Legal

Privacy Policy

Effective date: [EFFECTIVE DATE]

Toophan is a website builder for local businesses: you chat with an assistant, it fills a finished design with your words and photos, and your site goes live on its own address. This policy says what personal information that involves, who handles it, and what you can ask us to do about it.

1. Who we are and what this covers

Toophan is operated by [LEGAL ENTITY NAME], of [BUSINESS ADDRESS] (“we”, “us”). This policy applies to the Toophan website, the builder (the chat, the preview, the dashboard and the publishing tools) and the sites we host for our customers. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.

“You” means the person who creates an account to build a site (the “owner”). “Visitors” means people who visit a published site and, for example, send a message through its contact or booking form.

2. Two roles: our data and your visitors’ data

We act in two different roles, and the difference matters for who is responsible to whom.

• Your account and your use of the builder. We decide why and how this information is used, so we are responsible for it. This is the information in sections 3 to 5 about you and your business.
• Your visitors’ information. When a visitor fills in a form on your published site, the visitor is dealing with your business. You decide why that information is collected and what you do with it. We store and deliver it on your behalf, and we do not use it for our own purposes. You are responsible for telling your visitors what you do with it (see section 6).

3. What we collect

4. Why we use it

• To create and run your account and sign you in.
• To run the assistant, fill your chosen design, show previews, and publish, update, roll back or unpublish your site.
• To store your photos and generate photographs for photo slots you have not filled.
• To deliver form submissions to your inbox in the builder and, when email is switched on, to your email address.
• To take payment, manage your subscription and keep the records the law requires.
• To send you account and billing emails about your site’s plan, such as a payment problem, a plan ending, and the site coming back online.
• To keep the service secure, stop abuse and spam, fix faults and answer your questions.
• To meet legal obligations.

We rely on your consent, given when you create an account and when you use a feature (for example by uploading a photo or asking for an import), and on what is needed to provide the service you asked for. You can withdraw consent at any time (section 9); some features cannot work without the information they need. We do not sell personal information. We do not use your content or your visitors’ information for advertising, and we do not ourselves use it to train AI models.

5. Who else handles it

We use the service providers below to run Toophan. Each receives only what its job needs. The AI providers are used through their programmatic (API) services; their own terms govern how long they hold what they receive and for what purposes.

If we route AI requests through an AI gateway service, that gateway also handles the same requests. We will tell you if our providers change in a way that matters. A current list is always available from the contact in section 15.

We may also disclose information to a professional adviser, in a sale or reorganisation of the business (with the same protections continuing), or when the law or a court requires it.

6. People who visit a published site

If you are a visitor: the business that owns the site decides what to do with what you send through its form. We store it and pass it to that business. To see, correct or delete it, contact the business directly; if you cannot reach it, contact us and we will pass the request on. We do not store your IP address with your message; we keep only a salted one-way hash of it, in a short-lived counter deleted within about two days, to limit spam. One third party sees your IP address because your browser fetches resources from it when you load a site: Cloudflare (which delivers published sites, including their images and the fonts the design uses, and protects them from abuse, and runs a bot check on forms where it is switched on). Fonts are served from the site’s own address, not from Google. A published site’s images are served by our own server through Cloudflare; your browser never contacts our storage provider for them. We do not add analytics, advertising or tracking scripts to published sites.

The site assistant. A published site can show an AI assistant that answers visitors’ questions. The owner can switch it off from the builder. Its first message tells the visitor that it is an AI assistant that can only answer from the website. When a visitor sends it a message, the message and the earlier messages of that conversation are sent, with a short summary of the business’s published information, to our AI providers (OpenRouter and, behind it, the model provider, Anthropic) so a reply can be written. We do not store the text of the conversation on our servers; the visitor’s browser keeps it for that tab only (browser session storage, which is cleared when the tab is closed) so the conversation can continue. We keep only the record described in section 3. The assistant is not a person and does not give medical, legal, tax or financial advice. Visitors should not type health, financial or other sensitive details into it. If the visitor asks to be passed to the business, or the assistant offers it and the visitor accepts and sends the short form it shows, that message goes to the business owner’s inbox in the builder and, where email is switched on, to the owner’s email address, exactly like a contact form submission. Because our AI providers are outside Canada, a visitor’s messages to the assistant are communicated outside Canada (section 7). As with forms, the business that owns the site decides what to do with what its visitors send; we process it for that business.

For counsel: confirm the wording on cross-border transfer of visitors’ assistant messages (PIPEDA and Law 25 privacy-risk assessment), whether the in-chat disclosure is enough notice and consent for visitors in Quebec, and what the AI providers’ own terms say about how long they keep what they receive. We have not stated any retention period for them here because we cannot confirm one.

If you are an owner: you are responsible for your own visitors. In practice that means:

• Publish a privacy notice on your site that says what you collect through its forms, why, who handles it (including that we store it and may email it to you, and that, if you leave the site assistant on, visitors’ messages to it are processed by AI providers outside Canada), and how to reach you. The designs do not add one for you.
• Collect only what you need, use it only to answer the request, and do not add visitors to a marketing list without their consent (Canada’s anti-spam law applies to commercial messages).
• Answer visitors’ access, correction and deletion requests; ask us if you need us to delete a submission.
• Tell us promptly if a breach affects your visitors’ information so that we can meet our shared reporting duties.

7. Outside Canada

Most of the providers in section 5 operate in the United States, and some process information in other countries. Our database and files are hosted in: [DATA HOSTING REGION]. When information is processed outside Canada it is subject to the laws of that place, which may allow courts, law enforcement and national-security authorities to access it. We require our providers to protect it, but we cannot promise the protection that Canadian law gives. Where Quebec law applies, we assess privacy risks before communicating personal information outside Quebec (section 11). Using the builder means you accept this processing; if you do not, please do not use it.

8. How long we keep it

We keep information for as long as your account exists and as needed to provide the service. In particular:

• Chat history, drafts, uploaded and generated photos, and form submissions are kept until you delete your account (section 9) or ask us to delete them. Unpublishing a site takes it offline; it does not delete the project, its earlier versions, or its submissions.
• Every published version of a site is kept as a frozen record so you can roll back. Older versions stay until the project is deleted.
• Generated photos that fail our checks are deleted straight away. Duplicate uploads are not kept twice.
• Billing records are kept as long as tax and accounting law requires (generally six years for Canadian businesses), even after you delete your account; they include your email address, account ID, plan and subscription history. Our payment and sign-in providers keep their own records under their own policies.
• We do not yet run an automatic deletion schedule. You can delete your whole account yourself at any time (section 9). For anything else, deletion is done on request (section 9), and we will carry it out within 30 days of confirming the request.

9. Access, correction and deletion

You may ask us at any time to:

• tell you what personal information we hold about you and how we use it, and give you a copy;
• correct information that is wrong or out of date;
• delete individual projects, uploads or submissions, or your whole account, subject to what we must keep by law;
• stop using your information for a purpose you consented to, or withdraw your consent;
• ask a question or make a complaint about how we handle your information.

Write to [CONTACT EMAIL] from the email address on your account. We may need to confirm who you are first. We aim to answer within 30 days, and will tell you if we need longer or cannot fully comply and why. There is no charge for ordinary requests. You can edit your own business content and take your site offline yourself from the builder.

Deleting your whole account yourself. On your dashboard, “Delete my account” (you confirm by typing DELETE) takes every site you published offline, disconnects any domain you connected, and permanently deletes all your projects with their chat history and published versions, the photos you uploaded and the ones we generated, and the form submissions visitors sent you, and then closes your sign-in account. If you have a paid plan, it is cancelled with our payment provider first, so you are not charged again (we do not promise a refund for time already paid); if that cancellation fails, nothing is deleted and you can try again. This cannot be undone. What stays: our billing records (section 8), and whatever our payment and sign-in providers keep under their own policies. If you delete your sign-in account from the sign-in provider’s own pages instead, our systems are notified and run the same removal of your projects, photos and submissions, after cancelling any paid plan the same way. If part of the removal fails you are told, and you can run it again; it continues where it stopped.

10. Security

We protect information with measures that fit how sensitive it is: owner uploads sit in a private storage bucket and are shown only to their owner through short-lived links, while photos that appear on a site you have published are fetched by our own server and served from it, so the storage address never reaches a visitor’s browser; our application database is closed to public access and every request is checked against the signed-in owner; metadata including GPS location is stripped from uploaded photos; form submissions pass through spam checks and rate limits; secrets are kept out of the code; and traffic is encrypted in transit. No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada (and, where Quebec law applies, to the Commission d’accès à l’information), notify the people affected, and keep a record of it.

11. Quebec (Law 25)

If you or your visitors are in Quebec, these points also apply:

• The person in charge of protecting personal information is our [PRIVACY OFFICER TITLE], reachable at [CONTACT EMAIL].
• We ask for consent in clear and simple terms, for each purpose, and you can withdraw it. Information we collect only to provide a feature you asked for is not used for another purpose without asking you first.
• Before communicating personal information outside Quebec we assess the privacy risks and the protection the destination offers (section 7).
• We keep a register of confidentiality incidents and report those that present a risk of serious injury to the Commission d’accès à l’information and to the people affected.
• You may ask for your information in a structured, commonly used technology format, and ask that information about you which is no longer needed be deleted, or that a link to it be removed (de-indexed) where the law allows.
• We do not make decisions about individuals based exclusively on automated processing of their personal information. The builder’s assistant writes content for owners to review. The site assistant only answers questions from the site’s published information or offers to pass a message to the business; it does not decide anything about visitors.
• No technology we use identifies, locates or profiles individuals.

Owners with visitors in Quebec carry the same duties for their own sites (a privacy notice, a person responsible, and incident handling).

12. Children

Toophan is a business tool for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 when they create an account. If you believe a child has given us information, contact us and we will delete it.

13. Cookies and tracking

The builder uses cookies and similar storage that our sign-in provider sets so that you stay signed in and so that sign-in is secure. We do not use advertising cookies, analytics or session-recording tools on this website, in the builder or on published sites, and we do not add cookies to published sites ourselves. The site assistant, when a visitor uses it, keeps that conversation in the visitor’s browser session storage for that tab only; it is not a cookie and is cleared when the tab is closed.

14. Changes to this policy

We may update this policy as the product or the law changes. We will post the new version here with its effective date, and tell account holders by email or inside the builder before a change that materially affects how we use their information takes effect. Using the service after that date means you accept the update, except where the law requires fresh consent.

15. Contact and complaints

[LEGAL ENTITY NAME]
[BUSINESS ADDRESS]
[CONTACT EMAIL]

If we have not resolved a concern, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

This document is a draft prepared for review by a lawyer. It is not legal advice and it does not take effect until the owner-supplied details above are filled in and counsel has approved it.