Privacy Policy

1. Our role

We act as a controller for personal information we use to operate our website, manage accounts and business relationships, process billing, protect the Services, and communicate with you.

For personal information in prompts, files, connected content, and other data processed on an enterprise customer's behalf ("Customer Data"), we generally act as a processor or service provider. That processing is governed by the customer's instructions, applicable data-processing terms, and law. This Policy does not replace those terms. Your organization's administrators may manage your access and information within their permissions; sharing an email domain does not itself grant access to organization data.

2. Information, purposes, and legal bases

We collect information from you, your organization, authorized integrations, service providers, and operation of the Services. Requested research may retrieve information from public sources.

We assess legitimate interests against individuals' rights. An employer's agreement is not automatically a contract with each employee. We also process information where necessary to comply with applicable legal duties or establish or defend legal claims.

Customer Data may include personal information in documents, messages, images, audio, video, prompts, outputs, and task records. Connected services may supply authorized content, metadata, permissions, and access tokens. We process this information to provide requested functions, including retrieval, analysis, storage, and authorized actions; the customer determines the legal basis for processing on its behalf.

Stripe processes payment information. We receive relevant transaction records and limited payment-method information. Providing information needed for access, service delivery, or payment is necessary to use the corresponding function; without it we may be unable to fulfill your request.

3. Customer Data and AI

We use Customer Data to provide and support authorized functionality. We do not use Customer Data, outputs, or derived indexes and embeddings to train or improve generalized AI models unless the customer expressly agrees in a separate written agreement and applicable provider restrictions permit it.

Where an AI provider processes Customer Data for us, we require contractual restrictions against generalized model training using that content. Information sent to a provider depends on the requested function and necessary context. We may use operational metrics and appropriately de-identified information to improve the Services, subject to applicable law and contractual restrictions. Feedback and diagnostics do not override these Customer Data restrictions.

4. Disclosure

We may disclose information to:

• providers supporting hosting, storage, AI processing, payments, communications, support, security, and product analytics (including PostHog), subject to restrictions appropriate to their roles;
• your organization's authorized administrators, within their permissions;
• connected services or other recipients at your direction;
• advisers, authorities, or other recipients where necessary for legal obligations, claims, or protection against fraud and security threats; and
• parties involved in a business transfer, subject to applicable confidentiality and data-protection restrictions.

Personnel access is limited to authorized purposes and business need. Payment providers and services you independently use may process information under their own privacy notices. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use Customer Data for targeted advertising. The Google-specific restrictions below take precedence over these general disclosure provisions.

5. Google and other integrations

When you connect a service, we process the content, metadata, and credentials covered by your authorization for the disclosed functions. Authorized content may be sent to our AI providers where needed for those functions. You can revoke access in the connected service's account settings and disconnect through TouAI's available controls. To request deletion of imported content and derived indexes, use the available deletion controls or email privacy@tou.ai; for organization-controlled data, we coordinate with that organization. Revoking authorization alone does not erase previously imported data.

Our handling of Google API data, including derived information, follows the Google API Services User Data Policy and applicable Google Workspace policy, including Limited Use. We use it only for permitted, disclosed user-facing functions and supporting purposes. We do not use it for advertising, lending assessments, or generalized or organization-wide model training, even under a separate customer training agreement.

Transfers are limited to permitted user-facing functions with user consent, security needs, legal requirements, or an eligible business transfer with the user's explicit prior consent. Human access requires specific user authorization or another exception allowed by Google's policy. General business needs do not expand those exceptions. We obtain the required renewed consent before accessing newly disclosed Google data or using it for a new purpose. These restrictions bind our handling of Google data notwithstanding broader provisions elsewhere in our agreements.

6. Cookies and product analytics

إدارة ملفات تعريف الارتباط

We use cookies and similar technologies, including local browser storage, to support sign-in, sessions, security, and preference settings. Technologies necessary to provide the service you request remain available when you reject optional analytics.

With your consent, we use PostHog as an analytics service provider to understand use of the TouAI website, platform and documentation, evaluate product performance, and improve features and user journeys. This optional analytics remains off until you accept. Using the Services or accepting our Terms does not provide this consent.

Depending on the interaction, analytics events may include page and feature identifiers, event times, navigation and reading activity, selected form options and submission status, workflow outcomes, usage counts, transaction amounts and performance measures, language, general referral categories, and coarse device, browser and operating-system categories. Random browser and cross-site identifiers help link visits and subsequent activity across our sites. Signed-in platform and documentation activity may also be associated with your verified account ID and relevant organization or project identifiers.

We limit analytics event properties to selected operational fields. Our current event collection excludes passwords, authentication tokens, email addresses, prompts, file contents, conversation text, and free-text search or form content. These limits concern analytics events and do not change the information needed to provide a requested service or process standard network requests.

Session replay is a separate, optional choice in Manage Cookies and is off by default. Accepting usage analytics alone does not enable replay. If you separately allow replay, we use PostHog to reconstruct public page layout, interface labels, clicks and scrolling on selected pages of the website, platform and documentation, sampling up to 10% of eligible sessions. Project names, credit balances and usage figures shown in the business interface may also be visible. Page text, including project descriptions, search text, conversations, file contents, code and results, may also be visible. Account-profile areas are fully masked. Automated rules replace recognizable email addresses, phone numbers, ID numbers and common credentials. Recognition cannot reliably hide every name or address and does not guarantee complete de-identification. Contact, authentication, payment and credential pages, images/media, console logs and network contents are excluded. Replays are kept for 30 days. Replay requires the usage-analytics choice to remain effective; withdrawing either relevant choice or enabling Global Privacy Control stops subsequent recording. Already received recordings remain subject to the retention and deletion provisions below.

You can refuse optional analytics or change your choice at any time using “Manage Cookies” in our website footer, on this privacy page, or alongside the legal notice on the platform sign-in and sign-up pages. Where our sites can access the same preference, your choice applies across the website, platform and documentation in that browser. The choice is stored for that browser, rather than in your account. Signing in, signing out, or switching accounts in the same browser does not change it, and we do not sync it across browsers or devices. If more than one person uses that browser, its most recent choice applies until changed. We remember the choice for up to 180 days and may ask again if it expires, is cleared, or the applicable analytics purposes change. Refusing does not prevent use of the Services. Withdrawal stops subsequent collection under that preference and does not affect the lawfulness of earlier processing. Previously collected records are handled under Sections 7 and 9, including applicable deletion rights.

The cookie used to associate a visit source with subsequent cross-site activity expires after 30 minutes. Separate session and browser identifiers may also be stored locally. Session identifiers follow the relevant session. Browser identifiers have no independent automatic expiry and may remain in local storage until cleared; they are not used for this optional analytics when the related preference is no longer effective. These browser-storage periods and the 180-day preference period are separate from retention of analytics records described in Section 7. Section 8 also applies to international processing of these records.

You may also block or delete cookies and other site storage through your browser, which may affect functionality. We honor Global Privacy Control for this optional analytics and applicable legally required opt-out signals. Our no-sale and no-cross-context-behavioral-advertising commitments apply whether or not you send such a signal.

7. Retention and security

We retain information for the relevant service or business purpose, taking account of the relationship, customer instructions, legal recordkeeping duties, security needs, and applicable claim periods. Account and inquiry information is retained as needed to administer access and the relationship; billing records are retained for accounting and legal requirements; diagnostic records are retained proportionately to security and troubleshooting needs.

For analytics records, we determine retention by the time reasonably needed to understand usage trends, investigate product issues and evaluate improvements, subject to applicable law and deletion requests we are required to honor. Expiry of a browser identifier or Cookie preference does not itself delete records already received by us or PostHog. Those records remain subject to the retention, deletion and rights provisions of this Policy.

Customer Data follows the applicable service and contract retention rules. Playground resources covered by its temporary-retention policy are subject to deletion after seven days; this is not a seven-day rule for all stored data. When information is no longer needed, we delete or irreversibly anonymize it. Restricted backup copies may remain until overwritten in the applicable cycle, and legal preservation requirements may require longer retention. Leaving an organization does not itself delete data that organization controls.

We maintain reasonable and appropriate technical and organizational safeguards. No system can guarantee absolute security. We provide incident notices where required by applicable law or agreement. Contact privacy@tou.ai about security or deletion concerns.

8. International processing

Information may be processed in the United States and countries where our providers operate. Where a transfer requires protection under EEA, UK, or Swiss law, we use an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses and applicable UK provisions, with additional measures where required. Contact privacy@tou.ai for information about applicable safeguards or a copy, subject to necessary confidentiality protections.

9. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, or portability; object to certain processing; withdraw consent; opt out of covered sale, advertising, or profiling; and exercise applicable rights concerning automated decisions. Withdrawal does not affect earlier lawful processing. We use automation for service delivery, security, usage controls, and authorized payments; contact us to contest a determination or request human review where applicable.

Email privacy@tou.ai to exercise your rights. We may verify identity or an agent's authority and respond within applicable legal deadlines, explaining any lawful exception or extension. Where an appeal right applies, reply requesting review. We do not unlawfully discriminate against people exercising rights. EEA, UK, and Swiss individuals may complain to their relevant supervisory authority without contacting us first.

For Customer Data controlled by your organization, contact that organization; we will assist or route requests as required. Marketing messages include an unsubscribe option; necessary service communications may continue. Sensitive information is processed only for authorized service provision or other legally permitted purposes, not to infer sensitive characteristics for advertising.

10. Children, changes, and contact

The Services are intended for adults using them for business purposes. We do not knowingly register children under 18. Contact us about information a child has provided directly; customer-supplied information about minors remains subject to lawful instructions and required protections.

We will post updates with a revised date and provide notices or obtain consent where required by law or applicable provider policies. Updates do not retroactively remove contractual protections for Customer Data.

Regressor Inc.
40425 Chapel Way APT 211
Fremont, CA 94538, United States
privacy@tou.ai