Toai Privacy Policy

Effective date: October 1, 2025

Toai operates the SupportAIgent platform. This policy explains how we handle personal information.

Information We Collect

Account details (name, email, profile photo), workspace settings (logo, theme), and preferences.
Conversation data (messages, attachments, timestamps, channel IDs), including human handover notes.
Usage data (IP address, device/browser info, pages viewed).
Support communications you send us.
Data from third-party channels you connect (e.g., WhatsApp, Instagram, Facebook).

How We Use Information

To provide and operate the service (dashboards, chat logs, assignments, analytics).
To secure, monitor, and improve the platform.
To communicate with you about the service and support.
To comply with law and enforce our terms.

Sharing & Sub-processors

We do not sell personal information. We share it with the categories of recipients below, and we engage the following sub-processors, each under a data processing agreement, to operate the SupportAIgent platform on our behalf:

Workspace members of your organization, per the roles and permissions your workspace sets.
Connected messaging channels you choose to integrate (e.g., WhatsApp, Instagram, Facebook).
Authorities when required by law, or to protect rights and safety.
A buyer or successor in a merger or acquisition.

Sub-processor	Purpose	Data shared	Processing location
Meta Platforms, Inc. (WhatsApp / Instagram / Facebook, incl. the WhatsApp Embedded Signup SDK)	Message delivery across connected channels; WhatsApp Business onboarding.	Message content (both directions), customer phone number, profile name, media.	United States & other regions
Google LLC — Vertex AI	Large-language-model generation and voice-note transcription.	Message content and conversation context for each AI request; audio for transcription.	United States
OpenAI, L.L.C.	Fallback large-language-model provider.	Same as Vertex AI, when the fallback is used.	United States
LiveKit, Inc. (LiveKit Cloud)	Real-time WebRTC voice calling for WhatsApp calls answered in the web inbox.	Live call audio and connection metadata between the customer and the agent.	United States
Amazon Web Services, Inc. (RDS, S3, Cognito, Amazon MQ, SQS, EC2)	Hosting, database, object storage, admin identity, and message queueing.	All persistent data; admin account identity; uploaded media.	United States (us-east-1)

A current list of sub-processors is available on request; we will give workspace owners advance notice of any new sub-processor so they may object.

Retention

We keep data while your workspace is active or as needed for the purposes above. Workspace owners can request deletion; we delete within a reasonable period unless the law requires retention.

Security

We use reasonable technical and organizational measures (e.g., encryption in transit, role-based access, logging). No method is 100% secure.

Cookies & Similar Technologies

Strictly necessary cookies (no consent required).These are essential to operate the dashboard you have signed in to and are exempt from consent under ePrivacy Art. 5(3). We currently use one:

sidebar:state— remembers whether you left the admin navigation sidebar expanded or collapsed. It is a first-party functional preference cookie, set only after you sign in, contains no identifier and no tracking data, is never sent to any third party, and expires after 7 days.

We do not set this cookie on public, unauthenticated pages (our landing page, the public chat widget, this policy page, or the sign-in page). To remove it, clear your browser's cookies for this site; the sidebar will simply return to its default state.

International Transfers

Our infrastructure and sub-processors (see the table above) are located primarily in the United States. When you or your customers are in the European Economic Area, the United Kingdom, or Switzerland, using the service involves transferring personal data to these countries. Where required, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss equivalent) with each sub-processor as the transfer safeguard. A copy of the relevant transfer mechanism is available on request.

Workspace owners/admins can manage data in-product or email contact@toai.ai.

Changes

We may update this policy. We will post the new version with an updated effective date.

Contact

Questions or requests: contact@toai.ai

Note: For conversation data in a customer workspace, the workspace owner is usually the data controller and Toai acts as a processor; Toai is the controller for its own business operations. A Data Processing Addendum is available on request.