Privacy Policy

1. Who this covers

Toolspoke is a product of Guidenco, Inc., a Delaware C corporation (Delaware file number 7214918) with its registered office at 651 N Broad St, Suite 201, Middletown, DE 19709, United States. Guidenco, Inc. is the controller of the data described below. This policy covers the hosted service at toolspoke.com and this website. Section 11 covers what changes when you run Toolspoke on your own infrastructure.

We have not appointed a data protection officer, because our core activities are neither large-scale systematic monitoring of individuals nor large-scale processing of special category data, which are the conditions in Article 37 that would require one. We have not appointed an EU representative, relying on the exemption in Article 27(2): our processing is occasional, is not large-scale processing of special category data, and is unlikely to result in a risk to the rights and freedoms of individuals. If either position changes we will appoint and name the relevant party here.

Toolspoke sits in two different roles depending on the data:

• For account, billing, and website data, we decide what is collected and why. In data protection terms we are the controller, and this policy governs.
• For the data inside a workspace, including everything that passes through a tool call, the organisation decides what flows and why. We process it on their instruction. The Data Processing Addendum governs that relationship. If you are a member of someone else's Toolspoke workspace, they are the party to ask about that data first.

2. What we collect

Account and profile

Your name, your email address, whether that address has been verified, an optional profile photo, and which organisations you belong to along with your role in each. If you sign up with an email and password, the password is stored hashed, never in readable form.

Social sign-in

Sign-in with Google or GitHub is optional and is only available where the operator of the deployment has configured it. Where you use it, we store the account identifier the provider gives us and the tokens it issues for your account, so that you can sign back in.

Sessions

Each session record holds a session token, an expiry, the IP address and the browser user agent the session was created from, and which organisation and project you are currently looking at.

Workspace configuration

Organisation and project names, whether a project is open to your whole workspace or restricted to named people, who is on a restricted project and who administers it, the connectors you install and how they are configured, which of a connector's actions each project has switched off, and your agent keys with the names you give them and the projects, connectors and actions each one was granted.

Credentials you connect

API keys, OAuth tokens, and other secrets for the third-party systems you connect. These are encrypted at rest with AES-256-GCM and decrypted in memory only for the duration of a tool call that needs them. They are never displayed back to you after they are saved.

Tool call records

The most significant category, described in full in the next section.

Billing

Your plan, your seat count, your credit balance, and a ledger of every grant and every deduction. Card details are collected by Stripe and go to Stripe. We do not receive or store them.

Messages you send us

If you email us, we keep the message and our reply.

3. The tool call record

This is the part of the policy worth reading twice, because it is the most privacy-significant thing Toolspoke does.

Every tool call an agent makes through the gateway writes an audit record. That record contains:

• the full request payload the agent sent;
• the full response payload the tool returned;
• the member the calling agent key belongs to, and the agent key and the name given to it;
• the tool and the action called, and the project and organisation it belongs to;
• the status, the error message where there was one, how long the call took, and which execution path ran it.

There are two limits on that capture, and it is important to be exact about what each one does.

Arguments a connector withholds, applied on write. A connector operation can name the arguments that must never be stored. Those values are replaced before the record is written, so they do not reach the database at all. This is what covers personal content arriving under an ordinary field name, such as a message body or a calendar invitation, which key-name matching cannot recognise. It applies wherever that connector is installed, because the declaration belongs to the operation rather than to the deployment.

Redaction by field name, applied on read. When an audit record is read back through the product, any value whose field name looks like a secret is replaced with a redaction marker. The names matched include authorization, cookie, password, secret, token, api key, credential, and similar variants, at any depth of the payload. Bearer tokens and query string secrets are stripped out of error text the same way. This is a display-time protection: it means a secret that travelled inside a payload is not shown back to anyone reading the log, and it is not a claim that the raw value was never written to the database.

Responses that are never stored. A connector can declare that a particular operation's response must never be written. Records for those calls keep the member, the tool, the timing, and the status, and carry no response payload at all.

What follows from this is plain. Because request and response payloads are captured in full, any personal data inside the content an agent sends or receives is recorded. If an agent reads a support conversation, a document, a calendar, or a row from a CRM, the contents of that read are in the audit record, and any administrator of the organisation can read it. That is the point of an audit product, and it is a real privacy cost. Choose which tools you connect, how narrowly the underlying credential is scoped, and who you put on the project, with that trade in mind.

4. How we use it

• To provide the service: authenticating you, resolving your grants, executing calls, and showing you your logs.
• To keep it secure: detecting abuse, investigating incidents, and enforcing the terms.
• To meter and bill: counting credits and deriving seat counts.
• To support you: answering the questions you send us.
• To keep the product working: debugging faults and looking at usage in aggregate.
• To meet legal obligations.

Things we do not do. We do not sell personal data. We do not serve advertising. There is no advertising or cross-site tracking script on this website; the two analytics tools we do use are named in section 10, and the one that sets cookies runs only if you accept it. We do not use the content of your tool calls to train models.

Two features do send content to a model provider on your instruction: the toolkit builder, and the embeddings that power search. Both route through OpenRouter. Our OpenRouter account is configured for zero data retention with model training disabled, and OpenRouter routes only to providers that honour those settings. Your prompts and the content sent with them are not stored by the provider after the response is returned, and are not used to train any model.

5. Legal bases

Guidenco, Inc. is a Delaware corporation, and the service is offered to people in the European Economic Area, so the EU General Data Protection Regulation applies to that processing. We do not offer the service to people in the United Kingdom, so the UK GDPR does not apply. We do not meet the thresholds in the California Consumer Privacy Act, so it does not apply either. If any of that changes, this section changes with it.

Under the GDPR, our basis depends on the purpose:

• Performance of a contract (Article 6(1)(b)) for providing the service and billing it: authenticating you, resolving your grants, executing tool calls, showing you your logs, metering credits and taking payment.
• Legitimate interests (Article 6(1)(f)) for keeping the service secure and reliable: detecting abuse, investigating incidents, enforcing the terms, debugging faults and looking at usage in aggregate. Our interest is in running a service that is not misused and does not break; we have weighed it against your interests and have limited the processing to what those purposes need.
• Legal obligation (Article 6(1)(c)) for records we are required to keep, principally billing and tax records.
• Consent (Article 6(1)(a)) for anything optional, such as email we send you that is not about your account or the service. You can withdraw it at any time without affecting anything we did before you did.

6. Who else sees it

People in your organisation. Owners and administrators can read the organisation's audit log, which includes the payloads of calls made by other members' agents.

Sub-processors. A small set of providers process data on our behalf. Each one, what it does, and what it sees are listed in the table in the Data Processing Addendum. In short they are Infisical for secret management, Stripe for payments where billing is configured, OpenRouter for the toolkit builder and search embeddings, Harborbox for sandboxed execution, Cloudflare where a tunnel is enabled, an SMTP provider for invitation email, and GitHub's releases API when a command line tool is built from a release.

Legal requests. We may disclose data where we are required to by law, and we will tell you unless we are prohibited from doing so.

A change of ownership. If Guidenco, Inc. is acquired, merges, or sells the assets this service runs on, personal data may transfer to the acquirer as part of that transaction. The acquirer remains bound by this policy until it publishes one of its own, and we will tell you before your data moves so that you can delete your account first if you would rather.

7. How long we keep it

Audit records on the hosted service are kept for 365 days. A sweep deletes records older than that. Retention is a per-organisation setting, so an organisation can ask us for a shorter window at [email protected]; there is no interface for changing it yourself yet. On a self-hosted deployment the value is the operator's to set, and the shipped default there is no limit, because the operator already holds the disk and the data.

There is no way today to delete an individual audit record through the product. Records are removed in bulk by the retention sweep, or when the organisation itself is deleted.

Account and workspace data is kept while the account exists. After an organisation is deleted, its rows are removed. Billing records are kept for seven years from the date of the record, which covers the assessment periods that apply to a Delaware corporation.

8. Security

The measures actually in place today: credentials encrypted at rest with AES-256-GCM and decrypted only in memory for the duration of a call; runtime secrets resolved from Infisical rather than read from files on disk; TLS in transit; access to a connector's actions decided by the project it is installed in and narrowed further per agent key, with an agent key limited in every case to what its owner can reach at the time of the call; execution isolated in a per-project sandbox where the connector requires it; and the audit redaction described in section 3.

More detail is on the security page. We hold no security certification and this policy claims none. No system is perfectly secure, and we do not promise that ours is.

9. Your rights

Depending on where you live, you may have rights to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy in a portable form, to object to or restrict certain processing, and to complain to a data protection authority.

Where the data sits inside an organisation's workspace, that organisation decides what happens to it. We will pass your request on to them and assist them in answering it, rather than acting on it directly.

Under the GDPR those rights are access, rectification, erasure, restriction of processing, data portability, objection to processing carried out on the basis of our legitimate interests, and the right to withdraw consent where consent is what we relied on.

To make a request, write to [email protected]. We will respond within one month. Where a request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do. We will verify your identity proportionately, which normally means confirming that you control the email address on the account, and we will not ask for more than is necessary to be sure it is you.

If you are unhappy with how we have handled a request, you can complain to the data protection authority in the EU member state where you live or work. We have no establishment in the EU, so there is no single lead authority for complaints about us.

10. Cookies

Toolspoke sets a session cookie when you sign in, which is what keeps you signed in. There are no advertising cookies.

This website uses Google Analytics to count page views, configured in cookieless mode: Google's Consent Mode is set to deny all storage, so the script sets no cookie, stores nothing on your device, and does not identify you across visits. A self-hosted deployment does not load it at all.

We also use Microsoft Clarity to see how pages are actually used — which controls get clicked, where a layout sends people the wrong way. Clarity records a playback of your visit and sets two cookies to join your page views into one session: _clck, kept for up to a year, and _clsk, kept for a day. Microsoft is the processor for that data and may use it in line with its own privacy statement.

Clarity does not load until you accept it. Neither cookie is set, and no request is made to Microsoft, unless you choose Accept on the banner shown on your first visit. Declining, or simply ignoring the banner, means the script is never loaded at all — we treat silence as a no. Your choice is remembered in your browser's local storage rather than in a cookie, and clearing site data brings the banner back.

The session cookie is strictly necessary to deliver a service you have asked for, which is the exemption in Article 5(3) of the ePrivacy Directive, so it is set without asking. The Clarity cookies are not strictly necessary, which is why they are asked about first. A self-hosted deployment configures no Clarity project, so it shows no banner and loads no session recording.

11. Self-hosted deployments

When you run Toolspoke on your own infrastructure, your database, your audit records, and your connected credentials stay in your infrastructure. We receive nothing. Securing that deployment, backing it up, setting its retention, and answering data subject requests about it are your responsibility.

A self-hosted deployment still talks to whichever external services you configure it to talk to, which may include OpenRouter, Harborbox, Stripe, an SMTP provider, and Cloudflare. Those are your sub-processors in that arrangement, not ours, and the relationship with each is yours to govern.

In practice this means that for a self-hosted install you are the controller and this policy describes your deployment rather than ours. You will need your own privacy notice for your own users.

12. International transfers

The hosted service stores and processes your data in Germany. The application, the database and the audit records run on servers in Falkenstein, Saxony, operated by Hetzner Online GmbH. Data at rest does not leave the European Union.

Two things do cross the border, and neither is a bulk export:

• Our staff. Guidenco, Inc. is a Delaware corporation and its team works from India. Administrative access to production is remote access from outside the EEA.
• Sub-processors outside the EEA. Payment data goes to Stripe, model requests to OpenRouter, secret management to Infisical, and tunnelling to Cloudflare where it is enabled.

For both, we rely on the European Commission's 2021 standard contractual clauses, and we have carried out a transfer impact assessment covering the destinations involved. A copy of the clauses is available on request at [email protected].

13. Children

Toolspoke is a tool for work and is not directed at children. We do not knowingly collect data from them, and if we learn that we have, we will delete it. The service is bought under our terms, which require the capacity to enter a contract, so it is not for anyone under 18. We do not knowingly collect data from anyone under that age.

14. Changes

We may update this policy. The date at the top changes when we do, and for a change that materially affects you we will give notice by email or in the product before it takes effect.

15. Contact

Privacy questions go to [email protected]. Other routes are on the contact page.