 and IMAP records are scored inside inhand's own systems, and only the scores leave. Gmail content is never used this way. No venue's data trains a general AI model	Controller
Security and the law	Preventing fraud, abuse and malware; keeping an audit trail; meeting tax and legal duties; responding to lawful requests; defending legal claims	Controller
Telling venue users about inhand	Service and security messages, including notices on a second channel when something sensitive changes, and news about Hire Space's products where the law allows	Controller

1.6 Pooled, anonymised data

This is part of how inhand works, and part of the deal every venue accepts when it signs up. It can't be switched off in inhand.

What goes in. Figures from every venue on inhand, including figures inhand learned from venues' mail:

rates, minimum spends and revenue, from quotes, proposals and bookings;
the rates venues have set for future dates, provisional holds and which future dates are free, held or booked;
enquiries and quotes, counted, with their amounts, including quotes from Hire Space's own booking line;
individual quotes from similar venues, with the venue and the client removed, as inputs to the statistics behind pricing.

What never goes in. Names, email addresses, phone numbers, message text and dietary or access details. Nothing in the pool identifies a client or a member of staff.

How it is combined.

Venues are grouped by location, venue type, suitable events, vibes and luxury level, using Hire Space's similar-venue data.
Every figure anyone sees combines at least a minimum number of unrelated venue businesses: currently 6. No single business may make up more than a set share of a figure. The figures look back 18 months, so last year's season is always included.
We publish the current minimum, share and look-back on inhand's method page, and change them only on legal advice. [Configuration: PRICING_POOL_MIN_VENUES=6, PRICING_POOL_MAX_SHARE_PCT and PRICING_LOOKBACK_MONTHS=18. Lane PR sets the share.]
A venue whose group would be too small falls into a wider group, or none.
One automated job combines the figures under its own access. No person reads the inputs.

Who uses it.

inhand's pricing intelligence, which each venue sees in the app.
Hire Space, for its dynamic pricing.

What never happens.

No venue is shown another venue's records or quotes, or told which venues are in its group.
Pooled data is never sold, never used for advertising or marketing and never used to judge anyone's credit.
inhand's pricing model is statistics and rules, not a machine-learning model trained across venues. If that changes, this section changes first (§1.15).

Anonymous means anonymous. The statistics identify no person. In the ICO's words, "applying anonymisation techniques to turn personal data into anonymous information counts as processing personal data. The end result (the anonymous information) is not subject to data protection law, but the procedure (anonymisation) is" [ICO-Anon]. So where the inputs contain personal data, such as a sole trader's revenue or a client's booking, we make the statistics under our legitimate interests in helping venues understand demand and set their own rates, and in Hire Space's pricing (§1.9). We protect people's interests by removing identities first and by never showing a figure from a group below the minimum.

Your right to object. If you are a person whose data could be in the inputs, such as a venue's client or a sole trader running a venue, you may object (§1.14). We consider each objection and, where it succeeds, leave your data out. This is separate from the venue's agreement, which has no opt-out.

1.7 The Hire Space exchange

inhand is built by Hire Space, and Hire Space is part of it. The exchange is always on. There is no switch for it in inhand.

What Hire Space sees:

the venue's spaces, capacities and the rates it sets in inhand;
each date as free, held or booked, never who it is for;
the progress of the enquiries Hire Space sent: stage, quote value, hold, final value and whether it was won or lost, with a reason code;
the venue's recent quotes, without clients' names or contact details, so Hire Space can give a new client an indicative quote from that venue's own figures;
pooled statistics (§1.6).

What Hire Space never sees: the venue's email, messages or calls, or any rate inhand learned from the venue's mail except inside pooled statistics.

How it works:

Each time Hire Space checks a venue's availability or quotes, it names a real Hire Space enquiry, and the check is logged where the venue can see it.
The venue's team reach Hire Space with the same login.
A public listing on hirespace.com is optional.
Hire Space uses what it receives under its own privacy policy, as controller.
Hire Space's commission on the bookings it introduces comes from the venue's Hire Space terms (§3.5).

1.8 Agents that act for the venue

A venue's agents are AI team members. Each has its own seat in the venue's account, its own name and a log of everything it does, never a person's login. The venue gives each one a profile: Who I am, My objectives, Where I work, What I answer, What I may do, My personality, How much I do alone, When I hand over and How I'm doing. Templates cover Triage, New business, Existing bookings, BD (business development) and Accounts, and on the phone a Receptionist, New business and Existing bookings.

How much they do alone. The venue chooses, for each area:

Supervised: a person approves everything.
Auto, the default: an agent sends the replies classed as low risk on its own, and drafts the rest for a person.
YOLO: an agent does everything its "What I may do" box allows on its own.

What agents may do, if the venue allows it: reply, send a proposal, place a provisional hold, book a viewing, send a payment link, chase an invoice or offer a discount up to a set limit. Every action is logged with its reasons, and a person can undo it or switch the agent off.

Being open about AI. The phone agent says it is an AI assistant at the start of every call, and never claims to be human. Every email inhand drafts or sends carries a machine-readable mark that AI wrote it, as Article 50 of the EU AI Act asks where it applies [AI-ACT]. Emails carry no visible AI label.

The BD agent works overnight. It finds past clients and enquiries that went quiet in the venue's records and mail, plans the day's follow-ups and sends invitations back and keep-in-touch emails from the venue's own mailbox, within its daily sending limits. Before it sends any marketing email, it checks the recipient:

A person, sole trader or ordinary partnership is an "individual subscriber" under the Privacy and Electronic Communications Regulations (PECR). They get marketing email only with their consent, or under the "soft opt-in": where the venue got their details when they bought, or asked about, something similar, and gave them "a simple means of refusing ... at the time that the details were initially collected" and in every email since (reg. 22(3)) [PECR-22].
A company, limited liability partnership, Scottish partnership or public body may be emailed without consent. In the ICO's words, "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)" [ICO-EM]. inhand treats a client as a company only once its legal form is confirmed.
Anyone inhand can't place counts as an individual.
Every email names the venue and offers a simple way to unsubscribe, and every opt-out is honoured at once, companies' included.

The venue is the sender and the controller of this marketing (§3.7).

Phone agents can check dates and rates, place provisional holds and book viewings against the team's availability, if the venue allows each. They can also text a brochure or the venue's table-booking link, take a message or transfer the call. [phone-agents.md lists every tool.]

Who is responsible. The venue is responsible for what its agents send and agree in its name, as it is for a colleague's (§3.8).

1.9 Our lawful bases

UK GDPR Article 6 lists the reasons that make processing lawful [UKGDPR-6]. Where we are the venue's processor, the venue relies on its own reason, and we act on its instructions.

Purpose	Whose data	Our role	Lawful basis
Providing inhand to venue users: accounts, sign-in and support	Venue users	Controller	Legitimate interests: providing the service the user's organisation signed up for (Art. 6(1)(f)). Contract, where the user is the customer (6(1)(b))
Security, fraud prevention and the audit trail	Everyone	Controller	Legitimate interests. The law names "ensuring the security of network and information systems" as an example (Art. 6(11)(c))
Tax records and legal requests	Everyone	Controller	Legal obligation (6(1)(c))
Running inhand for the venue: mail, calls, messages, bookings, payments, documents, agents and reports	The venue's clients, callers, guests, suppliers and staff	Processor	The venue's own basis, usually its contract with the client or its legitimate interests
Dietary, access and health details	The venue's clients and guests	Processor	The venue's own condition under Article 9, usually explicit consent
Recording every call	Callers	Processor	The venue's legitimate interests, within the 2018 regulations on business recording [IPR-2018]
The BD agent's marketing	The venue's past clients and enquirers	Processor	The venue's legitimate interests, where the law names "direct marketing" as an example (Art. 6(11)(a)), with PECR's consent or soft opt-in for individuals
Pooled statistics	Personal data inside venue data	Controller	Legitimate interests, with a written assessment (§1.6)
What Hire Space receives through the exchange	Venue data	Controller (Hire Space)	The contract with the venue; legitimate interests
Product improvement	Venue users, and venue data as counts and scores	Controller	Legitimate interests. Scoring a venue's own records only where its Owner opts in (§4.1, Q12)
News about Hire Space's products for venue users	Venue users	Controller	Legitimate interests, with PECR: companies may be emailed, and individuals only with consent or the soft opt-in
Storage on your device	Users and visitors	Controller	PECR: strictly necessary, or measurement you can object to (§1.18)

Sub-processors are companies that process data for us, under contracts that bind them to protect it and use it only for us. We tell venues 14 days before we add or replace one, and list them all on inhand's trust centre.

Company	What it does for inhand	Data it handles	Where
Hosting and storage
Amazon Web Services	Runs inhand's core: storage (S3), queues, functions, encryption keys, receiving forwarded mail (SES), reading scanned documents (Textract), malware scanning (GuardDuty) and public images (CloudFront)	Everything inhand stores	London
MongoDB Atlas	inhand's database, on AWS, under inhand's own encryption keys	Everything inhand stores	London
Vercel	Serves the inhand app, the portal, the widget and inhand's API	Data passing to and from the apps	London for inhand's API. [The region of Vercel's own systems: to confirm]
Render	Runs inhand's AI service and its phone-call service	Mail and call content in transit	Frankfurt
AI
OpenAI	Reading, drafting, checking, summarising, embeddings, transcription and the phone agent's voice (GPT-Live)	Mail, message and call content	EU region, with zero data retention
TypeSafe AI (Jev)	Sorting messages: is it about an event, and what does it ask?	A minimised message: up to its first 500 characters, with addresses and numbers replaced	Not yet named in its DPA (§4.1, Q10)
Doubleword (TYTN Limited, London), our DeepSeek-V4.1 model provider	The deep pass of a venue's older mail (the venue book), in batches, on DeepSeek-V4.1-Flash, DeepSeek's openly published model, which the provider runs. Nothing is sent to DeepSeek the company, and nothing to an endpoint hosted in China	Event mail content and the facts read from it, in batch files kept until inhand deletes them, and deleted within 7 days at the latest	Stored in an AWS Europe region. Processed on GPU providers in the countries its contract names, some outside Europe, under UK adequacy, the UK Extension to the DPF or, elsewhere, the ICO's transfer agreement or addendum; never in China, Hong Kong and Macau included [DW-DUP] (§1.11)
Calls, texts and email
Twilio	The venue's inhand numbers, calls, texts and call recordings until inhand copies them to London	Numbers, calls, recordings and texts	Per its DPA. Calls leave from its Dublin edge
SendGrid (Twilio)	inhand's own system email: invitations, alerts, the digest and the owner's letter	Recipients' addresses, figures and company names, never mail content	EU
Payments and documents
Stripe	The venue's payments, on the venue's own Stripe account, and inhand's own billing	Payment records. Card data only on Stripe's pages	Per its DPA
Signature API	Electronic signatures on contracts	Contracts, and signers' names and email addresses	US, under the UK's and the EU's standard contract clauses
Identity and operations
Auth0 (Okta)	Sign-in, on Hire Space's sign-in service	Venue users' identities	EU
Doppler	Holds inhand's service passwords and keys	No customer data	[To confirm]
The compliance tool (Vanta or Drata)	Collects evidence for ISO 27001 and SOC 2	System settings and staff accounts, no customer content	[To confirm]
Operations, ids only
Datadog	Monitoring and alerts, and performance measurement in the web app, with session replay off	Ids, counts and timings, never content	EU (Germany)
LangSmith (LangChain)	Traces of AI runs, with their content blanked	Ids and scores	EU (Netherlands)
Inngest	Schedules inhand's background work	Ids only	US
Ably	Tells open apps that something changed	Ids only	[To confirm]
Upstash	Rate limits	Keys and request counts [confirm whether IP addresses]	[To confirm]
Notifications
Apple, Google (Firebase) and browser push services (Apple, Google and Mozilla)	Deliver notifications to phones and browsers	A short line with no client's name, unless a person opts in to names that stay hidden on a locked phone	Global. Browser pushes are encrypted end to end

Platforms with their own terms. Google and Microsoft provide the venue's mailboxes and calendars, and Google runs the Gmail add-on. Meta provides WhatsApp, Instagram and Messenger. They are the venue's own providers, not our sub-processors, and their own privacy terms apply. inhand uses Google Cloud Pub/Sub to hear about new Gmail messages; each notice carries the mailbox's address and a change number, never content.

Services the venue connects. Xero, QuickBooks (Intuit), Mailchimp (Intuit), Google Ads and Meta's ad accounts receive what the venue chooses to send them, under the venue's own agreements with them. A group's own warehouse receives the feed the group sets up; the warehouse is the group's, not our sub-processor. The feed is built by MongoDB Atlas and kept in inhand's AWS storage in London, both already listed, so it adds no sub-processor (management-reporting.md §9.6).

Optional modules (booking-and-modules.md §11). Table plans add nobody new. Ticketed events take payment through Stripe, already listed. Till links read bill totals from the venue's own till and send it nothing: Square and Epos Now from day one, Lightspeed, Toast and Zonal as each vendor approves inhand (booking-and-modules.md §4.4), and never Access EPOS (Q86). Rota connectors send shifts to the venue's own rota tool (Deputy, RotaCloud, Planday, 7shifts or Fourth): the event type, space, guest count and times, with the client's name only if an Admin turns names on. Book on Google sends Google the venue's details, its services with their rates and its links, and a conversion signal with Google's token when a booking from Google completes; it sends no client's details and no availability. The venue connects each of its own providers, under its own agreement with them.

Hire Space receives what §1.6 and §1.7 describe. It is the same company, acting in its own right.

Others: a buyer of Hire Space's business, with notice to you; the police, courts or regulators where the law requires; and our professional advisers.

Suppliers that hold no customer data: GitHub (our code), and the AI coding and review tools our engineers use (Anthropic, OpenAI Codex and CodeRabbit), which hold our code only.

1.11 Data outside the UK

inhand's UK service stores data in the UK, in London. Some processing happens elsewhere:

In the EU: AI calls (OpenAI's EU region), inhand's AI and phone services (Frankfurt), sign-in (Auth0), system email (SendGrid), monitoring (Datadog, Germany), AI traces (LangSmith, Netherlands) and call routing (Twilio's Dublin edge).
In Europe and beyond: the venue book's batch reads (Doubleword), stored in an AWS Europe region and processed on GPU providers in the countries our trust centre lists, some outside Europe. None is in China, and we never use an endpoint hosted there. [The trust centre's page waits for Q142.]
In the US: electronic signatures (Signature API), background-job ids (Inngest), message sorting (TypeSafe) [until it names a region] and the global services of Stripe, Twilio, Meta, Google, Microsoft and Apple, as their own terms say.

Each transfer rests on one of these:

UK adequacy regulations, which cover the EEA;
the UK-US data bridge, for US companies certified under the UK Extension to the EU-US Data Privacy Framework, in force since 12/10/2023 [GOV-DB];
the ICO's International Data Transfer Agreement, or its Addendum to the EU standard contractual clauses, each with a transfer risk assessment [ICO-IT].

Our residency register names the mechanism for each row. Every GPU country our AI model provider's contract names outside the UK and EEA is covered, before any venue's mail reaches it: by the UK Extension to the Data Privacy Framework where the GPU provider is a certified US company, or otherwise by the IDTA or the Addendum with a transfer risk assessment. None is in China. [§4.1, Q13: confirm each US company's certification. §4.1, Q10: Doubleword's contract.]

inhand's US service, when it opens, keeps storage, AI calls and phone calls in the US.

1.12 How long we keep it

Data	Kept
Mail that isn't about an event	Not kept. A fingerprint and the verdict, 13 months
Raw event mail	30 days. None where a card number was removed
Event threads' text and attachments	24 months, then fetched again from the mailbox if needed
Facts read from mail, suggestions and the venue book	[As event threads' text, 24 months: lanes DM1 and ON to confirm]
Call recordings	Until 90 days after the event the call concerns, or 90 days after the call if none, and at most 24 months; a venue can shorten it to 30 days (`phone-agents.md` §6.6; Q87)
Call records, transcripts and summaries	24 months
Voice-note audio	Until the facts are confirmed, 30 days at most
Bookings, proposals, the diary and other business records	While the venue is a customer
VAT invoices, credit notes and the payments and refunds against them; signed contracts	6 years for the tax records, while the venue is a customer. When it leaves they go to the venue in its export, because keeping them is the venue's duty
The audit trail	13 months, then 400 days in locked storage
Backups	35 days
The venue's figures (rollups)	25 months. Report runs and alerts, 13 months
Exports	7 days
Monitoring logs (ids only)	15 days, then 90 days archived
Pooled statistics	Anonymous. Published figures 400 days. Each run's record, with no venue in it, 6 years
Copies on phones and browsers	Wiped on sign-out, on removal and after 30 days unused. The inbox's text 14 days; drafts 24 hours
AI model providers' batch files	Deleted as soon as inhand has the results, and each deletion is recorded (App. C.20). Where a provider's zero data retention doesn't cover batch work, it keeps them until then, and never longer than its contract allows: Doubleword's contract requires deletion on request and within 7 days (Q125)
The warehouse feed	Each day's run is kept 35 days in inhand's storage in London, and deleted within an hour of the feed stopping. The group keeps what it copies under its own policy
Recordings at Twilio	Deleted once copied to London. Twilio keeps their details, not the audio, for 40 days after deletion [TW-REC]
A venue's account, when it leaves	30 days to export everything, then deletion, with a certificate. Only records under a legal hold stay, until the hold ends
Records of a venue accepting inhand's terms	While the venue is a customer, then 6 years [proposed]

1.13 Keeping data safe

Encryption. Data is encrypted in transit and at rest, under keys held in each region's own key service. The most sensitive fields are also sealed with each venue's own key. They include mail content, call transcripts, passwords to other systems and anything about health, such as dietary needs.
Least access. No Hire Space person has standing access to venue content or keys. Support staff see a venue's data only when the venue grants access to named threads, for a limited time, and Gmail content from a person's mailbox also needs that person's approval. Emergency access needs two people and is recorded.
Tested. Every change is reviewed and tested before it ships. Before the first real mailbox inhand has a full security review and an internal penetration test; an external penetration test follows the pilot, before general availability, and then every year. Google's security assessment (CASA) follows the pilot and is renewed every year for Gmail access.
Standards. We are building inhand to ISO/IEC 27001:2022 and to SOC 2's criteria, and plan to certify in 2027. We will say so here when we have.
Breaches. We tell the venue within 48 hours of becoming aware of a breach that affects its data, and tell the ICO and the people affected when the law requires.

1.14 Your rights

You can ask us to:

give you a copy of your data (access);
correct it;
delete it;
restrict how it is used;
give it to you in a format a computer can read, or send it to another organisation (portability);
stop using it where we rely on legitimate interests (objection), and always for direct marketing; and
have a person review a decision made without one (§1.17).

Where we rely on consent, you can withdraw it at any time.

How. Write to [privacy@inhand domain] or use the form at useinhand.com/privacy/request. We reply within one month, or tell you within that month if we need up to two more. It is free. We may ask you to prove who you are.

If you are a venue's client, caller or guest. The venue decides how your data is used in inhand, so please ask the venue first. If you ask us, we pass your request to the venue within [5] working days and help it answer.

Your mailbox's permissions. You can remove inhand's access to a mailbox in any of these places:

inhand's settings, where disconnecting a mailbox deletes its access token;
your Google Account, under Security, "Third-party apps and services" [confirm the label];
https://account.live.com/consent/Manage, for personal Microsoft accounts;
https://myapps.microsoft.com, for work or school Microsoft accounts.

Complaints. Tell us first. We acknowledge a complaint within 30 days and tell you what we found, as the Data Protection Act 2018 requires (s.164A) [DPA-164A]. You can also complain to the Information Commissioner's Office at ico.org.uk.

1.15 Google user data and Limited Use

"Google user data" means what inhand receives through Google's permissions: Gmail messages and labels, calendar events, the files a user picks from Google Drive and the details the Gmail add-on sees.

What inhand does with Google user data:

finds the venue's enquiries and keeps its event threads (§1.4.2);
drafts replies in the venue's threads, and sends them when the venue approves or when its agents send within the venue's settings (§1.8);
applies inhand's labels, and reads the labels the venue applies as instructions;
learns the venue's spaces, rates, menus and ways of working, as suggestions the venue controls;
keeps the venue's diary, holds, bookings and viewings in its calendars;
shows the venue its own reports; and
combines rates, minimum spends and revenue from venues' mail into pooled, anonymised statistics for inhand's pricing intelligence and Hire Space's dynamic pricing (§1.6).

What inhand never does with it. It never sells it, never uses or transfers it for advertising, never uses it to judge anyone's credit and never uses it to train a general AI model. No person reads it, except with the mailbox owner's approval for specific threads, for security, to comply with the law or as aggregated and anonymised figures used for internal operations.

Told, then asked. Before anyone connects Gmail, inhand shows these uses on its own screen, pooled data and the Hire Space exchange included, and asks them to agree with a tap. Only then does Google's consent screen open (§2.8).

Google's statement. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. [G-WS]

1.16 Microsoft data

Microsoft's terms let an app use mailbox data only within "permissions expressly granted by Customers in connection with using your Application" (3(b)(11)), and use its email APIs beyond syncing and backing up only with "use permissions expressly and specifically granted by Customers" (3(c)) [MS-API]. The venue terms give those permissions one by one (§3.9), and inhand uses Microsoft data only within them.
inhand never uses Microsoft data, "including any data aggregated, anonymized or derived from that data", for advertising or marketing (3(b)(12)) [MS-API]. So pooled statistics never feed Hire Space's advertising or marketing.
When a venue leaves, its Microsoft data is deleted with the rest of its account (§1.12), as Microsoft's terms ask (5(c)).
You can withdraw inhand's access by disconnecting the mailbox in inhand. Microsoft's own pages for this are https://account.live.com/consent/Manage for personal accounts and https://myapps.microsoft.com for work or school accounts.

1.17 Automated decisions and AI

The AI we use. OpenAI's models in its EU region, with nothing kept after each call; TypeSafe's Jev, for sorting messages; and DeepSeek-V4.1-Flash, DeepSeek's openly published model, run by our AI model providers listed on our sub-processor page, for the deeper read of a venue's older mail. OpenAI and TypeSafe don't train their models on what inhand sends [K]. We contract only with DeepSeek-V4.1 providers that don't train on what inhand sends, and inhand never opts in to any training. [Each provider's contract should say so without an exception for running the service: §4.1, Q10.]

Decisions without a person. Some of inhand's decisions involve no person:

sorting mail, and dropping what isn't about events;
agents in Auto or YOLO sending replies, placing holds, booking viewings or declining an enquiry the venue's own rules rule out;
ranking enquiries by how likely they are to book; and
in Auto or YOLO, changing the venue's rates.

Most of these have no legal or similarly significant effect on anyone. Where a decision about a client could have one, such as an agent declining a booking, the venue is the controller, and inhand gives it what UK GDPR Article 22C asks: telling the client about the decision, letting them "make representations", letting them "obtain human intervention" from someone at the venue and letting them "contest such decisions" [UKGDPR-22]. inhand never bases such a decision on health or other special category data.

1.18 Cookies, device storage and PECR

PECR governs storing or reading anything on your device, and since 05/02/2026 it counts a mobile app as a website. It allows storage "strictly necessary for the provision of an information society service requested by the subscriber or user", and storage whose sole purpose is to "collect information for statistical purposes about how the service is used with a view to making improvements to the service", if you are told and are "given a simple means of objecting, free of charge" (Schedule A1, paragraphs 4 and 5) [PECR-6].

Strictly necessary: sign-in sessions, security and fraud checks (including Vercel BotID on forms), the portal's session cookies and the offline copies the apps keep.
Measurement in the staff web app: Datadog's Real User Monitoring times pages and errors, with session replay off and ids only. You can switch it off in Settings. The switch is under Settings, Your data.
The booking widget on a venue's website stores nothing of its own. At the pay step, Stripe's payment fields run Stripe's fraud checks, which may store information on the device. They are strictly necessary for the payment the client asked for [which cookies: to confirm] (booking-and-modules.md §11).
Email open and click tracking is off until we have PECR advice. If it is ever switched on, opens are marked "may be automatic".
There are no advertising cookies, and the phone app has no third-party analytics.

1.19 Children

inhand is for businesses. Venue users must be 18 or over, and we don't knowingly collect children's data for our own purposes. A venue may hold details of children at its events, such as a name for a party or a dietary need, and the venue controls that data.

1.20 Changes to this policy

We will tell venue users in inhand and by email at least 30 days before a change that matters. Before inhand uses Google user data in a new way, it asks each Gmail user to agree to the updated policy, as Google requires [G-UDP]. Past versions are listed at useinhand.com/privacy/versions.

1.21 Contact

[Data Protection Officer], Hire Space Website Ltd, 40 Ashley Gardens, Ambrosden Avenue, London, SW1P 1QE; [privacy@inhand domain]. The Information Commissioner's Office: ico.org.uk.

[For US residents: a section on US privacy laws and call-recording consent is added before inhand's US service opens.]

Draft, not in force.

---