Privacy
policy.

Data processed through the toolty.io website is under the responsibility of Phenomain LLC, a Delaware limited liability company, 8 The Green, STE R, Dover, DE 19901, United States, the publisher of the website (legal notice).

For any question about your data: toolty@phenomain.com

With most tools, your files are never sent to us: we know neither their names nor their contents. Each tool's page says when that is not the case.

When a tool has to process a file on our servers, the file is sent over an encrypted connection, encrypted at rest, and automatically deleted no later than one hour after processing, unless you are a subscriber and explicitly ask for it to be kept.

If, as a subscriber, you choose to save a work session to resume it later, that session's files are kept securely, encrypted at rest, for as long as your subscription is active. When it expires, they can no longer be reopened, then are deleted after a thirty-day grace period. You can delete a saved session at any time.

Artificial intelligence tools send the file you give them to a model provider, through its programming interface, solely to produce the result you asked for.

We don't look at your files, we don't sell them, and we never use them to train a model.

• Account. If you create one: your email address and, if you sign in with Google, the name and address Google passes on to us. No password: you sign in with a one-time code sent by email, or with Google.
• Subscription and payments. Your plan, its dates, the amount and currency of each payment, and your AI credits. Card details are entered on Stripe, or on KPay's payment page, and never reach us; mobile money payments are handled by KPay.
• Usage counting without an account. To apply the limits of the free plan, a randomly drawn identifier stored in a cookie, combined with your IP address hashed with a key renewed every day. No browser fingerprint, no plain IP address.
• Activity statistics. For each tool, the number of operations and files processed, added up per day. These totals keep no account, no visitor, no file name or content: they say how many, never who.
• Tool usage, with an account. When you are signed in: the tools you use, with, for each day, the number of operations and files processed. Never the name, contents or fingerprint of a file. This record is used for support and to run the service; it is neither sold nor passed on to an ad network.
• Job history, Pro subscribers. If you are a Pro subscriber and leave it on: for each result delivered, the tool, the date, and the name, size and format of the files processed. Never their contents. It is only used to show them to you in your account; you can turn it off, delete one entry or all of them.
• Country, for the price currency. To show prices in your currency, your IP address is matched, on our servers, against a country database (MaxMind's GeoLite2). Only the country is derived; neither the address nor the country is kept. A currency you pick yourself takes precedence. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.
• Measurement and advertising, with your consent. If you accept them in the cookie banner: the pages viewed, the tools opened (their name only) and the steps of a sign-up or purchase, with the identifier of Google, Meta and TikTok cookies, your IP address and your browser. So that an ad network can recognize the sign-up or purchase that follows its ad, we also send it your email address — and, for a DV lottery photo order, your phone number, name, city and country — in hashed form, which cannot be read. Never the name, contents or metadata of a file.
• Technical logs. Like any server, ours record connection data (IP address, date, requested address), for the security of the service and to diagnose failures.
• Correspondence. The messages you write to us, and whatever you choose to put in them.

• Providing the service, running your account and subscription, sending the emails they require (sign-in codes, receipts, renewal notices): performance of our contract with you.
• Keeping our accounts and answering to the authorities: legal obligation.
• Applying the limits of the free plan, protecting the service against abuse and attacks: legitimate interest.
• Measuring the website's audience and the effectiveness of our ads: your consent, which you can withdraw at any time.

No ads on the website, no sale of data. Your files are never used for measurement or advertising.

Each one receives only what its task requires:

• Hostinger — server hosting.
• Cloudflare — file storage for the duration of server processing, and for the sessions subscribers choose to save.
• Neon — database (accounts, subscriptions, credits).
• Brevo — email delivery.
• Stripe — card payments.
• KPay — mobile money payments, and card payments in mobile money countries.
• Google — sign-in with Google, if you choose it; address suggestions in the contact form, based on what you type there.
• Google, Meta and TikTok — audience measurement (Google Analytics) and measurement of our ads (Google Ads, Meta, TikTok), only if you accept them. Each processes this data under its own policy: Google, Meta, TikTok.
• AI model providers — only for the AI tools you use; their current list is available on request.

Phenomain LLC is based in the United States, and several of our service providers process data outside the European Union. These transfers rely on the safeguards provided for by the General Data Protection Regulation, in particular the European Commission's standard contractual clauses.

• Files processed on our servers: one hour at most after processing.
• Saved sessions (subscribers): for as long as the subscription is active, then a thirty-day grace period before deletion.
• Account: for as long as it exists. You can delete it at any time from your account; its data is then erased.
• Payments: for as long as our accounting and tax obligations require.
• Usage counting: since the key that hashes IP addresses is renewed every day, a counter can no longer be linked to an address beyond that day.
• Tool usage per account: twenty-four months, then deleted; erased with the account.
• Job history: eighteen months, or three if you choose, then deleted; erased with the account.
• Measurement and advertising: your banner choice, six months; the advertising identifiers attached to a sign-up or purchase, ninety days on our side. Google, Meta and TikTok's own periods are listed on the Cookies page.
• Correspondence: for as long as needed to follow up on your request.

Every connection to the website is encrypted. No password is stored, since there are none. Your sign-in session lives in a cookie that page scripts cannot read, and files processed on our servers are encrypted at rest there.

You can access your data, correct it, erase it, restrict its processing, object to it, and receive a copy in a machine-readable format. Write to us at toolty@phenomain.com: we reply within one month.

You may also lodge a complaint with the data protection authority of your country, in France the CNIL.

Audience measurement and advertising trackers are only set with your consent, given or declined in the banner, and changeable at any time from the footer. What the website stores in your browser is detailed on the Cookies page.

This policy may change as the service evolves; the update date is shown at the top of the page. If a change affects how your data is processed, account holders are notified by email before it applies.