Privacy policy

Who processes your data

The data controller is TooT S.r.l., Viale Della Resistenza 198, 87036 Rende (CS), Italy, VAT 03518790781, REA CS-240879. For anything concerning your data, write to our certified address [email protected]. We have not appointed a Data Protection Officer: we do not fall within the cases where one is required.

What we process

Three categories, kept separate from one another.

• Your account: email address, name, your password in hashed form (we never keep the plain one) and, if you sign in with Google, the identifier Google returns to us. Plus your chosen language and the date your address was verified.
• Your use of the service: the WordPress sites you connect and their technical data, the history of actions taken from the panel, notification preferences, an optional Telegram link, the API keys you create, and audit logs — who did what, and when.
• Payments: if you subscribe to a paid plan, billing details and transaction outcomes. Card numbers never pass through our systems: Stripe handles them directly.

Why, and on what legal basis

• To provide the service you asked for — keeping your account, connecting sites, running checks, updates and backups. Legal basis: performance of the contract.
• To invoice you and meet accounting and tax obligations. Legal basis: a legal obligation.
• To keep the service secure and working: technical logs, access records, abuse protection. Legal basis: our legitimate interest in defending the service and the data you entrusted to us.
• To write to you when needed: alerts about your sites, service messages, answers to your requests. Legal basis: performance of the contract.

The content of the sites you manage

When you use the Copilot or generate content, parts of your sites' text are sent to our AI provider to produce the answer. We do not use that content to train models, ours or anyone else's. If you manage client sites, remember that for their data you are the controller and we are the processor: keep the two roles distinct in your agreements with them.

Who we entrust data to

Only providers we need in order to run the product, each appointed as a data processor. None of them may use your data for their own purposes.

• Railway — the infrastructure the service runs on, including the database and the job queue.
• Cloudflare — the domain, traffic protection, and the storage that holds your site backups.
• Stripe — subscriptions and payments.
• Resend — delivery of service emails.
• OpenRouter — the AI model provider, which receives text only at the moment of a request.
• Google — sign-in with Google, if you choose it, and page performance measurement.
• Telegram — only if you link your account to receive notifications there.

Data leaving the European Union

Several providers listed above are based in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission and, where the provider participates, on the Data Privacy Framework. It is a consequence of how today's web infrastructure is built, and we would rather state it plainly than bury it in a line.

How long we keep it

• Account data for as long as your account exists. If you close it, we delete the data within thirty days, except what we must keep by law.
• Tax documents for ten years, as accounting rules require.
• Your site backups for the period your plan provides, after which they rotate and are deleted.
• Technical and audit logs for twelve months.

What you can ask us

You can ask to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format, and object to processing we base on legitimate interest. Write to the certified address above: we answer within one month. If you believe something is wrong, you may contact the Italian Data Protection Authority (www.garanteprivacy.it).

If this policy changes

The date at the top says when it was last updated. If we change something that genuinely affects you — a new purpose, one more recipient — we tell you by email before it takes effect, not after.