Privacy Policy

When our customers, managed service providers and similar organizations, use the Service, they decide what data they submit and why. For that data, the customer is the controller and Toolqit acts as a processor (or service provider) on the customer’s behalf, governed by our Terms and any data processing agreement. This Policy describes our own practices, including the information we collect when you visit our website, create an account, or communicate with us.

• Account information: name, work email, organization, role, and credentials you provide when you register or are invited.
• Phone numbers: a mobile number you provide if you enable SMS-based two-factor authentication or text notifications, used solely to deliver those messages.
• Voice input: when you use voice dictation to compose a reply, the app accesses your device microphone and streams the audio to our speech-to-text provider, acting as our subprocessor, to transcribe it into text. The feature works only after you grant microphone permission through the standard system prompt of whatever medium you are using, such as your mobile operating system or web browser, and you can revoke that permission at any time in its settings. We retain only the resulting text as part of your message; the audio recording itself is not stored.
• Customer Data: tickets, messages, attachments, contact details, and other content that you or your end users submit to the Service. We process this data solely to provide the Service, as described in our Terms.
• Usage and device data: log data, IP address, browser and device type, pages viewed, and actions taken, collected automatically when you use the Service or our website.
• Cookies and similar technologies:used to keep you signed in, remember preferences, and understand how the Service is used.
• Communications: information you share when you contact support, request a demo, or respond to a survey.

We use personal information to:

• provide, maintain, secure, and improve the Service;
• authenticate users, prevent fraud, and enforce our Terms;
• respond to support requests and communicate with you about the Service, including service and security notices;
• analyze usage in aggregate to understand and improve performance; and
• comply with legal obligations and protect our rights.

The Service uses AI models to draft replies, classify tickets, and run automations. We do not sell Customer Data, and we do not use Customer Data to train third-party AI models. Where AI providers process content to deliver a response, they act as our subprocessors under contractual terms that prohibit using that content to train their own models.

Toolqit connects to Google services only when a customer administrator or technician chooses to connect them, and each connection can be revoked at any time.

• Google Workspace administration: a managed service provider may link a client’s Google Workspace tenant to Toolqit so that its technicians can service that client’s users from the help desk. Access is granted by a super administrator of that tenant through Google’s domain-wide delegation to Toolqit’s service account and is limited to the scopes that administrator approves. Through the Google Admin SDK, Toolqit reads user, group, organizational unit, domain, license, and sign-in audit information for the linked tenant, and performs only the administrative actions a technician explicitly approves inside a ticket, such as resetting a password, suspending or restoring an account, resetting two-step verification, changing group membership, assigning a license, or transferring a departing user’s Drive files and Calendar events to a colleague. Every action is written to an audit log recording which technician approved it, when, and on which account.
• Google Calendar: a technician may connect their own Google Calendar so that Toolqit can show their availability and schedule meetings with customers on their behalf. Toolqit reads free/busy information and creates or updates calendar events only for that technician.

We use Google user data solely to provide these features to the customer that connected the account. We store the connection itself, the directory details needed to display linked accounts inside a ticket, and the audit log of actions taken. Temporary passwords and backup codes generated during an action are shown once to the technician and are not retained. We do not sell Google user data, do not use it for advertising, share it only as described in Section 6, and never use it to develop, improve, or train artificial intelligence or machine learning models. Where an AI feature summarizes account information inside a ticket, it processes that information only to produce the requested output, as described in Section 4.

Toolqit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Toolqit’s access at any time from the Google Admin console for a Workspace tenant, or from your Google Account permissions page for a personal connection. When a connection is removed, we delete the stored connection and any cached directory data associated with it; audit-log entries are retained as described in Section 9.

We do not sell personal information. We share it only:

• with subprocessors and service providers who help us operate the Service, under written confidentiality and data-protection terms;
• with your organization and the users it authorizes within the Service;
• with the integrations and PSA, RMM, or email systems you choose to connect;
• when required by law, legal process, or to protect the rights, safety, and security of Toolqit, our customers, or others; and
• in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Our current subprocessor list is published on our Trust Center.

Text messaging originator opt-in data, consent, and mobile phone numbers will not be shared with or sold to third parties or affiliates for marketing or promotional purposes. Mobile numbers are shared only with our SMS delivery provider, acting on our behalf, solely to deliver the messages you have requested.

If you enable SMS-based two-factor authentication or text notifications, we send transactional security messages, such as one-time passcodes and account notifications, to the mobile number you provide. You opt in inside the application by entering and verifying your mobile number; this is the only way to enroll, and no marketing messages are sent. Message frequency varies based on your account activity. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. As stated above, mobile phone numbers and SMS consent are never shared with or sold to third parties or affiliates for marketing purposes.

We have engaged a third-party provider to help us build a set of controls aligned with the HIPAA Security and Privacy Rules and SOC 2 (Security, Availability, Confidentiality). Our commitments include encryption of data at rest (AES-256) and in transit (TLS 1.2+), role-based access on a least-privilege basis with SSO and MFA, vulnerability scanning and annual external penetration testing, centralized logging and monitoring, and a documented incident and breach response program. Where Toolqit handles Protected Health Information on a customer’s behalf, we intend to act as a Business Associate under a separately executed Business Associate Agreement.

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Customer Data is retained for the duration of the subscription; following termination, we make Customer Data available for export for thirty days before deletion. Logs are retained for at least thirteen months.

We are based in the United States and may process and store information there and in other countries where we or our subprocessors operate. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for cross-border transfers.

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, or to object to or restrict certain processing. Because much of the data we process belongs to our customers, requests about Customer Data are routed to the relevant customer; we assist them in responding. To exercise a right or ask a question, contact us using the details below. We will not discriminate against you for exercising these rights.

We may update this Privacy Policy from time to time. We will provide reasonable advance notice of material changes. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

Questions about this Privacy Policy or our handling of personal information may be directed to founders@toolqit.ai. For urgent matters, please mark the subject line URGENT; we will respond within one business hour on business days and within four hours otherwise.

Toolqit, Inc. · Effective September 23, 2026. The current version of this Policy is available at toolqit.ai/privacy.