Privacy Policy

InHandsIQ is an order-tracking service for promotional-products distributors. You forward your order emails to a private address, and InHandsIQ shows which orders are at risk of missing their in-hands date. InHandsIQ is run by Youssef, an individual based in Morocco. In this policy, “we” and “us” mean Youssef. For any question or request, write to youssef@inhandsiq.com.

This policy covers our website, inhandsiq.com, and the InHandsIQ app. The emails a company forwards to us also contain information about other people, such as its suppliers and clients. We handle that information on the company's behalf, under the same rules.

Your account

• Your email address and your name.
• If you sign in with Google: the name, email address and profile picture Google shares. We ask Google only for this basic profile, never for access to your Gmail.

Your company

• The company name, its time zone, and two answers from sign-up: how many orders you have active and which order system you use.
• The settings you choose: the morning digest and its hour, deadline defaults, costs of delay, and how long to keep raw email.
• Gmail's forwarding confirmation code and link, and the address that asked for forwarding, when Gmail sends them to your intake address, so the setup page can show them to you.

The emails you forward

• Whatever you or your forwarding rule send to your intake address: senders, recipients, subject, date, message IDs, the body and attachments. The next section explains what happens to them.

In your browser

• A cookie that keeps you signed in.
• A few preferences in your browser's local storage: your setup checklist, which mail app you use, and marks you make on the sample pages. They stay on your device; we don't receive them.

Records of the service

• Our hosting providers keep standard request logs, such as the time, IP address and page, to run and secure the service. Our own logs record outcomes, such as “1 email stored”, never the content of an email.
• For each AI request we record which model ran and what it cost, not what it read.

We don't use analytics, advertising or tracking tools.

You choose what to forward: all your email (the simplest setup), or only order emails through a filter. When you forward everything, most of what arrives isn't about an order; it takes step 3 below and is deleted within minutes. Every email follows the same path:

1. Arrival. The email reaches our email-receiving provider and waits in a private, encrypted holding area. Mail the provider flags as carrying a virus is deleted without being read.
2. A quick automated check. An AI model reads the email to decide whether it's about an order. Mail the provider flags as spam skips this check and counts as not about an order.
3. Not about an order. The email is deleted within minutes and is never shown to anyone. We keep only a fingerprint (a one-way hash of its message ID), the date, the intake address it was sent to and a category such as “newsletter”, so the same email isn't processed twice.
4. About an order. The email and its attachments are stored in your company's private storage. Our AI reads them to pull out the facts (dates, promises, statuses), and each fact keeps the exact sentence it came from.
5. Clean-up. The copy in the holding area is deleted as soon as the email is handled. If something fails, we try again, and anything still there is deleted automatically after about one to two days.

If the check can't run when an email arrives, for example because our AI provider is briefly unavailable or your company's monthly AI budget is used up, the email is kept in your company's private storage, shown nowhere, and checked again later by a scheduled job.

Anyone can forward past order threads to try@in.inhandsiq.com to see what InHandsIQ would have flagged. We accept them only from a sender whose email passes standard authentication checks, at most twice a day per company and 60 emails at a time. We prepare at most 10 readouts a day in total; later submissions wait, unread, for the next day with room. If our spam filter flags a submission from an authenticated sender, it waits, unread, until Youssef decides whether to prepare it.

• The emails are kept in a separate space used by that one submission and read by our AI only to prepare your readout.
• Before the readout is sent to you, Youssef reviews it: the orders, dates and the quotes it shows. That is the one case where a person reads what our AI found without being asked for help, because you asked for the readout.
• The emails, the readout and everything about the submission are deleted within 7 days of its arrival. They're never used for anything else.
• If we turn a submission away, we keep only the sender address it showed, the reason and the results of the authentication checks, so Youssef can see that a real sender was refused. Its emails are not kept. That record is deleted within 7 days.

• Order emails: the email, its attachments and its text are deleted a set number of days after the order closes. Your company chooses that number in settings, from 30 to 365 days (90 by default). The facts and quotes taken from the email stay as the order's record.
• Account and company information: for as long as your company uses InHandsIQ.
• Deleting your company: your company's owner can delete it in settings. We delete its stored files first, then all of its data: orders and their risk history, emails, fingerprints, drafts and settings. Your own sign-in account (your name and email) stays, so you can start again. To delete it too, write to youssef@inhandsiq.com and we'll do it within 7 days.
• Backups: deleted data can remain in our database provider's backups for up to 7 days. Stored email files are not part of those backups.

We use AI models to read emails: first to check whether an email is about an order, then to pull out the facts. Requests go through a routing service that sends them only to model providers that don't store the content or train on it (zero data retention). We never use your emails to train AI models, ours or anyone else's.

AI can misread an email. That's why every fact shows the sentence it came from, and why dates, deadlines and risk levels are calculated by our own code, not by the AI.

• To run InHandsIQ for your company: reading the emails you forward, building your orders, flagging risks and preparing follow-up drafts.
• To sign you in and keep your account secure.
• To answer you when you ask for help.
• To tell Youssef when a new company signs up (your name, email, company details and sign-up answers), so he can welcome you personally.
• To send you the service emails described below.

We don't sell your information and we don't use it for advertising. We won't include your company's data in statistics across companies unless your company opts in; no such feature exists today.

If you're in the EU or UK: we use your information to provide the service you signed up for, and to keep it secure, which is in our legitimate interest and yours.

• Sign-in links, when you ask for one.
• The morning digest, once it's available, to the people in your company. Your company can turn it off in settings.
• Replies when you write to us.
• Your backtest readout, if you send threads to try@, from Youssef's own mailbox.

We never send email to your suppliers or clients, and never from your mailbox. Follow-up drafts open in your own email app, and you decide whether to send them.

If an email we send you bounces permanently, or you mark one as spam, we stop emailing that address. We keep it on a do-not-send list with the reason and the date, nothing else. Write to us if you want it removed.

A few service providers host and run parts of InHandsIQ. They process your information only on our instructions:

• website hosting and computing;
• database, sign-in and file storage;
• email receiving and sending;
• an email delivery service for our internal sign-up notifications, which keeps a copy of each message it delivers for up to 45 days;
• an AI routing service and the AI model providers it uses, under zero data retention;
• Google, if you choose to sign in with Google.

Our hosting, database, storage and email receiving services keep your information in the United States, so if you're elsewhere, it's transferred there. Sign-in emails are sent through our own mailbox provider, which may handle them outside the United States; they carry only your email address and the link. We'll give you the names of these providers on request at youssef@inhandsiq.com.

• Your information is encrypted in transit (HTTPS) and at rest.
• Each company's data is kept apart from every other company's at the database level.
• We check the signature on every incoming-email notification before processing anything.
• The key our app uses for incoming email can reach only that holding area, and the database's administrative key never leaves our servers.
• Only Youssef has administrative access. He looks at your company's emails or orders only when you ask for help and give permission, or when it's necessary to keep the service secure or to comply with the law.

Wherever you live, you can ask us to see, correct, export or delete the personal information we hold about you, or object to how we use it. Write to youssef@inhandsiq.com; we answer within 30 days. If you're in the EU or UK, you can also complain to your data protection authority.

If you're a supplier or client whose details appear in an email a company forwarded to us, you can make the same requests to that company or to us.

InHandsIQ is a business service and isn't meant for anyone under 18.

When we change this policy, we update the date at the top. If a change affects how we handle your data, we email account owners before it takes effect.

Youssef, Morocco · youssef@inhandsiq.com