Privacy notice
Last updated 23 October 2026
Who processes your data
The data controller is Vinicios Gama Salum, trading as Tooluy, based in Kamëz, Tirana, Albania. Privacy contact: [email protected].
We are the controller for account, billing and communication data and for the tooluy.com website. For the data that businesses put into Tooluy about their own clients and employees, the business is the controller and we are the processor (see below).
What we collect, why, and on what basis
- Account data: name, email, phone, business name, tax number, address and password (stored hashed). To create the account and provide the service. Basis: contract.
- Usage and security data: IP address, logins and actions in the app (for example, who finished a stage). For security and to make the app work properly. Basis: legitimate interest.
- Billing: plan, payments and invoices. Card details are processed by Paddle: we never see the full card number. Basis: contract and legal obligation.
- Communication: messages from the contact form on tooluy.com (name, email, phone, business name and message), emails you send to contact@ or support@ and demo requests. To reply to you. Basis: legitimate interest or contract.
- The tooluy.com website: it uses no cookies and no analytics. The hosting provider processes your IP address only to deliver the page and protect it from attacks. Basis: legitimate interest.
Data about businesses’ clients and employees
Businesses using Tooluy enter data about their clients (name, phone, email, address, quotes, payments) and employees (name, role, hours, wages). For this data the business is the controller. We:
- process it only to provide the service and following the business’s instructions;
- keep it confidential and let only people who need it see it;
- protect it with the security measures described below;
- use only the other processors listed on this page;
- help the business answer people’s requests and report data breaches;
- delete it or return it to the business after the account is closed.
These rules, together with the Terms and conditions, form the data processing agreement between us and the business.
Who receives data
- netcup GmbH (Germany): the servers Tooluy runs on, in Nuremberg.
- Cloudflare, Inc.: DNS, the tooluy.com website and email forwarding.
- Brevo (Sendinblue SAS, France): sending system emails such as account confirmation and client notifications, and messages from the contact form.
- Google (Gmail): we read the emails you send to contact@ and support@ in Gmail.
- Paddle.com: Merchant of Record for our orders; processes payments, taxes and invoices.
- The off-site backup storage provider, when active. Backups are encrypted.
- Our professional advisers (accountant, lawyer), when needed.
- Authorities, only when the law requires it.
Services that a business switches on itself: Meta Platforms (WhatsApp Business), easyPos (fiscalisation) and the business’s own email server for campaigns. When a business switches them on, the data they need is sent to them.
We do not sell data and do not use it for advertising.
Where data is stored
Tooluy data is stored on servers in Germany, inside the European Union. Some providers (Cloudflare, Google, Paddle) may also process it outside the EU or Albania. In those cases we rely on appropriate safeguards: adequacy decisions, the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework.
How long we keep it
- Account and business data: while the account is active. After closing, we delete it within 90 days.
- Accounts that were created but never confirmed are deleted automatically after 7 days.
- Encrypted backups: up to 8 weeks, then deleted automatically.
- Invoices and payment records: as long as tax law requires.
- Security logs: up to 12 months.
- Emails with us: up to 2 years after the last message.
Your rights
You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format and object to its processing. Where processing is based on consent, you can withdraw it at any time.
Write to [email protected]. We reply within one month.
You have the right to complain to the Information and Data Protection Commissioner in Albania, or to the data protection authority in your country.
If you are a client or employee of a business that uses Tooluy, make your request to that business first: it decides about your data. We will help.
Security
- The connection to Tooluy is always encrypted (HTTPS).
- Each business sees only its own data.
- Passwords are stored hashed, and the keys for connected services (email, WhatsApp) are stored encrypted.
- Backups are made every day and are encrypted.
- Access to the servers is limited to the people who need it.
Cookies
The tooluy.com website uses no cookies. The app at app.tooluy.com uses only cookies needed for logging in, security and language. We do not use cookies for advertising or analytics.
Children
Tooluy is a service for businesses and is not for people under 18.
Changes
When we change this notice, we update the date at the top. For important changes we will tell you by email or in the app.