Privacy.

1. Introduction

Toaver ("we," "us," or "our"), operated by Chartbuddy B.V., is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use Toaver. By using Toaver, you agree to the collection and use of information in accordance with this policy. If you do not agree to this Privacy Policy, please do not use Toaver.

Chartbuddy B.V. is the data controller for the personal data described in this policy.

1.1 What this policy covers

This policy covers the Toaver desktop application for macOS and Windows, which works with files on your device, Google Slides™ and Google Docs™, and third-party data sources ("connectors"), and includes an AI assistant, Toaver AI. It also covers this website. Any customer can request a Data Processing Addendum (DPA) by emailing legal@chartbuddy.io.

2. Data protection officer

If you have any questions about this Privacy Policy or how we handle your personal data, you may contact our Data Protection Officer:

• Email: privacy@chartbuddy.io

3. Information collection

3.1 Types of data

We process the following types of data:

• Account information: Name, email address, and organization name for authentication, billing, and support.
• Authentication data: Credentials and tokens needed to sign you in and keep a session, including where you connect a Google account.
• Google integration data: Identifiers for the Google Slides presentations and Google Docs documents you select for use with Toaver, and the Google access tokens that let Toaver act on them on your behalf.
• Projects: Project names, members and their roles, the chart defaults and document templates linked to a project, PowerPoint template files and template guides you add, and a record of changes to the project.
• Toaver AI usage records: For each AI request, the model, the amount of input and output, the cost, and technical sizes and checksums of the request.
• Feedback: The text, screenshots, recordings or files you choose to attach when you send us feedback from Toaver, together with your Toaver version and operating system.
• Usage analytics: How you use Toaver, such as which features and commands you use, performance timings and app version. These records are linked to your account. They do not include chart content, spreadsheet data, prompts or file contents.
• Diagnostic data: Error messages and technical error details (such as stack traces) from Toaver, sent with usage analytics.

3.2 Data transfer

Rendered chart images are temporarily transferred to our Google Cloud Storage (Europe-West4, Netherlands) for approximately two seconds to enable insertion into Google Slides or Google Docs via signed URLs. Images are deleted immediately after insertion, with a lifecycle rule as failsafe.

3.3 What stays on your device

Charts, files and chats in Toaver stay on your own device. Apart from Toaver AI (Section 10.2), their content is not sent to our servers.

Google. If you connect a Google account, our backend issues the short-lived Google access token Toaver uses, and Toaver edits the Google Slides and Google Docs files you choose directly through Google's APIs.

Connectors. When you connect a data source such as Hex, Stripe or Notion, Toaver talks to that service directly under your account there, and stores the sign-in for it in your operating system's credential store.

Project sharing. When you share a project, colleagues see its name, members, chart defaults and templates, not your files or chats.

3.4 Data storage

We store the data in Section 3.1 on our servers (Section 11.2), except PowerPoint template files, which are stored in Google Cloud Storage in the Netherlands. We will not sell your personal data to third parties.

4. Lawful basis for processing personal data

We process your personal data based on the following lawful bases under the General Data Protection Regulation (GDPR):

• Performance of a Contract: Processing is necessary to provide the services you have requested.
• Legitimate Interests: Processing is necessary for our legitimate interests in improving and securing Toaver, provided that these interests are not overridden by your rights. We rely on this basis for usage analytics and error details. You can object to this at any time (Section 9.6).
• Consent: Where required, we will obtain your consent before processing your personal data.

5. How we use your information

We use your information for the following purposes:

• Authentication: To verify your identity when accessing Toaver, and to determine which plan applies to your account.
• Customer Service: To provide you with effective and efficient customer support.
• Customization: To tailor your experience based on your preferences and your organization's settings.
• Security: To protect your account and our services from unauthorized access and security threats.
• Improvement: To enhance features and performance based on usage analytics and error details.
• Research: To conduct analysis and produce reports regarding the use of our services, based on anonymized and aggregated data.

6. Information sharing and disclosure

We may share your information in the following circumstances:

• Legal Requirements and Protection: We may disclose your information if required by law or subpoena, or if we believe it is necessary to comply with legal obligations or requests from law enforcement, enforce our terms, or protect the rights, property, or personal safety of our company, our users, or others.
• Business Transfers: In cases where we buy, sell, divest, or transfer the company (including shares or any combination of our products, services, assets, or business segments), your data may be transferred as part of the assets. If this occurs, we will notify you promptly of the change.
• Aggregate/Anonymized Information: We may share aggregated or anonymized data about the use of our services for analytics or marketing purposes. This data does not identify individual users and is not restricted by this Privacy Policy.
• Consent: We may disclose your information to third parties when we have your explicit consent or a legal basis other than consent.
• Subprocessors: We use carefully selected subprocessors: DigitalOcean (hosting, Amsterdam), Google Cloud Storage (chart image transfer and template files, the Netherlands), Orq, OpenAI and Google Cloud (Toaver AI, Section 10.2), and Mollie for payments.
• Advertising Measurement: If you arrive from an ad in ChatGPT, we keep the ad's reference for 90 days and tell OpenAI when you sign up, so we know which ads work. OpenAI's measurement script runs on this website without advertising cookies.

7. International data transfers

All personal data is processed and stored within the European Economic Area (EEA), with two exceptions: Toaver AI runs in the EU by default, but if your organization chooses the US region, Toaver AI requests are processed in the United States; and the advertising measurement in Section 6 involves OpenAI in the United States. In those cases we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the recipient is certified under it.

8. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law.

• Account, authentication data and projects: as long as your account exists.
• Invoices: as long as Dutch tax law requires, currently seven years.
• AI usage records: as long as needed for billing, and at least as long as the related invoices.
• Usage analytics, error details and feedback: as long as needed to support and improve Toaver.

9. Your rights under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• 9.1 Right to Access: You can request access to the personal data we hold about you.
• 9.2 Right to Rectification: You can request correction of any inaccurate or incomplete personal data.
• 9.3 Right to Erasure: You can request deletion of your personal and user-generated data.
• 9.4 Right to Restrict Processing: You can request the restriction of processing your personal data under certain circumstances.
• 9.5 Right to Data Portability: You can receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.
• 9.6 Right to Object: You can object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• 9.7 Right to Withdraw Consent: If processing is based on your consent, you can withdraw consent at any time without affecting the lawfulness of processing before its withdrawal.

To exercise any of these rights, please contact us at legal@chartbuddy.io. We will respond to your request within 30 days.

10. Artificial intelligence and automated access

10.1 We do not train models on your data

We do not use your content, your data, or your personal data to train machine learning models, and we do not permit our providers to do so.

10.2 Toaver AI

If you choose to use Toaver AI, Toaver's built-in AI assistant, your prompt and the content it needs to answer are sent through our AI gateway to our AI providers: Orq, which routes the request, and OpenAI or Google Cloud, which run the model. That content can include your chat, the files you add or point it to, chart data, slide or document text, previews of charts and pages, and results from connectors. Requests run in the EU by default, or in the United States if your organization chooses that region.

Our servers do not store your prompts, files or AI replies; we keep only the usage records described in Section 3.1. The model providers keep this content no longer than needed to answer the request and prevent abuse. Orq, which routes the request, keeps a log of it in the EU for a limited period, at most 365 days, and does not use it to train models.

10.3 Connecting your own AI assistant

You may connect your own AI assistant, such as Claude or ChatGPT, to Toaver through the Model Context Protocol (MCP). That connection runs locally on your own device. We do not receive your prompt or Toaver data through it.

10.4 Your AI provider, not ours

This section is about AI assistants you connect yourself, not Toaver AI. Your prompt and any data you give such an assistant are handled by that assistant's provider under your own agreement with them. We are not a party to that agreement. Consult that provider's privacy notice to know how it handles your data.

10.5 Automated decision-making and profiling

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

11. Data security

• 11.1 Transmission Security: All personal data transmitted between Toaver and our servers is encrypted using HTTPS.
• 11.2 Data at Rest: Personal data stored on our application servers is encrypted using strong encryption methods such as RSA or AES. Those servers are located in Amsterdam, the Netherlands, within the European Union.

12. Data breach notification

In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by GDPR.

13. Children's privacy

Toaver is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are under 16, please do not use Toaver or provide any personal data to us.

14. Changes to this privacy policy

We may update our Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this Privacy Policy periodically.

15. Contact information

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at legal@chartbuddy.io.

16. Complaints

If you believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with a supervisory authority in the European Union, particularly in your country of residence or where the alleged infringement occurred. In the Netherlands, this is the Autoriteit Persoonsgegevens.

17. Information control

• 17.1 Access and Update: You can access and update your personal information by logging into your account.
• 17.2 Data Deletion: You can delete your account and all associated data from your account settings, or ask us at support@chartbuddy.io. In some instances, we may need to retain certain information even after a deletion request if required to fulfill legal obligations, regulatory standards, or to safeguard against fraud and abuse. Files and charts on your own device are yours and are not affected by deleting your account.
• 17.3 Managing Communications: You can opt out of promotional emails by clicking the "unsubscribe" link in them. To stop receiving essential service-related notifications (such as account verification, billing confirmations, feature updates, and security alerts), please contact us at legal@chartbuddy.io.

18. Cookies and similar technologies

This website uses a first-party cookie to count visits (24 hours) and loads its font and demo from Google Fonts and jsDelivr.

19. Third-party services

Toaver does not itself embed third-party services that collect personal or sensitive user data. The exceptions are that Toaver downloads fonts from Google Fonts when a chart uses a font that is not bundled with Toaver, and loads an icon from Google when you open the panel for connecting an AI assistant; both disclose your IP address to Google.