handld Privacy Notice
Version: to be confirmed. Effective date: to be confirmed. Last updated: 9 Oct 2026.
1. Who is responsible for your data
handld (company in formation) ("handld", "we") is the controller of the personal data described here. Contact for privacy questions and requests: therestishandled@gmail.com.
This notice covers handld.xyz, the web desk at app.handld.xyz, invitations, onboarding, support and any waitlist.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and account | Email address, login identifiers, account settings, invitation code, Terms and Ruleset acceptance records (version, time) | You |
| Wallet | Your Hyperliquid account (wallet) address; the public address of the trade-only agent wallet you authorise | You, Hyperliquid |
| Eligibility declarations | Declared country of residence; every nationality you declare; age confirmation (18+) | You |
| Location and device signals | IP address, IP-derived country/region, VPN/proxy/datacenter indicators, browser and device data, session times | Your device. IP geolocation: DB-IP (db-ip.com) IP to City Lite database, processed locally on our server; your IP is not sent to DB-IP. |
| Sanctions screening record | Name, date of birth, nationalities and residence as screened; wallet address screened; lists checked, results, reviewer, date | You, public sanctions lists |
| Trading data and audit log | The symbol, direction and invalidation you send; the size and stop the Ruleset calculates; allow/refuse reason; Ruleset version; orders, fills, fees and positions on your Hyperliquid account placed or affected by the desk; timestamps | You, the desk, Hyperliquid |
| Support and communications | Messages you send us, and our replies | You |
| Billing (only once paid seats exist) | Name, billing country, payment status and limited card details as handled by Stripe. We do not see full card numbers | You, Stripe |
| Website and analytics | none | none |
We do not ask for, and you must never send us, your Hyperliquid master private key or seed phrase.
Note on the opacity of the desk: the trading screen does not show you size, stop or refusal reasons, but we do record them in the operator tools and audit log, and they are personal data about you. See section 8 on your right of access.
3. Why we use it and our legal basis
Lawful bases are under the EU General Data Protection Regulation (GDPR). The basis for each purpose below is to be confirmed.
| Purpose | Data used | Lawful basis (to be confirmed) |
|---|---|---|
| Create and run your account; send your trades to Hyperliquid under your accepted Ruleset; enforce lockouts; keep the desk working | Account, wallet, trading data, device data | Performance of a contract (Art. 6(1)(b)) |
| Check eligibility (age, residence, location, nationality) and enforce the geo gate, including VPN/proxy detection | Eligibility declarations, location and device signals | to be confirmed |
| Sanctions screening of invitees and users, including wallet address | Screening record, eligibility declarations, wallet | to be confirmed |
| Keep an audit log of instructions, calculated parameters and outcomes | Trading data and audit log | to be confirmed |
| Security, fraud and abuse prevention; investigating incidents | Device, location, account, logs | Legitimate interests (Art. 6(1)(f)) in securing the Service and users' accounts |
| Support and complaints | Support messages, account, relevant trading data | Contract; legitimate interests |
| Service emails (onboarding, Ruleset or Terms changes, security notices) | Contract; legitimate interests | |
| Waitlist or product news emails (if any) | to be confirmed | |
| Billing (once paid seats exist) | Billing data | Contract; legal obligation (accounting and tax) |
| Establishing or defending legal claims; responding to lawful requests from authorities | Any relevant data | Legitimate interests; legal obligation |
Nationality data is not a "special category" under GDPR, but it is sensitive in practice. We use it only for eligibility and sanctions purposes.
Automated decisions. The desk applies the Ruleset automatically, including refusing trades and applying lockouts. Signup and access may also be refused automatically on eligibility or location signals. Sanctions matches are always reviewed by a person before any final decision.
4. Who we share it with
We do not sell your personal data, and we do not share it for third-party advertising.
We share personal data only as needed with:
- Processors acting on our instructions under a data processing agreement: to be confirmed.
- Hyperliquid, the venue where your account sits and where the desk places orders. Orders and the builder fee placed by the desk are associated with your Hyperliquid address on Hyperliquid. Hyperliquid processes data under its own terms and privacy practices, and activity on Hyperliquid may be publicly visible on its ledger.
- Stripe, once paid seats exist, for payments. Stripe may act as an independent controller for some purposes under its own privacy policy.
- Professional advisers (lawyers, accountants, auditors) under confidentiality.
- Authorities, courts or regulators, where the law requires it or to establish, exercise or defend legal claims.
- A successor, if the business or its assets are transferred, subject to this notice.
5. International transfers
Some processors may process data outside the European Economic Area. Where they do, we rely on a transfer mechanism to be confirmed. You can request a copy of the relevant transfer terms at therestishandled@gmail.com. Data on Hyperliquid is recorded on a public ledger that is not located in any one country.
6. How long we keep it
| Data | Retention (to be confirmed) |
|---|---|
| Account and contact data | to be confirmed |
| Eligibility declarations and geo-gate logs | to be confirmed |
| Sanctions screening records (including refused invitees) | to be confirmed |
| Trading data and audit log | to be confirmed. The audit log is designed to be tamper-evident and append-only; see section 8 on erasure |
| Support messages | to be confirmed |
| Security and access logs | IP address and IP-derived location: 90 days. Event record (type and time): up to 2 years from the event. |
| Billing records (once paid seats exist) | to be confirmed |
| Waitlist email | to be confirmed |
When a retention period ends we delete or irreversibly anonymise the data.
7. Security
We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, and limiting operator access to the audit log. The desk holds only a trade-only agent key that cannot withdraw funds. No system is free of risk. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.
8. Your rights
Where GDPR applies, you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase data, where the law allows. Some data, such as sanctions screening records and audit-log entries, may need to be kept for legal obligations or legal claims;
- restrict processing;
- data portability for data you provided, processed by automated means on the basis of contract or consent;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, where we rely on consent, without affecting earlier processing;
- not be subject to a solely automated decision with legal or similarly significant effects, where Art. 22 applies (see section 3).
To exercise a right, email therestishandled@gmail.com. We may need to verify your identity. We respond within one month, extendable where the law allows.
If you live outside the EEA, you may have similar rights under your local law.
9. Complaints
You can complain to us first at therestishandled@gmail.com. You also have the right to complain to a data protection supervisory authority, in particular in the EU Member State where you live or work or where an alleged infringement took place. Our lead authority in Estonia is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia. Phone +372 627 4135. https://www.aki.ee/en
10. Age
The Service is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn we have, we will delete it, subject to section 6.
11. Cookies
Cookie use on the Service is to be confirmed.
12. Changes
We will post updates here and, for material changes, tell you by a method to be confirmed before they apply.