Privacy.

1. Introduction

We are mavi Finans Ltd, a company registered in Cyprus with registered office in Nicosia, Cyprus (“Handlr”, “we”, “us”).

This privacy policy explains how we process your personal data when you use Handlr (“the Service”), whether as a creator receiving support or a supporter making donations. It also explains your rights under the EU General Data Protection Regulation (GDPR) and applicable Cyprus data protection laws.

mavi Finans Ltd is the data controller for personal data processed through the Handlr platform.

2. When you support a creator

When you support a creator, their Handlr transaction view can show the name and optional message you submitted, the amount, payment status and limited card information such as the brand and last four digits when available. Handlr does not show the creator your full card number or your email address in that view. Stripe processes the card payment. A creator is responsible for their own use of information they receive.

3. Personal data we collect

Creators: We store the account name and email, page details (such as username, bio, avatar and cover), payout-account reference and capability status, and the profile or address details you choose to provide. Stripe handles identity verification and bank-account details for card payouts; Handlr does not store your identity documents or full bank details for that flow. Some legacy payment fields remain in the database but the mavi pay rail is inactive.

Supporters: We record the name you enter, support amount, optional message and payment/settlement references. Stripe processes card details; Handlr does not store full card numbers. If you use a Handlr account or contact support, we also process the email address you provide for those purposes.

External analytics: Handlr currently loads no external analytics or session-recording script. A future analytics connection will be announced and its privacy controls reviewed before activation. No third-party advertising is active.

Creator page views: We record total visits, including repeat visits, without cookies for this counter. It stores no visitor names, email addresses or raw IP addresses. Random visit receipts prevent duplicate counting and become eligible for bounded cleanup after 24 hours; aggregate totals remain separate from payment records.

Email delivery: Our configured email provider receives the recipient address and message content needed to send service emails. When using Resend, verified delivery-event records contain provider event and email identifiers, status types and timestamps. These records exclude message content and recipient addresses and become eligible for bounded cleanup once both recorded timestamps are over 30 days old.

Support: We save your support questions, replies, contact details you provide and delivery status so staff can help you and you can return to your conversation. Dashboard conversations are linked to your signed-in creator account. An email address supplied through the contact form does not verify account ownership. If agent support is enabled, the assigned assistant receives the relevant conversation and permitted account context. Private support conversations are not automatically published as shared guidance or used to train a global model. Please do not include passwords, authentication codes or card details.

4. How we use your data

• Contract: Provide the Service — page creation, payment processing, emails.
• Legal obligation: EU tax reporting, AML compliance, legal requests.
• Legitimate interests: Improve the Service, prevent fraud, respond to inquiries.
• Cookie preferences: External analytics and marketing tracking are currently inactive. Manage stored preferences via the Cookie Policy.

5. Data storage

Payments are processed through Stripe. Service emails use the configured mail provider, currently Resend during the temporary connection; Mittera reconnection is deferred. The email provider processes recipient addresses and message content to deliver those emails.

6. Retention

We retain information for the purpose for which it was collected and review an account-closure or erasure request by data category. Some payment, accounting, fraud, dispute and legal-claim records may need to remain after an account closes. We restrict their use where required and review them when the applicable obligation or claim ends. Support conversations and provider copies require their own review; closing a Handlr account does not by itself erase a provider's copy.

Creator page-view receipts become eligible for bounded cleanup after 24 hours, and Resend delivery-event records after both recorded timestamps are over 30 days old. These cleanups run when the relevant new activity occurs, so eligibility is not a guarantee that every row disappears at that exact time. A stream alert's seven-day display window likewise does not itself delete its stored record. We do not currently promise one deletion deadline for every category.

7. Your GDPR rights

You may request access, rectification, erasure, portability, objection or restriction of processing. Contact hello@handlr.sh. Staff verify identity before disclosing account data or processing closure. We respond without undue delay, normally within one month; if a lawful extension is needed, we tell you within that first month. Erasure can be limited by a legal obligation or a valid claim. You may complain to the Cyprus Data Protection Commissioner.

8. Cookies

Essential cookies support authentication, theme and saved preferences. External analytics and session recording are currently disabled. See Cookie Policy.

9. Contact

mavi Finans Ltd, Nicosia, Cyprus. hello@handlr.sh.