TOSTA PRIVACY POLICY

Effective Date: November 1, 2026

1. INTRODUCTION

Welcome to TOSTA ("TOSTA," "we," "our," or "us").

TOSTA helps users interact with their existing productivity tools and services through natural language and voice commands. This Privacy Policy explains what information we collect, how we use it, and the choices available to users.

By using TOSTA, you agree to the practices described in this Privacy Policy.

2. OUR PRIVACY PRINCIPLES

TOSTA is built around the following principles:

Your data belongs to you.
We collect only what is necessary to provide the service.
We do not sell personal information.
We do not use user content to train public AI models.
We strive to minimize long-term storage of user information.
You control which third-party services are connected.

3. INFORMATION WE COLLECT

Beta Access Registration

If you request consideration for TOSTA beta access, we collect:

Your email address
The date and time of your request
The version of the consent notice you accepted
Your beta registration or invitation status

We also use limited technical information, including your IP address and browser or device signals, to prevent automated abuse and protect the registration form. Your IP address is not stored in the beta registration database.

Submitting a beta access request does not guarantee an invitation. Email ownership verification is deferred to a future invitation or access workflow.

Account Information

When you create an account, we may collect:

Name
Email address
Authentication information
Subscription status

Connected Services

When you connect third-party services, we may receive limited information necessary to perform requested actions.

Examples include:

Calendar event metadata
Task metadata
Notes metadata
Contact information
Email metadata
Communication metadata

We access only the information required to execute user-requested actions.

Voice and Text Commands

When you interact with TOSTA, we may process:

Voice recordings
Voice transcriptions
Text commands

These inputs are used solely to understand and execute your requests.

Device Information

We may collect:

Device type
Operating system version
Application version
Diagnostic information
Error logs

4. HOW WE USE INFORMATION

We use information to:

Provide and operate TOSTA
Execute requested actions
Authenticate users
Maintain account security
Improve reliability and performance
Provide customer support
Evaluate and administer beta access requests
Contact beta registrants only about private beta invitations and occasional beta-related updates they requested, not unrelated marketing
Prevent automated abuse of website forms
Comply with legal obligations

5. THIRD-PARTY SERVICES

TOSTA integrates with services such as:

Google
Microsoft
Todoist
Notion
Zoom
Other authorized providers

Your use of those services remains subject to their respective privacy policies and terms.

TOSTA does not control how third-party providers process your information.

Cloudflare

We use Cloudflare infrastructure to host and protect the beta registration service. Beta registration records are stored in Cloudflare D1. Cloudflare Turnstile processes limited technical information, such as IP address and browser or device signals, to determine whether a registration request is likely to be submitted by a person rather than an automated system. Cloudflare processes this information on our behalf under its Privacy Policy.

6. DATA STORAGE

TOSTA seeks to minimize stored user data.

Data may be stored temporarily when necessary to:

Execute requests
Synchronize services
Maintain account functionality
Support troubleshooting and diagnostics

We retain information only for as long as reasonably necessary.

Access to beta registration records is limited to authorized TOSTA administrators.

Uninvited beta registrations are reviewed or deleted no later than 12 months after the beta begins, unless consent is renewed or another justified retention requirement applies.

7. AI PROCESSING

TOSTA may use artificial intelligence technologies to interpret user requests and generate responses.

User content is not sold and is not intentionally used to train public AI models without explicit consent.

8. DATA SECURITY

We implement reasonable technical and organizational safeguards designed to protect user information from unauthorized access, disclosure, alteration, or destruction.

However, no method of transmission or storage is completely secure.

9. YOUR RIGHTS

Depending on your location, you may have the right to:

Access your information
Correct inaccurate information
Delete your account
Request data portability
Restrict certain processing activities
Withdraw consent for beta communications and request deletion of your beta registration record

To withdraw consent or request deletion of a beta registration record, email flow@tosta.app. Withdrawing consent does not affect processing that occurred before the withdrawal.

10. CHILDREN

TOSTA is not intended for children under 17 years of age.

We do not knowingly collect personal information from children.

11. INTERNATIONAL USERS

Your information may be processed in countries other than your country of residence.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time.

Material changes will be communicated through the application or website.

13. CONTACT

For questions regarding this Privacy Policy, contact:

Witty Vixen LLC
flow@tosta.app
www.tosta.app