Privacy Policy

1. Data we collect

Account data. Your name, email address, and password (stored only as a one-way hash). If you sign in with Google, we receive your Google account identifier, name, and email address. We also store your preferences.

Workspace and billing data. Workspace name, members and their roles, plan, credits, and usage. Our payment provider collects your card and billing details; we do not see or store your card number.

Connected apps and services. A workspace member, or the member's AI agent, can connect an app or service to Toolscaled, for example Gmail, an API, or an MCP server. We store the access that the service gives us, encrypted, with the permissions granted. We use it only to perform the actions that you or your workflows request.

Content you process. What your chats, workflows, and automations read, produce, and store, such as messages, files, and the results of tools.

Messages you send us. Support requests, feedback, and other messages you send us, with your contact details and what you include.

Usage and technical data. A cookie that keeps you signed in, and service logs that we use to run, secure, and fix the service. We do not use advertising or analytics cookies, and we do not track you across other websites.

2. How we use it

• To provide the service: sign you in, run your sessions, workflows, and automations, and show you the results.
• To bill you and to apply plan limits and credits.
• To send service emails, such as email verification, password reset, and notices about your runs, account, or billing.
• To answer your messages and to improve Toolscaled.
• To keep the service secure, prevent abuse, and fix faults.
• To meet legal obligations, such as tax records.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of our contract with you (service, billing, service emails, support); our legitimate interests (security, abuse prevention, fault fixing, improving the service); your consent (the launch list in section 11); and legal obligation (tax and accounting records).

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We do not use your content to train AI models.

3. AI models

Some features send content to AI model providers: for example, to decide which workflow handles an incoming email, or to run a workflow step that uses a model. A feature sends only the content it needs. We use only providers whose terms, or our settings with them, forbid training their models on customer content. Providers may keep content for a limited time to detect abuse. The list of providers, with links to their terms and privacy policies, is at /legal/ai-providers.

4. Google user data

Toolscaled's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, and why. When a workspace member connects a Google account, they choose the Google services Toolscaled may use, and Google asks them to allow each one. Toolscaled uses each service only for the actions that the member, the member's AI assistant, or the member's workflows and automations ask for:

• Gmail: read and search messages and their attachments, list and create labels, change the labels of a message, move a message to the trash or out of it, create, delete and send drafts, and send mail. An automation can also read new mail as it arrives, to decide which workflow handles it.
• Google Sheets: read the cells of a sheet, add rows, change cells, and create a sheet.
• Google Calendar: list events and free or busy times, and create and change events.
• Google Docs: read a document, create a document, and add text to it.
• Google Tasks: list task lists and tasks, create and change tasks, and mark them complete or not complete.
• Google Forms: read a form and its responses, create a form, and change it.
• Google Drive: download, upload, and find or create a folder for, the files that a member picks or that Toolscaled creates.

A Google account that a workspace member connects is private to that member: only that member's AI assistant can use it, and only for the Google services allowed for that account. The member can share the account with every member of the workspace; their AI assistants, and the workspace's workflows and automations, can then use it too. A workspace administrator can stop the sharing of an account or disconnect it, and can use it only while it is shared. When the member leaves the workspace, Toolscaled disconnects the account and deletes the credentials that it stored for it.

How we use it. Only to provide the features that the member uses. We do not sell Google data, use it for advertising, use it to decide creditworthiness, or let a person read it except as described below.

Where we keep it, and for how long. We store Google data encrypted, and keep it only as long as the feature that read it needs it. The data that a chat, a workflow run, or an automation reads is deleted after a limited period. A workflow that you save can keep values from your Google data that its steps use (for example a sheet or an address), until you delete the workflow. The access that Google gives us is stored encrypted until you disconnect the account. When a workspace is deleted, its Google data is deleted with it. Manage and delete your data gives the current periods.

Who receives it. Google data goes only where a feature you use sends it:

• the AI model providers that run a workflow step or decide which workflow handles an incoming mail (section 3, and the list at /legal/ai-providers);
• a security service that checks text from your Google account for instructions aimed at our AI models before a model reads it;
• the AI assistant that you connect to Toolscaled (for example Claude or ChatGPT), which receives the results of the tools it asks to use;
• our email delivery provider, for the notices you get about your runs;
• a web search provider, when you or your workflow search the web with words from your data;
• our hosting, storage, and backup providers (section 5).

No AI training. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models. We do not let any AI model provider train its models on Google data.

How we protect it. We encrypt Google data in transit and at rest, and protect the encryption keys. A Toolscaled person reads your Google data only when you ask us to, when we must investigate a bug or abuse, or when the law requires it.

How to delete it. You can remove Toolscaled's access at any time in your Google Account settings, or by disconnecting the account in Toolscaled. A disconnect revokes that access at Google and deletes it from Toolscaled. To ask us to delete your Google data, email support@toolscaled.com.

The same limits apply to data we receive from Microsoft and from any other app, API or MCP server that you connect.

5. Who receives data

We use service providers to run Toolscaled, and each receives only the data it needs for its service:

• hosting, storage, and backups;
• network delivery and protection against attacks;
• payments and invoices;
• email delivery;
• AI model providers (section 3);
• sign-in with Google;
• web services that a feature uses, such as web search.

They process data for us under contracts that limit its use. Email support@toolscaled.com for the current list of providers.

We also disclose data when the law requires it, to protect our rights or the safety of users, or to a buyer of our business, who must follow this policy.

The apps and services you connect receive the requests that your workflows make. Their own privacy policies apply to the data they hold.

6. International transfers

We store and process data in the United States. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses (and the UK Addendum) in our providers' data processing terms.

7. How long we keep data

We keep account and workspace data while your account is active, or until you ask us to delete it. We keep the content that chats, runs, and automations process only as long as the feature needs it, and then delete it. When a workspace is deleted, by its administrator, with the account of its last member, or by us under our Terms, we delete its content; an administrator who deletes a workspace can cancel the deletion for a short time first. We keep security logs for a limited time, and billing records as long as tax law requires. Copies in backups expire on a regular schedule. Manage and delete your data gives the current periods.

8. Your rights and choices

You can:

• see your account data in the app, and correct it in the app or by email to us;
• disconnect a connected account at any time, which deletes its stored access;
• delete a workspace that you administer, in its settings;
• ask for a copy of your personal data;
• ask us to delete your account and your personal data.

To ask for a copy, a correction, or deletion, email support@toolscaled.com from the address on your account. We answer within 30 days. We delete your data from backups when those backups expire. We keep billing records the law requires us to keep.

If you are in the EEA or the UK, you also have the right to object to or restrict our processing, to data portability, to withdraw consent, and to complain to your local data protection authority. If you live in a US state with a privacy law (for example California), you have the rights that law gives you, including the right to know, delete, and correct, and we will not treat you differently because you use them.

If your data is part of a workspace that another person administers, we may send your request to that workspace's administrator.

9. Security

We encrypt data in transit and at rest, keep our encryption keys in a key management service, store passwords only as one-way hashes, and limit access to production systems to the people who operate Toolscaled. A Toolscaled person reads the content of your workspace only when you ask us to, when we must investigate a bug or abuse, or when the law requires it. No system is completely secure; if a breach affects your personal data, we will tell you as the law requires.

10. Children

Toolscaled is a service for businesses. It is not directed at children under 13, and we do not knowingly collect personal data from them. If you think a child under 13 gave us personal data, contact support@toolscaled.com and we will delete it.

11. Launch announcement list

If you ask on toolscaled.com to hear when Toolscaled launches, we keep your email address and the record of your consent, use the address only for that announcement, and delete the list after we send it. To leave the list, email hello@toolscaled.com from the address you signed up with.

12. Changes and contact

We may change this policy. We post the new version on this page with a new effective date. If a change is significant, we also tell workspace administrators by email before it takes effect.

Email support@toolscaled.com with any question about this policy or your data.

Toolscaled LLC