Privacy Policy

Hendl Labs Ltd, registered in England and Wales under company number 17379976, operates the Hendl platform. For your account data we are the controller. For the personal data inside your cases, your organisation is the controller and we are its processor under a Data Processing Addendum.

Account data: name, work email, role and authentication records. Usage data: actions taken in the platform, retained as part of the audit trail. Case data: whatever your organisation puts into its cases — controlled by them, not by us.

To provide and secure the service, to meet legal obligations, and — for account data only — to send service communications. We do not sell personal data, and we do not use case data for advertising or model training.

Digital workers process case data to advance cases, within autonomy levels your organisation sets. Decisions with legal or similarly significant effects on a person are gated to human approval by default. Every automated action is logged and reviewable.

You choose a data region at workspace creation — UK, EU or US — and case data is stored and processed there. Cross-border transfers, where they occur, rely on adequacy decisions or standard contractual clauses.

Case data follows the retention schedule your organisation sets. Account data is kept for the life of the account plus ninety days. Deletion propagates to backups on a published cycle, and is certified on request.

You may access, correct, export or erase your personal data, object to processing, and complain to the ICO or your local supervisory authority. For data inside a case, direct the request to the organisation running the case — we support them with per-case data maps.

We use a short list of vetted subprocessors for hosting, model inference and support tooling. The current list is published in the Trust Center; we give thirty days’ notice before adding one.

Our Data Protection Officer answers directly: privacy@hendl.ai, or Hendl Labs Ltd, 1 Sekforde Street, London EC1R 0BE.