Hands for Agents · your engineering s.r.o., company ID 09738100

Privacy notice (GDPR)

Version 2026-09-29. What personal data is processed, why, where and for how long.

What we do
Physical-world engineering tasks in the Czech Republic (EU): design, make, assemble, measure, test, verify on site, receive and ship. Order one service on its own — for example only a 3D-model check, only 3D printing, only a machined part, or only manufacturing drawings — or combine several, up to full product development and construction through to the finished item shipped to you. Each task ends with an evidence package.
What we do not do
Nothing that involves credentials or accounts, impersonation, surveillance of people, social-media manipulation, bypassing verification, referral fraud, weapons, counterfeits, or anything illegal in the Czech Republic or the EU. A human screens every task.
How to pay
Fixed quote in EUR or USD, paid by card through Stripe Checkout by the agent or its operator: in full at ordering up to 150 EUR, deposit and balance above. No crypto, no anonymous payment. Every task gets an invoice from your engineering s.r.o.

1. Controller

your engineering s.r.o., company ID (IČO) 09738100, Jaurisova 515/4, Michle, 140 00 Praha 4, Czech Republic. Contact for data protection: legal@handsforagents.com. We have not appointed a data protection officer; we are not required to.

2. What we process, why, and for how long

Data Purpose Legal basis (GDPR) Kept for
Operator's e-mail and name or company name (both required for every request), optional country, optional VAT or tax id Quote, contract, invoice Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (accounting law); Art. 6(1)(f) legitimate interest for the rest of the tax review period Task record: 24 months after the task ends. Invoice and accounting records: 10 years
Content of the request, correspondence (including the messages we send you through the status API and by e-mail, and the messages you or your agent send us through the status API or by e-mail), input files Performing and documenting the task Art. 6(1)(b) contract 24 months after the task ends
Delivery address, recipient name and phone Shipping Art. 6(1)(b) contract 24 months after the task ends
Evidence package (photos, video, reports) Proof of performance, disputes Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest in defending claims 24 months after the task ends
Identity verification data for sensitive task categories Preventing misuse Art. 6(1)(f) legitimate interest in preventing fraud 24 months after the task ends
Refused requests, including any files uploaded to them and messages sent about them (by us or by you) Preventing repeated misuse for a short screening window Art. 6(1)(f) legitimate interest 7 days after the refusal, deleted from the live database and file storage. Database and file backups, made daily and before every deployment, are not deleted or rotated on a fixed schedule, so a copy can remain in a backup without a time limit. The e-mails notifying us of the request or of a message you sent, sent to our own mailbox, are not deleted by this. The access log and the application log entries about the request (which include the quote id, and for the application log the e-mail subject line, which can include your name) are not deleted by this either and follow the rows below instead: 30 days in active use, then archived for 3 years
Payment status, last four card digits, card country (from Stripe) Matching payments to tasks, refunds Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (accounting law) 10 years with the accounting records
Server access log: IP address, time, requested URL, user agent Operating and securing the site; kept afterwards to establish, exercise or defend legal claims Art. 6(1)(f) legitimate interest 30 days in active use, then archived, with access restricted to the operator, for 3 years (the general limitation period)
Usage statistics of the MCP server and the API: time, host and path, the MCP method and tool name (never the tool's arguments or our replies), the name and version the client software reports about itself, user agent, country (from Cloudflare), a session marker, the identifiers of a quote or task created in the session, and a one-way hash of the IP address (salted with a secret that changes every month; the address itself is not stored in this record) Finding out how many and what kind of AI agents use the service, and improving it Art. 6(1)(f) legitimate interest 90 days as detailed records, then only daily totals without any address or hash
Application log: for every e-mail the system sends about your request or task, the recipient address and subject line (which can include your name) Confirming that a notification about a quote or task was actually sent; kept afterwards to establish, exercise or defend legal claims Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest 30 days in active use, then archived, with access restricted to the operator, for 3 years (the general limitation period)

Retention periods are the ones in the terms of service, section 14. Security measures, the same as in section 10 of the terms and in the data processing agreement: access limited to the persons doing the task; devices encrypted and protected by password; data stored in the EU.

We never receive or store full card numbers. We do not use personal data for marketing, profiling or automated decision-making. Every decision about a request is made by a human.

3. This website

Static HTML. No JavaScript is executed, no cookies are set, no analytics, no third-party requests, no images or fonts loaded from other servers. The payment page is hosted by Stripe on stripe.com and is subject to Stripe's own privacy policy and cookies.

4. Who receives the data

We store data in the EU. Stripe may transfer data outside the EU under the safeguards described in its privacy policy (EU–US Data Privacy Framework, standard contractual clauses). When we ship outside the EU, the carrier and the recipient's customs authority receive the shipping data.

5. Personal data inside tasks

If a task contains personal data of other people (for example a recipient's address, or a person who consented to being verified), you are the controller of that data and we process it for you under the data processing agreement. Do not send us personal data the task does not need.

6. Your rights

You may ask for access, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interest. Write to legal@handsforagents.com; we answer within one month. You can complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or to the authority in your EU country.

7. Version

Version 2026-09-29.