Privacy Policy

1. Who is responsible for your information

Before publishing, replace this paragraph with the legal name, registered address, and contact details of the Toodily entity that acts as data controller or business under applicable privacy law.

Privacy questions and requests can currently be sent to [email protected]. Add a dedicated privacy or data-protection contact if one is appointed.

2. Information you provide

Account information may include your name, email address, authentication details, profile settings, selected region, plan, and communication preferences.

Workspace content may include tasks, projects, epics, dates, reminders, tags, checklists, notes, comments, attachments, membership information, activity history, prompts, and feedback you choose to submit.

Payment providers process billing and transaction details when you purchase a subscription or credits. Confirm whether Toodily receives billing address, tax information, partial card details, receipts, or transaction identifiers and update this paragraph accordingly.

3. Information collected through use of Toodily

We may process device, browser, app version, language, time zone, approximate region, IP address, authentication events, feature interactions, diagnostics, crash information, sync status, storage usage, and security logs.

Before publishing, list the analytics, crash-reporting, attribution, cookie, and similar technologies actually used by the mobile and web applications. Remove any category that Toodily does not collect.

4. Why we process information

We process information to create and authenticate accounts; store and synchronize workspace content; enable collaboration; deliver reminders and notifications; provide billing, support, backups, recovery, and data-region controls; and operate requested AI features.

We also process limited information to secure the service, prevent abuse, diagnose failures, measure reliability, understand feature performance, communicate service updates, comply with law, and protect users and Toodily.

Where applicable law requires a legal basis, the basis may be performance of our contract, legitimate interests in operating and securing the service, consent, or compliance with legal obligations. Counsel should confirm the basis for each processing purpose before publication.

5. Collaboration and sharing at your direction

Content in a shared project or workspace is available to members according to their permissions. Owners or administrators may add or remove members and may be able to access, change, export, or delete shared content.

When you connect an integration or direct Toodily to export information, the selected information is shared with that provider under its own privacy terms.

6. Service providers and other disclosures

We may use vetted providers for infrastructure, storage, authentication, communications, customer support, payments, monitoring, and AI-assisted functionality. They may process information only to provide contracted services and subject to appropriate safeguards.

Before publishing, add a current subprocessor list or link and identify hosting regions, authentication providers, payment processors, email and notification services, monitoring tools, and AI model providers used in production.

We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect safety or rights, investigate abuse, or complete a merger, financing, acquisition, or sale with appropriate confidentiality protections.

Toodily does not sell personal information. Counsel should confirm whether any analytics or advertising practice could constitute “sale,” “sharing,” or targeted advertising under applicable regional law.

7. AI-assisted features

When you use an AI feature, Toodily may send your prompt and the workspace context needed for that request to an AI provider. Generated output and usage metadata may be returned to and stored by Toodily as part of your workspace or conversation history.

Before publishing, identify each production AI provider, its retention settings, processing region, whether customer content may be used for provider training, and the controls available to users. Do not claim that content is excluded from training until contracts and configuration have been verified.

8. Security

Toodily uses administrative, technical, and organizational safeguards intended to protect information. No service can guarantee absolute security.

Before publishing, replace this paragraph with verified controls, including encryption in transit and at rest, credential handling, access controls, logging, backup protection, vulnerability management, incident response, and any independent certifications. Do not name standards or certifications that Toodily has not obtained.

You can help protect your account by using unique credentials, securing your devices, reviewing project membership, and contacting us promptly if you suspect unauthorized access.

9. Storage locations and international transfers

Toodily may allow you to select from supported workspace regions. Account, billing, support, security, or service metadata may still be processed in other locations where Toodily or its providers operate.

Before publishing, document the actual storage architecture, available regions, backup locations, and transfer safeguards such as contractual clauses or adequacy decisions.

10. Retention, deletion, and recovery

We retain information while needed to provide the service, satisfy your settings, maintain security and recovery functions, comply with law, resolve disputes, and enforce agreements. Different categories may have different retention periods.

Users may be able to delete content, restore items from a recycle bin, export selected information, or request account deletion. Backup and security copies may remain for a limited period before being overwritten or deleted.

Before publishing, insert confirmed retention periods for active accounts, deleted accounts, recycle bins, backups, support records, security logs, AI conversations, and billing records.

11. Your privacy choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent. You may also have the right to complain to a privacy regulator.

You can manage certain account details, workspace access, notifications, and content in Toodily. Contact [email protected] for requests that cannot be completed in the product. We may verify your identity before fulfilling a request.

12. Children

Toodily is not intended for children below the minimum age applicable to the service. Before publishing, align this section with the eligibility rule in the Terms and document the process for removing information submitted by an ineligible child.

13. Policy changes

We may update this policy as Toodily changes. The effective date and permanent version link identify the policy in effect. We will provide additional notice when required for material changes.

14. Technology details to confirm before publication

Confirm the legal entity and governing privacy jurisdictions; production hosting and data regions; database and object-storage providers; authentication method; encryption controls; analytics and crash tools; email and push providers; payment processors; AI providers and training settings; subprocessors; cookie use; retention schedules; export and deletion workflows; incident contact; and any security certifications.