Privacy policy

Who this covers

• Shoppers who use Onhand through an AI assistant such as Claude, ChatGPT, Cursor, Grok, Mistral, or Muse.
• Merchants who list a business, connect a register or booking system, or subscribe.
• Businesses we list from public sources, and visitors to askonhand.com.

What we collect

If you are a shopper

• Searches and business lookups work without signing in.
• When you sign in through your assistant to take an action, we receive an account identifier and your verified email address from our sign-in providers.
• Actions you approve, such as a booking, checkout, or quote request: the business, item or service, price, time, and the result. Reviews and outcome reports you choose to submit.
• When you are signed in and a search finds no matching item at a nearby shop, we may keep an empty-search record so nearby shops can see demand. This includes the search text you typed and the shop it relates to. The record itself carries no account identifier. These records are not deleted on a fixed schedule. They are removed if the shop's listing is deleted. Please do not type personal information in searches.
• When area requests are enabled, you can request more detail without signing in or giving an email. We count requests by a coarse area and a fixed item category. These totals contain no search text, exact location, account identifier, or session identifier. We use them to decide where to add businesses and refresh information.
• To limit repeated or abusive area requests, we keep short-lived keyed caller identifiers separately from the area totals. They are not published. Our retention targets are 180 days for daily area totals, 30 days for pending request totals, and one day for these security counters. Collection stays off until reviewed wording and verified cleanup are in place.

If you are a merchant

• Your sign-in email, name, and whether you have set up a second factor; your organization, team members, and invitations.
• Your business profile, hours, and listing requests, including the address and phone number you submit.
• For an online or service-area listing, we send your verification address to the U.S. Census Bureau once to confirm your city. We do not save that address or its coordinates in your listing, request, or audit record. Your public listing shows your city and any cities you choose to serve, without a street address or map pin.
• From systems you connect: catalog items, prices, appointment openings, and whether each item is in stock, low, or out. Access tokens for those systems are encrypted.
• Your plan and subscription status from Stripe. We never receive your card number.

From public sources

• Business names, addresses, categories, phone numbers, and websites from open map data such as Overture Maps and Foursquare Open Source Places. Details such as opening hours, takeout or outdoor seating may also come from OpenStreetMap (© OpenStreetMap contributors, ODbL), labelled with that source, unconfirmed by the business, and withheld 90 days after we last saw them.
• Text from public business web pages, fetched by our crawler, OnhandBot, which honors robots.txt.
• Item and service names and sections from an unclaimed business's own public menu pages, PDFs, and images. These sources are read in memory; we do not store the source files. We may show the names with the label "From the business's public website, not confirmed by the business", a source link, the date last seen, and a band indicating how clearly we read the name. This is not a statement about stock, bookings, or current availability. Owner-approved results come first. Website names are withheld after 90 days without another observation, when the business is claimed, or when it opts out.
• From the same pages, a price band ($ to $$$$) and details such as takeout, delivery, outdoor seating, dietary options, accessibility and payment, each with the quote or source link it came from. A band comes from a price range the page states or from the prices printed on its menu; we keep the band, not the prices. These details carry the same label and follow the same 90-day, claim and opt-out rules as website names. We read a site only after it shows the business's listed phone, or its address and name.

Technical information

• Server logs and a session cookie that keeps you signed in. For rate limiting and abuse prevention, we store your IP address, and for MCP requests your session identifier when supplied, unhashed, in short-term rate-limit counters. Expired database counters are cleared as new requests arrive and otherwise by our team. They may remain until then. We do not use advertising or cross-site tracking cookies.

Optional analytics and your choice

Product analytics is off by default; session replay is currently off. Privacy settings, available on every page, lets you accept, reject or withdraw permission at any time. We store only this preference in a first-party cookie for 180 days; it is separate from essential sign-in cookies. When analytics is enabled and you accept, we use opaque random identifiers for your signed-in account.

When enabled, and only with your permission, we use PostHog, hosted in the United States, to understand pages and features used and where setup fails. We may record a masked reconstruction of interactions, with inputs and displayed personal text hidden. We will not send shopper questions, tool contents, emails or exact stock counts. Consenting merchant funnels would use opaque random identifiers rather than email or sign-in IDs.

We honor Do Not Track and Global Privacy Control as rejection even after prior acceptance. Withdrawal stops future collection and clears browser analytics identifiers. No earlier activity will be replayed or sent after consent. Our planned limits are one year for events and 30 days for replay; deletion controls and retention will be checked before collection starts. Ask for access or deletion at privacy@askonhand.com.

Before enabling PostHog as an analytics service provider, we will put processor terms and applicable safeguards for international transfers in place. Your browser choice is also saved for your signed-in account. Rejection or withdrawal suppresses linked setup events; signing out withdraws this account consent.

What we never collect or do

• We never store exact stock counts. Shoppers see in stock, low, or out.
• We never process payments or store payment card details. The business's own provider takes payment.
• We do not sell personal information, show ads, or let anyone pay to rank higher.

How we use information

• To answer assistant questions about businesses, availability, prices, and open times.
• To carry out the actions you approve and show you their status.
• To run merchant accounts, subscriptions, and listing reviews.
• To send service email, such as invitations and decisions.
• To keep Onhand secure and prevent abuse.
• To meet legal obligations.

Who we share it with

• The business and its provider, when you confirm an action. For example, to create a Square appointment we send Square your verified email so the business knows who booked. Calendly and Shopify receive a booking reference so the result can be matched. We tell you what will be shared before you confirm.
• The assistant you use receives the results of the tools it calls.
• Service providers that run Onhand for us: Google Cloud (hosting), PlanetScale (database), Google Firebase Authentication and WorkOS (sign-in), Stripe (merchant billing), Resend (email), and an AI model provider that reads public business web pages, menu PDFs, and images to read item and service names.
• When semantic search is enabled, Google Cloud Vertex AI or the configured OpenAI-compatible embedding provider receives search text and approved catalog text to match businesses by meaning. Embedding requests contain text, without shopper account identifiers or location coordinates.
• Legal reasons: when required by law or to protect people, Onhand, or the businesses we list.
• Business transfers: if Onhand is sold or merged, under this policy's protections.

How long we keep it

These are our retention targets. Our team currently deletes records manually and periodically. Deletion is not automated. Records may remain past the target until removed. Records without a fixed deletion schedule are described below.

• Account and business profile data, while the account is active.
• Short-lived records, such as pending action requests, generally up to about 90 days, longer while an action is still being completed or reconciled. This is separate from the history of actions you approve.
• Many operational records are kept up to about 180 days. Some categories are kept longer, as listed here. Unsuccessful website discovery records, up to about a year; successful website discovery records stay while the business exists.
• Records needed to settle a later dispute, such as ownership claims, listing decisions, audit logs, and the history of shopper actions, including actions you approve, for about two years. Deleting these event records is a manual step that we do not run on a fixed schedule, so they may be kept longer.
• Empty-search records include the search text you typed and the shop it relates to. The record itself carries no account identifier. These records are not deleted on a fixed schedule. They are removed if the shop's listing is deleted. Please do not type personal information in searches.
• IP addresses in short-term rate-limit counters. Expired counters are cleared as new requests arrive and otherwise by our team. They may remain until then. Counter expiry does not itself delete the stored IP address.

How we protect it

Connection tokens are encrypted, access is limited to the service that needs it, merchant actions that matter require a recent second factor, and sensitive fields are kept out of logs. No system is perfectly secure, so tell us right away at privacy@askonhand.com if you suspect a problem.

Your choices and rights

• Ask to access, correct, or delete your information, or to receive a copy, by emailing privacy@askonhand.com. We respond within 45 days.
• Disconnect Onhand from your assistant at any time in that assistant's settings.
• Merchants can disconnect a connected system from the dashboard, which deletes its stored access token.
• Businesses can ask us to correct or remove a listing, or block OnhandBot in robots.txt.
• If you own or represent a business, request removal of website items. We review the request before applying an opt-out. Your email is used only to handle the request, and request details are kept for approximately 30 days and may remain until our team removes them. An approved opt-out remains in effect.
• Depending on where you live, including under the Texas Data Privacy and Security Act, you may have additional rights. We will not treat you differently for using them, and you can appeal a decision by replying to our response.

Children

Onhand is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact privacy@askonhand.com and we will delete it.

Changes and contact

We will post changes here and update the date above. For a material change we will give notice before it takes effect. General support: help@askonhand.com. Privacy requests: privacy@askonhand.com.