Legal

Privacy Policy

Last updated: 11 July 2026 · Effective on public launch

This policy explains what personal data HandInLoop collects, how we use and protect it, who we share it with, how long we keep it, and the choices and rights you have. It is written to meet Malaysia's Personal Data Protection Act 2010 (PDPA). If you are in a jurisdiction with additional protections, those may also apply.

1. Who we are

LESOFI LLP (registration no. LLP0010642-LGN), trading as "HandInLoop" ("we", "us"), is the data controller for the personal data described here. You can reach us at privacy@handinloop.com, or by post at 31, Jalan BU 6/4, Bandar Utama, 47800 Petaling Jaya, Selangor, Malaysia.

Human verification is carried out by trained reviewers operating on the Gigsdata workforce platform, acting as our data processor under contract and only for the purpose of verifying your documents.

2. What we collect

• Account details. When you sign in with Google, we receive your name, email address, and Google account identifier. We do not receive your Google password.
• Documents you upload. The files you submit for extraction (for example invoices) and the data extracted from them. These may contain personal data about you or third parties (names, addresses, contact details, amounts).
• Usage and audit records. A record of each job — who submitted it, when, which fields were extracted, and each review/validation step — kept as your audit trail.
• Product analytics. Pseudonymous events (a document was submitted, validated, or a limit was reached) keyed to your account identifier. These contain no document content and are used to understand and improve the service.
• Technical data. Standard request logs (IP address, timestamps) needed to operate and secure the service.

3. How we use your data

• To provide the service: extract data from your documents using AI, route low-confidence results to a human reviewer, and return validated data with an audit trail.
• To manage your account, enforce free-tier limits, and process any credit purchases.
• To send you service messages (for example, when a job is complete).
• To secure, maintain, and improve the service.
• To meet legal and record-keeping obligations.

We process your data to perform our contract with you, to pursue our legitimate interest in running and improving the service, and — where required by the PDPA — with your consent. We do not sell your personal data, and we do not use your documents to train third-party AI models.

4. AI and human review

Documents are processed by a large language model hosted on Amazon Web Services (AWS Bedrock) within the Asia Pacific (Singapore) region. AWS processes the content only to perform the extraction and does not use it to train its models. When a result needs checking, the document is shown to a trained human reviewer who verifies the extracted fields. Reviewers see only what they need to complete the review and are bound by confidentiality obligations.

5. Where your data is stored and processed

Your documents and extracted data are stored on AWS in the Asia Pacific (Singapore) region, encrypted in transit (TLS) and at rest (AWS KMS). This means your data may be processed outside Malaysia:

• Singapore — document storage, AI extraction, and the application database (AWS).
• United States — pseudonymous product analytics (PostHog), which contains no document content.

Where we transfer personal data outside Malaysia, we do so under safeguards consistent with the PDPA and our providers' contractual and security commitments.

6. How long we keep it

• Uploaded documents: automatically deleted 30 days after a job completes. This window lets you re-download results; after it, the source file is removed from storage.
• Extracted data and audit records: kept while your account is active, as these are the output you rely on and your compliance record. Removed on account deletion, subject to any legal retention obligation.
• Account and billing records: kept for as long as needed to provide the service and meet legal/accounting requirements.

7. Deleting your data

You can ask us to delete your documents or your account at any time by emailing privacy@handinloop.com. We will:

• delete the requested documents (and their extracted data, if you ask) from active storage promptly, and
• on account deletion, remove your account, documents, and extracted data,

except where we must retain certain records to meet a legal obligation. Backups are cycled out on a rolling basis. Independently of any request, uploaded documents are auto-deleted on the retention schedule in section 6.

8. Who we share it with

We share personal data only with:

• Service providers who process it on our behalf under contract — AWS (hosting, storage, AI), the Gigsdata reviewer platform (human verification), PostHog (analytics), and our email and payment providers.
• Authorities, where we are legally required to disclose.

We do not share your documents with anyone else, and we never sell your data.

9. Your rights

Under the PDPA you may request access to the personal data we hold about you, ask us to correct it, withdraw consent, limit certain processing, or request deletion. To exercise any of these, email privacy@handinloop.com. We will respond within the timeframe required by law. If you are not satisfied, you may contact the Personal Data Protection Commissioner of Malaysia.

10. Security

We protect your data with encryption in transit and at rest, strict access controls, tenant isolation, and audit logging. No system is perfectly secure, but we work to protect your data and to notify you and the authorities of any breach as required by law.

11. Cookies & analytics

Our marketing site uses only the storage strictly necessary to function. With your consent — given via the banner shown on your first visit — we also use PostHog to measure pageviews and site usage so we can improve the site. This analytics is off until you accept, records only pseudonymous usage (no document content), stores its state in your browser's local storage rather than tracking cookies, and can be declined with no loss of functionality. You can clear your choice at any time by clearing this site's data in your browser.

12. Changes to this policy

We may update this policy as the service evolves. We will post the new version here and update the "last updated" date; significant changes will be communicated to account holders.

13. Contact

Questions about this policy or your data? Email privacy@handinloop.com.