Privacy

What data we process, why, for how long, and how to make us stop.

Who processes your data

What we process, and what we do not

It does not connect to any system of yours Handmetric does not read your email, your documents or your databases, and asks for no permission over them. The only thing it processes is the text you write to describe a process, and what is estimated from it. The Google account is used only to know who you are: your address and your name, nothing else.

What is kept in your area

The projects you create —the company name, its sector, how many people and the hourly cost you give—, each process you describe with its steps, and the estimates that come out of them, with their status and the reason whenever one could not be estimated. That is the point of having an area: without history there is no roadmap to compare.

For what you tell us about your company and the people who work in it, you are the controller and we are the processor: we process that data on your instructions and for nothing else. The processing agreement spells it out, with the list of providers involved.

Process descriptions and the names of whoever performs each step are stored encrypted, with a different key for each organisation. The rest —how often it is done, how long it takes, what came out estimated and what did not— is stored readable, which is what allows the roadmap to be ordered without decrypting anything. Each organisation sees only its own data, and the database enforces that, not just the code.

You can delete your account and everything kept in it from your own area, with the “Delete my account” button, or by writing to belmontemoralessergio@gmail.com from the address you sign in with. It is a real deletion: no copy and no marker remain.

Specifically, what is processed:

Data Purpose Legal basis
Email address and name of your Google account Knowing who you are when you sign in, and writing to you if needed Your consent
The processes you describe: steps, who does them, with what, how long they take Estimating them and keeping the result for you to consult Your consent
Project: company name, sector, size and hourly cost Putting figures on the estimates Your consent
That you accepted the processing agreement: version, date and time Being able to prove which text you accepted Legitimate interest in keeping the service available
IP address, temporarily Rate-limiting requests and preventing abuse Legitimate interest in keeping the service available

For how long

Your account and what it holds, for as long as you keep it open. When you ask to leave, everything is deleted within thirty days at most, backups included.

There is no automatic deletion by age today: nothing disappears unless you ask. If one day there is, it will be announced here and in the processing agreement before it applies.

The area session lives seven days from the last sign-in and expires on its own. IP addresses from rate limiting, one hour at most.

Who it is shared with

With no one for commercial purposes. We do not sell or hand over data. Three providers take part, as processors: the one hosting the service and the one verifying the Google account, with data in the European Union; and the language model provider that turns your description into steps, Google LLC, which processes that text in the United States under the EU–US Data Privacy Framework and does not use it to train anything. The specific list is in the processing agreement. Separately, if you create a link to share a report, whoever has that link sees it in full, with whatever names it contains, until you revoke it from your area: it is your decision, and when you created and revoked it is recorded.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to belmontemoralessergio@gmail.com. What is stored in your area you download in full from there, as JSON ("Download my data"), and delete from there.

If you gave us your email in a contact form, you can delete it here instantly. The area account is deleted from your own area by typing your email, or by writing to us from it if your account has no verified email.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Cookies

Three cookies are used, all technical and none from third parties: one identifies your session during the sign-in exchange with Google (30 minutes); another keeps your area open (seven days); and the third remembers which language you want the site in, and is only written if you change it. No tracking and no advertising: the only thing measured is how many times each page is viewed each day, without storing who viewed it or from where. That is why you will not see a banner asking for permission: there is nothing to consent to.

Document version: 2026-09-13

This is a courtesy translation. The Spanish version is the original and is the one that binds; in case of discrepancy, the Spanish text prevails.