HandsetHQ privacy policy

What we collect

• SMS: new incoming and outgoing message text, sender and recipient numbers or sender identifiers, timestamps, direction, message status and command/delivery evidence on the SIM you select. This includes SMS sent in your normal messaging app and can include personal conversations or verification messages on that SIM.
• Device and connection information: the phone label and business number you supply, app-generated installation/enrollment identifiers, app version, connection times, permission/readiness states, pending-event counts and operational error codes. SIM identifiers are used on the phone to bind capture and sending to your selected subscription.
• Workspace accounts: the owner’s email address, business/workspace name, authentication records, device enrollments and developer-key metadata supplied through the website.
• Service operations: our hosting, database and email providers process technical request information, such as IP addresses, authentication events and email delivery records, to operate and protect the service.

The companion does not import pre-enrollment SMS history or collect RCS, MMS, your address book, location, microphone audio or call recordings. It does not use advertising identifiers or an advertising/behavioural analytics SDK. A restricted earlier enrollment retains its narrower contact scope until you review a new enrollment.

Why SMS access is needed

SMS access powers the workspace activity feed, synchronises new messages between the phone and website, and sends workspace or connected-CRM requests through the selected SIM. Phone access identifies and checks that SIM. Notifications show the live connection.

After you agree to the in-app disclosure, grant Android permissions and connect a reviewed setup, capture, upload and remote sending can continue in the background when the app screen is closed. Workspace/API requests can trigger SMS sends while sending is enabled. Carrier charges may apply. We do not sell message data or use it for advertising.

Who can access the data

Your workspace owner can view uploaded messages and manage enrolled phones. Developer API keys can give systems chosen by that owner access to messages, devices or sending, according to the key’s scopes. Those CRM systems may keep their own copies.

Authorised NorthAxis operators and service providers may access data as needed to run, secure and support the service. Supabase provides the hosted database and account authentication; Vercel hosts the website and API; Resend delivers account emails. Resend is not used to transmit your SMS content. Data is not posted publicly.

The hosted workspace database is configured in Sydney, Australia. Our providers may process technical, support or email information in other countries. If you pair with a different connector server, its operator receives the selected SMS data and its own privacy policy also applies. Check the server shown in setup before connecting.

Security and retention

The release companion uses HTTPS/WSS with normal certificate checks. Device credentials are protected using Android’s key storage. Workspace access uses authenticated accounts and workspace-scoped permissions; developer and device credentials can be revoked. SMS history is readable by the service for the activity feed and integrations; it is not end-to-end encrypted.

The phone keeps unacknowledged or unresolved records so they can be transferred reliably. Acknowledged payloads are removed from its transfer queue, while compact deduplication and execution evidence remains until safe disconnection. This does not delete the original messages in your phone’s messaging app.

The hosted workspace retains SMS, command and activity history while the workspace exists, unless deletion is requested and completed. There is currently no automatic age-based history purge. Removing or revoking a device does not erase that history. Older copies in provider backups expire under the configured backup retention schedule rather than immediately when live records are deleted.

Your controls

You can decline the SMS disclosure, deny or revoke Android permissions, and pause capture and sending in the companion’s Device settings. Use Disconnect when safe after pending work is resolved. A workspace owner can revoke a device’s server access or revoke an integration key. A text already submitted to the carrier cannot be recalled.

Only enroll a phone you are authorised to share. If you use a company phone, ask the workspace owner about their customer/employee information practices and connected CRM systems.

Children and policy changes

HandsetHQ is business software intended for adults and is not directed at children. We update this page when our practices change. Changes that require renewed SMS consent are presented in the companion before further capture or sending.