1. Introduction and Scope
This Privacy Policy explains how Blackshiba Consulting Company Limited (黑柴管理顧問有限公司, "we," "us," or "our") collects, uses, stores, and protects your personal data when you use Handshaker (including the Web App, backend API, and Chrome extension, collectively the "Service").
By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Service.
2. Data Controller and Contact Information
- Operator: Blackshiba Consulting Company Limited (黑柴管理顧問有限公司)
- Tax ID: 60657238
- Contact email: contact@handshakerai.com
- Official website: https://handshakerai.com
3. Data We Collect
Depending on the features you use, we may collect the following types of data:
- Account data: email address, display name, profile photo, sign-in method (e.g., Google or email/password), and Firebase user identifier.
- Profile information: company, job title, industry, region, skills/bio, tags, business card or avatar images, and other information you voluntarily provide.
- Contact data: names, job titles, companies, contact details, notes, source platform, interaction records, partner relationships, invitation status, and related information.
- Google integration (requires your separate authorization): Google Contacts (read-only), Gmail message headers and content summaries (read-only), and Google Calendar events and attendees (read-only), collected only when you initiate synchronization within the App.
- Chrome extension (requires your consent and manual initiation of sync): When you start LinkedIn or Facebook synchronization from the Handshaker Web App, the extension reads contact data visible to you on the corresponding connections or friends pages, such as names, publicly displayed job titles, companies, and profile links (where available on the page). We do not access your social platform passwords, session cookies, messages, posts, or other private content, and we do not send messages or connection requests on your behalf.
- LinkedIn cloud sync on mobile (requires your manual initiation): the LinkedIn account, password, security-check interactions, and verification codes you enter are transmitted over HTTPS to a controlled cloud browser solely to complete sign-in and synchronization at your direction. Passwords and verification codes are not written to the Handshaker database or application logs. To continue synchronization, or when you choose to stay signed in, the LinkedIn session and cloud-browser profile may be temporarily retained by the processing service.
- Device and technical data: browser type, operating system, IP address, API request logs, error reports (if enabled), extension binding identifiers, and FCM push tokens (if you enable push notifications); on our official website and Web App, analytics tools may also collect page views, feature usage events, device type, and similar data (see Section 6).
4. Sources of Data
- Information you provide directly (registration, profile edits, manual contact entry, preference settings).
- Third parties you authorize (Google OAuth, LinkedIn/Facebook page synchronization).
- Automatically generated data (sync job records, notifications, system timestamps, security and debugging logs).
- Product analytics tools (production): Google Analytics 4 and Microsoft Clarity (see Section 6).
5. Purposes of Use
- To provide, operate, and improve contact management, partners, search, notifications, and integration features.
- To verify identity, bind the Web App and Chrome extension, and prevent abuse.
- To synchronize Google, LinkedIn, or Facebook contacts to your account at your direction.
- To send account-related notifications (e.g., email verification, account deletion confirmation).
- To analyze product usage to improve the experience (e.g., Google Analytics 4 and Microsoft Clarity; primarily in aggregated or anonymized form, not for selling personal data or personalized advertising).
- To comply with legal obligations, respond to lawful requests, and protect users and the security of the Service.
7. Data Retention
- While your account is active: we retain your account, contact, and integration data so you can continue using the Service.
- After you disconnect an integration or sign out of the extension: related OAuth tokens or binding status are updated or revoked according to system design; contact data already synced to your account remains unless you delete it or delete your account.
- LinkedIn cloud sync on mobile: the sign-in session and cloud-browser profile are temporarily retained only to continue synchronization you initiated. You may clear the sign-in state from the sync screen, and the processing environment may also remove it automatically when recycled. Contact data already synced remains unless you delete it or delete your account.
- After account deletion: once the deletion process completes, data is removed or anonymized from primary systems after the grace period expires; backups or logs may be retained briefly for technical or legal reasons before deletion.
8. Data Security
We implement reasonable technical and organizational measures, including HTTPS encryption in transit, cloud access controls, and centralized backend writes (the frontend does not write directly to Firestore). However, no method of transmission over the Internet is completely secure; please safeguard your login credentials.
9. Your Rights
- Access, correct, or update your profile and contact data (within the App).
- Revoke Google integration or Chrome extension binding (within the App or extension).
- Clear the cloud browser’s LinkedIn sign-in state from the mobile LinkedIn sync screen.
- Request account deletion (see the next section).
- Contact us regarding privacy matters: contact@handshakerai.com.
10. Account and Data Deletion
You may request one-click account deletion in the Web App under Profile / Settings. After you submit a request:
- Your account enters a "pending deletion" state with a default grace period of 14 days; during this period, you may sign in and cancel deletion.
- During the grace period, we will attempt to send a confirmation email to your login email address (if email services are configured).
- After the grace period expires, we will delete or anonymize your account, contacts, integration records, extension bindings, and related data, and revoke Google integration authorization.
- Deletion is generally irreversible once complete; if you only need to correct data, we recommend editing your information or disconnecting specific integrations rather than deleting your entire account.
- If you cannot use in-app features, please email contact@handshakerai.com; we will verify your identity and assist you.
11. LinkedIn Cloud Sync and Chrome Extension — Additional Information
- LinkedIn sync on mobile uses a controlled cloud browser. Only after you open sync and submit sign-in information does the cloud browser sign in to LinkedIn, process security checks required by LinkedIn, and read 1st-degree connections visible to your signed-in account.
- Mobile sign-in information is transmitted over HTTPS. Passwords and verification codes are sent only to that cloud browser to complete sign-in and are not written to the Handshaker database or application logs. If you choose to stay signed in, the LinkedIn session may be temporarily retained in the cloud-browser profile until you clear it or the processing environment is recycled.
- The Handshaker Chrome extension collects contact data only after you accept this Privacy Policy, sign in and bind your Handshaker account, and explicitly initiate LinkedIn or Facebook synchronization from the Handshaker Web App.
- During synchronization, the extension opens or uses the relevant LinkedIn Connections page or Facebook friends page and reads contact information visible to your signed-in account, such as names, publicly displayed job titles, companies, and profile links (where available on the page).
- Even if the view automatically returns to the Handshaker Web App during synchronization, data reading is limited to that user-initiated social sync session; the extension does not collect or upload contact data on its own when synchronization is not active.
- The extension does not access social platform passwords, session cookies, private messages, posts, payment data, or browsing data unrelated to synchronization; it also does not send messages, posts, connection requests, or perform other social actions on your behalf.
- Synchronized data is transmitted over an encrypted connection to https://api.handshakerai.com and stored in your Handshaker account solely to provide contact management features; it is not used for advertising or sold to third parties.
- You may stop using synchronization, unbind your account, or remove the extension at any time. Removing the extension clears locally stored login, consent, and binding state in your browser; contact data already synced to your Handshaker account may be deleted in the Web App or removed through the account deletion process.
- Handshaker is an independent service and is not affiliated with, endorsed by, or sponsored by LinkedIn or Meta. Users are responsible for complying with the applicable terms and policies of those platforms.
12. Children's Privacy
The Service is not directed to children under 16 (or the higher age required in your jurisdiction). If we learn that we have collected children's data without verifiable parental consent, we will delete it promptly.
13. Cross-Border Transfers
Cloud services we use (such as Google Cloud) may be located outside your country or region. By using the Service, you understand that your data may be processed abroad and is protected by this Policy and the security measures of our providers.
14. Changes to This Policy
We may update this Policy due to feature changes, legal requirements, or operational needs. For material changes, we will update the "Last Updated" date on this page; where required by law, we will provide additional notice through in-app notifications, email, or other means.
15. Contact Us
If you have any questions about this Privacy Policy, our data practices, or exercising your rights, please contact us at contact@handshakerai.com.