v1
Privacy Policy
What are personal data and what data do we process?
Personal data means any information relating to an identified or identifiable natural person that can be used to identify them, directly or indirectly. For the purposes of this broad definition, we therefore consider any data obtained in connection with users' use of our services to constitute personal data for our purposes.
We primarily process data that users provide to us through their use of our services, in particular their email address and password when registering, as well as their preferences and account settings in their profile. If an organization is registered, we also process the organization's name, all settings within the organization, and information about individual members, including users who have only been invited.
We also process information about the individual tools that users activate and, for tools that require user configuration, information relating to such configuration.
Passwords, whether they are passwords used to access our services directly or access credentials stored in the configuration of individual tools, are stored in our database in encrypted form.
If users use our chat, we also process all messages they send to the chat.
We also process all files that users upload to the storage, whether personal or organizational, as well as the names of folders created by users there.
In addition to data that users explicitly provide to us, we also process certain data in the background, primarily on the basis of our legitimate interest, namely the security and stability of our services. This includes, in particular, the IP addresses from which requests to our services are made, together with the exact date and time of the request and the specific part of the service to which the request is directed. For example, we record information about tool calls and any failures associated with them.
Why do we process your data?
We primarily process your data so that we can provide our services to you, enable you to log in and manage your account, store your content and settings, and ensure the proper functioning of individual tools.
We also process certain data in order to secure our services, prevent their misuse, detect technical problems, and ensure their stability.
Where permitted by applicable law, we may also process certain data in order to comply with our legal obligations or protect our legitimate interests.
On what legal basis do we process your data?
Depending on the specific circumstances, we process personal data primarily on the basis of the performance of a contract, our legitimate interest, compliance with a legal obligation, or your consent.
For example, processing data necessary to operate your account and provide our services is generally necessary for the performance of a contract. Data relating to the security and operation of our service may be processed on the basis of our legitimate interest.
Where processing is based on your consent, you may withdraw that consent at any time. Where possible, you may also withdraw your consent by deleting your account. Account deletion can be performed directly in your profile settings.
Deleting your account will also terminate your use of our services and result in the deletion of your data to the extent that further retention is not necessary, for example, to comply with a legal obligation or to protect our legitimate interests.
With whom do we share your data, or who may have access to your data?
We primarily seek not to share your data with anyone at all. However, there are a few exceptions.
One such exception concerns providers of large language models used as part of our chat. We currently use the Google Cloud Platform cloud infrastructure platform for large language models, provided by Google LLC, which may, in certain circumstances, act as a processor of personal data. It will only have access to data that you send through the chat to the Gemini Flash or Gemini Pro language model. In the future, we plan to add a much broader range of large language model providers, and our Privacy Policy may therefore be updated accordingly.
With regard to tools, some tools, by their nature, must send data to third parties. For example, an email mailbox management tool necessarily has to communicate with the email service provider. However, most of our tools currently do not share data with anyone.
Users should also be aware that by connecting tools to external language models, the providers of those models may gain access to a broad range of user data that we manage, particularly data relating to the content of the user's storage. Similarly, by connecting another language model through Ollama to our chat, that model may gain access to such data.
It should also be noted that third parties may be able to determine that a user is registered with us, for example by entering an email address into the registration form or by inviting a user to an organization. Although we seek to limit this possibility as much as technologically possible, it unfortunately cannot be completely eliminated in practice.
If a user is a member of an organization, other users may be able to see that the user is a member of that organization. Organization administrators may also have the ability to see the devices and IP addresses from which a user logs in.
What are your rights?
In connection with the processing of your personal data, you generally have the right to:
- request access to your personal data;
- request the correction of inaccurate data;
- request the deletion of your personal data;
- request restriction of the processing of your personal data;
- object to processing based on legitimate interests;
- request data portability where this right applies;
- withdraw your consent to the processing of personal data where processing is based on consent.
Some of these rights may, of course, not be applicable in all situations. For example, we may be legally required to retain certain data even after you have requested its deletion.
Withdrawal of Consent and Account Deletion
Where the processing of your personal data is based on your consent, you may withdraw that consent at any time.
Where consent is associated with the use of your user account, you may practically withdraw your consent by deleting your account. Account deletion is available directly in your profile settings.
By deleting your account, we will cease processing your data for purposes for which the account is no longer required. However, we may retain data that we are legally required to retain or that we need to protect our legitimate interests even after the account has been deleted.
How can you exercise your rights?
If you wish to exercise any of your rights, you can contact us at the email address provided below.
If the requested action can be performed directly within the service, for example by deleting your account in your profile settings, you may do so directly there.
We seek to respond to requests without undue delay and within the time limits prescribed by the GDPR.
Where can you lodge a complaint?
If you believe that we are not handling your personal data properly, you may contact us first and we will attempt to resolve the situation.
You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).
Cookies
We use only cookies that are necessary for the operation of our services, in particular for secure user authentication, maintaining an authenticated session, and related account security.
We do not use cookies for advertising purposes or cookies used for analytical tracking of users.
As these cookies are necessary for the secure operation of the service and for authentication, it is not possible to simply disable their use without limiting or preventing the relevant part of the service from functioning.
Data Controller
The data controller is currently:
Martin Tošner
Větrná 1467/72A
370 05 České Budějovice 2
Czech Republic
Email: martin.tosner@tooldurus.com
Change of Data Controller
In the near future, the rights and obligations relating to the processing of personal data will be transferred to a newly established legal entity under the laws of the Czech Republic.
Until this legal entity is established and becomes the data controller in relation to the relevant processing of personal data, the data controller will remain Martin Tošner.
Once this legal entity has been established and the relevant rights and obligations have been transferred, this legal entity will become the data controller to the relevant extent. Its exact identification and contact details will subsequently be provided in the then-current version of this Privacy Policy.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example if we add new features, tools, or service providers.