Privacy Policy

How we handle data.

Last updated · August 21, 2026

Summary

ToolPlex is an enterprise AI platform. This Privacy Policy describes how ToolPlex LLC ("ToolPlex," "we," "us," or "our") collects, uses, and protects personal information when you visit our public website, evaluate our Services, or use the ToolPlex platform under a separately executed agreement.

Key points:

  • We collect only what's needed to operate the Services, evaluate prospective customers, and meet legal obligations.
  • Customer Content (data Customers submit to the Services) is processed only on the Customer's dedicated, single-tenant infrastructure. We do not use Customer Content to train ToolPlex's models, share it across customers, or sell it.
  • We may collect and use de-identified, aggregated metadata, telemetry, and usage signals (which do not identify the Customer or contain Customer Content) to operate, secure, and improve the Services.
  • We comply with the GDPR, CCPA, and applicable state privacy laws.
  • We do not sell personal information, share it with advertisers or data brokers, or use it for targeted advertising.

For Customers under an executed Service Agreement, POC Contract, Master Service Agreement, or other written agreement with ToolPlex (each a "Customer Agreement"), the data processing terms of that Customer Agreement (including any Data Processing Agreement) control over this Privacy Policy.

Contact: [email protected]

1. Definitions

  • Customer: An organization that has executed a Customer Agreement with ToolPlex for use of the Services.
  • Customer Content: Data, files, documents, configurations, and other materials a Customer submits to the Services, including data drawn from a Customer's systems for use by AI agents and automations.
  • Customer Agreement: A Service Agreement, POC Contract, Master Service Agreement, Order Form, or other written agreement executed between Customer and ToolPlex.
  • Services: The ToolPlex enterprise AI platform, including web, desktop, and mobile applications, agents, automations, playbooks, and related products and services.
  • Visitor: A person who visits the public ToolPlex website without entering into a Customer Agreement.
  • Personal Data / Personal Information: Information that identifies, relates to, or could reasonably be linked to an identifiable individual.

2. Scope

This Privacy Policy applies to:

(a) Visitors to the ToolPlex public website and any forms, sales discussions, or demos conducted prior to the execution of a Customer Agreement; and

(b) Personal Data collected during the operation of the Services where not otherwise governed by an executed Customer Agreement.

For Customers operating under a Customer Agreement, the data processing terms of that agreement (including any associated Data Processing Agreement) control. Where this Privacy Policy and the Customer Agreement conflict, the Customer Agreement governs as to that Customer's use of the Services.

3. Information We Collect

A. From Visitors

  • Contact information voluntarily submitted via demo request or contact forms (name, work email, company, role, message).
  • Device and log data (IP address, browser type, operating system, referrer, timestamps).
  • Cookies, analytics, and device identifiers as described in Section 9.

B. From Customer Personnel

When a Customer's authorized users access the Services:

  • Account data (name, work email, authentication method).
  • Usage telemetry (interactions, feature usage, performance metrics, error events).
  • Application logs for security, troubleshooting, and operational purposes.

C. From Customer Systems

The Services may process Customer Content drawn from a Customer's data sources, internal APIs, and connected systems, as configured by the Customer or by ToolPlex on the Customer's behalf. Customer Content remains the Customer's data; ToolPlex acts as a processor with respect to it under GDPR.

D. Desktop and Mobile Applications

The desktop application stores chat sessions, configuration, and authentication tokens locally on the user's device. The mobile application stores authentication tokens, session identifiers, and notification preferences in encrypted device storage. Both transmit telemetry, error reports, and crash diagnostics to ToolPlex for operational purposes.

4. Legal Bases for Processing

We process Personal Data on the following bases:

  • Performance of contract. To provide the Services to a Customer under a Customer Agreement.
  • Legitimate interests. To operate, secure, monitor, debug, and improve the Services; to evaluate prospective customers; to prevent fraud and abuse; to enforce our Terms.
  • Consent. For any optional processing where required by law.
  • Legal obligation. To comply with applicable laws and respond to lawful requests.

5. Customer Content and Aggregated Data

Customer Content. Customer Content is processed only within the Customer's dedicated, single-tenant runtime. ToolPlex does not use Customer Content to train its models, does not share Customer Content across customers, and does not sell Customer Content to any third party.

De-identified, aggregated data. ToolPlex may collect, derive, retain, and use de-identified, aggregated metadata, telemetry, and usage signals (which do not identify the Customer or contain Customer Content) to operate, secure, monitor, debug, and improve the Services and to develop new features. De-identified, aggregated data is owned by ToolPlex and may be retained indefinitely.

6. Sharing

We do not sell Personal Data. We do not share Personal Data with advertisers or data brokers. We share Personal Data only:

  • With subprocessors. Third-party providers acting under our instructions and bound by appropriate contractual safeguards (see Section 7).
  • In response to legal process. When required to comply with applicable law, court order, or lawful government request, or to enforce our rights.
  • In a corporate transaction. In connection with a merger, acquisition, financing, or asset sale, subject to confidentiality.
  • With Customer authorization. As configured by the Customer (e.g., when integrations route data to systems the Customer designates).

7. Subprocessors

We engage subprocessors in the categories of: cloud infrastructure, authentication, AI inference, analytics, billing, email delivery, and security monitoring. A current list of named subprocessors is available to Customers under NDA upon request.

We require subprocessors to provide a level of data protection at least equivalent to that required by applicable law and the relevant Customer Agreement.

8. International Transfers

ToolPlex LLC is incorporated in the United States. Personal Data may be transferred to and processed in jurisdictions other than the country of the data subject, including by ToolPlex's subprocessors and AI inference providers. Where required by applicable law, we implement appropriate safeguards, including Standard Contractual Clauses. Specific data residency and transfer mechanisms applicable to Customer Content are addressed in the Customer Agreement and any associated Data Processing Agreement.

9. Cookies and Tracking

The public website uses Google Analytics only when a Visitor chooses to allow analytics. Google Analytics helps us understand website traffic, which pages are visited, how Visitors interact with key links and forms, and general browser, device, approximate location, referral, and campaign information. It uses first-party cookies named _ga and _ga_<container-id> to distinguish Visitors and maintain session information. Google Analytics cookies may remain for up to two years unless they are deleted earlier.

We store a Visitor's analytics choice in the browser so we do not ask again on every page. Visitors can change that choice at any time through Cookie settings in the website footer. Declining analytics does not affect access to the public website.

The Services may use essential cookies, local storage, and device identifiers for authentication, saved preferences, fraud prevention, abuse detection, and security. These technologies are not used for advertising.

We do not currently respond to "Do Not Track" browser signals.

10. Data Retention

We retain Personal Data only for as long as needed for the purposes described in this Policy:

  • Visitor inquiries and pre-contract communications: typically up to 24 months from last interaction.
  • Operational logs and telemetry: typically up to 12 months for security, debugging, and operational purposes.
  • Customer-related Personal Data: per the executed Customer Agreement.
  • De-identified, aggregated data: indefinitely.
  • Enforcement, audit, and legal records: as long as needed for legal claims, compliance, or enforcement.

We will delete or anonymize Personal Data within a commercially reasonable period following a valid deletion request, generally not exceeding 90 days, except where retention is required by law, for fraud prevention, or for enforcement of our Terms.

11. Your Rights

Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to processing of your Personal Data, and to data portability. We will respond to verifiable requests within the timeframes required by applicable law (generally 30 to 60 days).

To exercise these rights, contact [email protected] with sufficient information to verify your identity.

For requests concerning Customer Content, please direct your request to the Customer organization. ToolPlex acts as a processor with respect to Customer Content and will respond to data subject requests as instructed by the Customer.

12. California Privacy Rights (CCPA)

California residents have the right to know what categories of Personal Information we collect, to request deletion of their Personal Information, to opt out of any "sale" or "sharing" of Personal Information (we do neither), and to be free from discrimination for exercising these rights.

To submit a CCPA request, contact [email protected] with "California Privacy Request" in the subject line.

13. Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Data, including encryption in transit and at rest, access controls, single-tenant per-Customer runtimes, audit logging, and ongoing monitoring. No system is perfectly secure; we make no warranty against unauthorized access. Our security overview is available at toolplex.ai/#security.

In the event of a breach affecting Personal Data, we will notify affected Customers and supervisory authorities as required by applicable law.

14. Children's Privacy

The Services are intended for business use by adults. We do not knowingly collect Personal Data from individuals under 18.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to Customers, prominent website notice, or in-app notification. Continued use of the Services after such notice constitutes acceptance of the updated Policy.

16. Contact

For questions about this Privacy Policy or to exercise your rights:

Email: [email protected] Subject Line: Include "Privacy Request" for data subject rights requests.