Privacy policy
This page explains what personal data Toile collects, why, who else handles it, how long we keep it, and your rights. Short version: we collect what is needed to run your account, we never sell anything, and your brand's data is used only to run Toile for you.
1. Who is responsible
[LEGAL ENTITY], [ADDRESS], Portugal, tax number [NIF]. Contact for anything about privacy: [PRIVACY EMAIL].
2. Your data and ours
There are two kinds of data in Toile, and the rules differ.
- Brand data: the files and sales a brand adds to its workspace (production quantities, sales, plans, costs, settings). The brand decides what goes in and why. For this data the brand is the controller and we are its processor. We follow the brand's instructions, set out in the data processing agreement.
- Account data: about the people who use Toile (name, email, sign-in records, billing contact). For this data we are the controller. This policy is mainly about account data.
3. Using Toile without an account
If you use the tools without signing in, your files are read in your browser and are not uploaded to us. They are kept in your browser's storage until you clear them. We still receive normal web request data (see section 4). Guest pages send no error reports.
4. What we collect
- Account: name, email address, a hashed password (we never see or store the password itself), whether the email is confirmed, and when the account was created.
- Workspaces: which workspaces you belong to and your role, invitations you send or receive, and a record of actions such as uploading or deleting a file (who, what, when).
- Sign-in and security: session records with IP address and browser type, and short-lived counters used to stop password guessing.
- Billing: the workspace's plan and Stripe customer reference. Stripe holds the payment details; we never see full card numbers.
- Error reports: the error message, where it happened, the time, a request id, and the workspace and account id. Text that looks like file contents, request bodies, cookies and query strings are stripped out before anything is stored. Our own error log keeps the account id so we can help you; nothing personal is sent to Sentry, only the workspace id.
- Server logs: page and API requests (path, status, time taken, request id, and the workspace id). No file contents.
From Shopify we take only totals: units sold and in stock per product and size, and prices. We do not store your shop's customers' names, emails, addresses or order details.
5. Why, and the legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running your account and workspaces, sending account emails | Contract (6(1)(b)) |
| Billing, invoices and tax records | Contract, and legal obligation (6(1)(c)) |
| Security, stopping abuse, fixing errors | Legitimate interest in a safe, working service (6(1)(f)) |
| Telling owners about important changes to the service or terms | Contract, and legitimate interest |
We do not send marketing email without your consent. We do not make automated decisions about people.
6. What we never do
- We never sell or rent personal data or brand data.
- We never use a brand's data to train models.
- We never use one brand's data to inform what another brand sees: no shared benchmarks, no comparisons, no "brands like you".
- We do not use advertising or tracking cookies, and we do not share data with advertisers.
7. Who else handles data
We use these companies to run Toile. Each has a contract with us that limits what it can do with the data.
| Company | What it does for Toile | Data | Where |
|---|---|---|---|
| Railway Corp. | Runs the Toile servers | All data passes through it while in use | [RAILWAY REGION, E.G. EU WEST, AMSTERDAM] |
| Neon Inc. (on AWS) | Database and backups | Accounts, workspaces, files, settings, logs | [NEON REGION, E.G. AWS EU-CENTRAL-1, FRANKFURT] |
| Resend Inc. | Sends account emails (confirm, reset, invitations) | Name, email address, the email itself | [RESEND REGION, E.G. EU-WEST-1, IRELAND] |
| Functional Software Inc. (Sentry) | Error monitoring | Error messages and the workspace id. No file contents, no names or emails | [SENTRY REGION, E.G. EU, FRANKFURT] |
| Stripe Payments Europe Ltd. | Payments and invoices | Billing name, email, address, VAT number. Card details go to Stripe only | Ireland, with transfers to the US |
| Shopify International Ltd. | Only if you connect a shop: source of sales and stock totals | Shop name; we receive per-product totals, not customer data | Ireland, with transfers to Canada and the US |
| Google Ireland Ltd. (Google Fonts) | Serves the typeface | Your IP address when a page loads the font | Ireland, with transfers to the US [OR REMOVE ONCE THE FONT IS SELF-HOSTED] |
We will update this list before adding a new company. Workspace owners are told by email at least 30 days before a new company handles brand data.
8. Transfers outside the EU
Where a company above handles data outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the company is certified, or on the European Commission's Standard Contractual Clauses. We choose EU regions wherever the provider offers them.
9. How long we keep it
| Data | How long |
|---|---|
| Workspace files and settings | Until you delete them or the workspace. The last 20 versions of each file are kept so you can restore one |
| A deleted workspace | Removed from the live database at once. Backups are overwritten within [BACKUP DAYS] days |
| Account | While you have it. Deleted within 30 days of your request |
| Sessions | Up to 30 days after the last use |
| Error reports (ours) | 90 days, or until the workspace is deleted |
| Error reports in Sentry | [SENTRY RETENTION, E.G. 90] days |
| Server logs | [LOG RETENTION, E.G. 30] days |
| Workspace activity record | As long as the workspace exists |
| Invoices and billing records | 10 years, as Portuguese tax law requires |
10. Security
All traffic is encrypted (HTTPS). The database is encrypted at rest by our provider. Shop access tokens are encrypted again with our own key. Every request is checked against workspace membership, so one brand can never read another's data. Passwords are hashed. Access to production systems is limited to the people who run Toile.
11. Your rights
You can ask to see, correct, export or delete your personal data, to object to or limit how we use it, and to take it elsewhere. Write to [PRIVACY EMAIL]. We answer within one month.
- Export a workspace: Account, Your data, Download all data. You get a zip with every file as CSV, plus settings.
- Delete a workspace: the owner can do it on the Account page, Delete the workspace. It removes the files, versions, settings, members, invitations and any shop connection.
- Brand data: if your request is about data a brand put in its workspace, we pass it to that brand, because the brand decides about that data.
You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority where you live.
13. Changes
If we change this policy in a way that matters, we will tell account holders by email before it takes effect.