What Information Do We Collect?
Information you provide to us
The personal information we collect may include:
- Names and email addresses
- Mailing addresses and job titles
- Usernames and passwords
- Billing addresses and payment instrument data
- Contact or authentication data
Sensitive information. We do not process sensitive information.
Payment data. We may collect data necessary to process your payment, such as your payment instrument number and security code. All payment data is handled and stored by Stripe.
All personal information you provide must be true, complete, and accurate. You must notify us of any changes.
Information collected automatically
We automatically collect certain information when you visit, use, or navigate our Services. This information does not reveal your specific identity but may include device and usage data used primarily to maintain security and for internal analytics.
- Log and usage data. Your IP address, device information, browser type, activity in the Services (date/time stamps, pages viewed, features used, crash reports).
- Device data. Information about your computer, phone, or tablet, including IP address, device and application identification numbers, browser type, hardware model, ISP/mobile carrier, operating system, and system configuration.
- Location data. Device location data based on your IP address. You can opt out by disabling Location settings on your device.
Google API. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How Do We Process Your Information?
- Account creation and authentication. We process your information so you can create and log in to your account, and to keep your account in working order.
- Vital interests. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
What Legal Bases Do We Rely On?
If you are in the EU or UK
The GDPR and UK GDPR require us to explain the valid legal bases we rely on:
- Consent. We may process your information if you have given us permission for a specific purpose. You can withdraw your consent at any time.
- Legal obligations. We may process your information where necessary for compliance with our legal obligations.
- Vital interests. We may process your information where necessary to protect vital interests of you or a third party.
If you are in Canada
We may process your information with your express or implied consent. You can withdraw consent at any time. In some exceptional cases, we may be legally permitted to process your information without consent, including for fraud detection, business transactions, court orders, or publicly available information.
When and With Whom Do We Share Your Personal Information?
- Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
Do We Use Cookies and Other Tracking Technologies?
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. These technologies help us maintain security, prevent crashes, fix bugs, save preferences, and assist with basic site functions.
We also permit third parties and service providers to use online tracking technologies on our Services for analytics. To the extent these technologies are deemed a “sale” or “sharing” under applicable US state laws, you can opt out as described in Section 12.
Google Analytics
We may share your information with Google Analytics to track and analyze the use of the Services. To opt out, visit tools.google.com/dlpage/gaoptout.
Do We Offer Artificial Intelligence-Based Products?
As part of our Services, we offer AI-powered products, features, and tools (collectively, “AI Products”). The terms in this Privacy Notice govern your use of the AI Products within our Services.
AI service providers
We provide AI Products through third-party service providers, including Amazon Bedrock, Anthropic, Google Cloud AI, Hugging Face, and OpenAI. Your input, output, and personal information will be shared with and processed by these providers. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.
AI product capabilities
Our AI Products are designed for: AI automation, AI bots, AI insights, AI document generation, AI translation, image analysis, natural language processing, and text analysis. All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties.
How Long Do We Keep Your Information?
We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).
Following the end or expiry of your subscription, we may retain your data for a period of up to 90 days to allow you to access, review, and export your information. For the first 30 days of this period, you may continue to access your data in a read-only capacity. Thereafter, access may be limited to data export only. During this period, your ability to use active product features will be restricted. Your data will not be automatically deleted solely because a subscription has ended — deletion occurs when you explicitly request it, or when we determine there is no longer a legitimate basis for retention.
We may also retain certain information as necessary to prevent fraud, resolve disputes, assist with investigations, enforce our legal terms, or comply with applicable legal obligations. When there is no longer any legitimate purpose for retaining your personal information, we will delete or anonymize it. Where immediate deletion is not possible (for example, because your data is stored in backup archives), we will securely store and isolate it from further processing until deletion can be completed.
How Do We Keep Your Information Safe?
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission to and from our Services is at your own risk. You should only access the Services within a secure environment.
Do We Collect Information From Minors?
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 years old, or that you are the parent or guardian of a minor and consent to that minor’s use of the Services.
If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any such data, please contact us at support@toystack.ai.
What Are Your Privacy Rights?
In some regions (including the EEA, UK, Switzerland, and Canada), you have rights under applicable data protection laws, which may include:
- The right to request access and obtain a copy of your personal information
- The right to request rectification or erasure
- The right to restrict the processing of your personal information
- The right to data portability, where applicable
- The right not to be subject to automated decision-making
To make a request, contact us using the details in Section 14.
UK complaints
If you are located in the UK and are unhappy with how we have handled your personal information, you may complain to us directly or to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint • 0303 123 1113.
Withdrawing consent
If we rely on your consent to process your personal information, you have the right to withdraw consent at any time by contacting us using the details in Section 14. Withdrawal does not affect the lawfulness of processing before that withdrawal.
Opting out of marketing
You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in the emails we send, or by contacting us as described in Section 14.
Account information
To review, change, or terminate your account, contact us using the information in Section 14. Upon a request to terminate your account, we will deactivate your account and process deletion of your data in accordance with our data retention practices. We may retain certain information where we have a legitimate basis to do so, including to prevent fraud, assist with investigations, enforce our legal terms, or comply with applicable legal requirements.
Controls for Do-Not-Track Features
Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. California law requires us to note that we do not respond to DNT signals at this time.
Do United States Residents Have Specific Privacy Rights?
Categories of personal information collected
| Cat. | Category & Examples | Collected |
|---|---|---|
| A | Identifiers — real name, alias, postal address, telephone number, unique personal identifier, online identifier, IP address, email address, account name | YES |
| B | Personal information (CA Customer Records statute) — name, contact information, education, employment history, and financial information | YES |
| C | Protected classification characteristics — gender, age, date of birth, race, ethnicity, national origin, marital status | NO |
| D | Commercial information — transaction information, purchase history, financial details, and payment information | NO |
| E | Biometric information — fingerprints and voiceprints | NO |
| F | Internet or network activity — browsing history, search history, online behavior, interest data | NO |
| G | Geolocation data — device location | NO |
| H | Audio, electronic, or sensory information — images, audio, video, or call recordings | NO |
| I | Professional or employment-related information — job title, work history, professional qualifications | NO |
| J | Education information — student records and directory information | NO |
| K | Inferences from collected data — profiles or summaries about an individual’s preferences and characteristics | NO |
| L | Sensitive personal information | NO |
How we use and share personal information
We may share your personal information with our service providers pursuant to a written contract. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information belonging to website visitors, users, and other consumers.
Your rights
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of processing for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects
How to exercise your rights
Email us at support@toystack.ai or refer to the contact details in Section 14. Under certain US state laws, you may designate an authorized agent to make a request on your behalf.
Appeals
If we decline to take action regarding your request, you may appeal our decision by emailing support@toystack.ai. If your appeal is denied, you may submit a complaint to your state attorney general.
California “Shine The Light” law
California Civil Code Section 1798.83 permits California residents to request, once per year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes. To make such a request, contact us using the details in Section 14.
Do We Make Updates to This Notice?
Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated “Last updated” date at the top of this Privacy Notice. If we make material changes, we may notify you by prominently posting a notice or by directly sending you a notification. We encourage you to review this Privacy Notice frequently.
How Can You Contact Us About This Notice?
If you have questions or comments about this notice, you may email us at support@toystack.ai or contact us by post:
How Can You Review, Update, or Delete the Data We Collect?
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, corrections to inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.
To request to review, update, or delete your personal information, please contact us at support@toystack.ai.