Privacy policy
Last updated : 14 October 2026
This document describes the personal data processed by the tolus.app website and by the Tolus service, the purposes of that processing, its retention periods and the rights of the data subjects.
1. Data controller
Identity of the entity that determines purposes and means.
- Controller: Digitz, a French EURL (single-member limited liability company) with a share capital of €1,500, registered office 73 Cours Albert Thomas, 69003 Lyon, France, registered with the Lyon Trade and Companies Register under number 524 498 672, VAT number FR52524498672. Publication director: Abdeslam Aourik.
- Contact for data-related questions: hello@tolus.app, with GDPR in the subject line.
- Data protection officer: none is appointed, the provider being a small structure; requests are handled at the address above.
- Reminder of roles: for the data of users invited by an agency, the agency is the controller and the provider the processor (see the DPA); this policy covers the processing for which the provider is the controller.
2. Data collected
Categories of data processed, by source.
- Account data: email address, display name and role in the organization.
- Organization data: agency name, settings (hours per day, work types, locale), projects and retainers.
- Usage content: tickets, comments, internal notes, attachments, logged time, notifications.
- Billing data: Stripe customer and subscription identifiers, payment history; card data is collected and stored by Stripe only.
- Technical data: IP address, sign-in and error logs, user agent, kept for 12 months.
- Public website tolus.app: static pages, with no cookies or trackers. If you submit the sales form, Tolus stores your name, email, optional company, subject and message to answer your enquiry. The hosting provider’s server logs remain separate.
- Signed-in support form: category, subject and message, together with the name, email and organisation linked to your account. Requests are personal and are not automatically shared with colleagues. A one-way fingerprint of the IP address helps limit abusive submissions; requests do not store the raw IP address.
3. Purposes
Why the data is processed.
- Delivering the service: magic-link authentication, organization management, tickets, retainers and reports.
- Optional writing assistance: correcting, clarifying or shortening the text requested by the user, with Mistral AI. Optional import assistance: suggesting how a retainer tracking sheet imported by the agency maps to Tolus, with Mistral AI.
- Transactional email: sign-in, invitations, ticket notifications, lifecycle emails (welcome, trial ending, payment failure, cancellation).
- Billing and subscription management.
- Security, abuse prevention and logging.
- Support and customer relationship: answering sales enquiries and requests sent from the signed-in workspace or by email at hello@tolus.app. Requests are accessible to authorised Tolus administrators. Notification emails contain only a reference and a protected link to the back office, not the submitted message. Submitting a request does not subscribe you to a marketing list.
- Compliance with legal obligations (accounting, legal requests).
- No analytics are carried out: no advertising tracker and no audience measurement tool. No marketing prospection is carried out from the service data.
4. Text shared with writing assistance
The feature remains optional and does not run while you simply type.
- Only the selected text, or the draft text when nothing is selected, is sent with the language and writing instruction. No project history or attachment content is loaded automatically.
- The text may contain personal data you entered, including in an internal-note draft. Choose only the relevant passage and avoid secrets, access credentials and sensitive data. The result comes back as a suggestion to review, without automatic publication.
- A technical log tracks calls by organization and user: date, model, command, call outcome, duration, token counts and estimated cost. It stores neither the requested text nor the suggestion. The account identifier allows authorized administrators to identify who made the call; this link is removed when the account or organization is deleted. This log is used to monitor operation and costs, not for audience measurement or advertising.
- The inference region does not guarantee that Mistral AI retains no data. Retention of requests and responses depends on the terms and settings of the API service used, including its abuse-prevention controls. Tolus does not promise immediate deletion or zero data retention.
- Using this assistance does not grant permission to use tickets, drafts or responses to train a model. Permission concerning the public website does not extend to private content.
5. Legal bases
Basis for each purpose (GDPR article 6).
- Performance of the contract: delivering the service, transactional email, billing.
- Legitimate interest: security of the service, abuse prevention and technical monitoring.
- Legal obligation: retention of invoices and accounting records.
- Consent: no processing relies on consent, as the service only sets strictly necessary cookies.
6. Retention periods
One period per data category.
- Account and organization data: for the duration of the subscription, then 90 days after termination before permanent deletion, with warning emails 30 days and 7 days before deletion.
- Usage content: same rules as the organization; the retention period does not depend on the plan.
- Billing data: 10 years, under accounting obligations.
- Technical logs: 12 months.
- Backups: 30 days; deleted data leaves the backups at the end of this rotation.
7. Your rights
Rights of data subjects and how to exercise them.
- Rights of access, rectification, erasure, restriction, portability and objection; right to give instructions about the fate of data after death where applicable.
- Exercise: by email to hello@tolus.app, with GDPR in the subject line, answered within one month (GDPR article 12).
- Users invited by an agency: requests may be addressed to the agency acting as controller; the provider assists under the DPA.
- Complaint to the supervisory authority: the CNIL (cnil.fr), the French data protection authority.
8. Recipients and subprocessors
Who has access to the data.
- Authorized staff of the provider: only the people who need access to the data to run and maintain the service.
- Hosting: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, telephone +49 89 3564717 70 (contabo.com), servers located in Germany (European Union).
- Payments: Stripe, Stripe Payments Europe Ltd, Ireland.
- Email: Resend.
- Optional writing and import assistance: Mistral AI, a company established in France, called only when the user chooses a writing command or asks for import assistance on a tracking sheet.
- Error monitoring: Sentry, only if the tool is enabled on the service.
- Third-party tools and agents connected by a client agency: when the agency connects such a tool, the data of its projects is transmitted to it at the agency’s initiative and under its responsibility; that third party is not a subprocessor of the provider.
- Authorities: only upon a legally grounded request.
9. Transfers outside the European Union
Location and safeguards.
- Primary hosting: Germany (European Union), with Contabo GmbH.
- Resend may process data outside the European Union; those transfers are governed by the European Commission standard contractual clauses. Writing assistance uses Mistral AI’s European endpoint (api.eu.mistral.ai), with inference in the European Union or EFTA. This choice does not guarantee the location of the provider’s account data, billing data or other technical metadata. Any Mistral AI transfers outside countries recognized as adequate are subject to the safeguards in its data processing agreement, including standard contractual clauses.
11. Security
Protective measures, consistent with the DPA annex.
- Encrypted connections (HTTPS), authentication by password or through single-use, time-limited links, isolation per organization, role-based access control, rate limiting on sensitive sends.
- Backups: one daily database snapshot is kept for 30 days on the service’s persistent volume. It is not encrypted at rest and no off-server copy is currently claimed.
- Notification in case of a data breach: without undue delay and at the latest 72 hours after becoming aware of it, by email to the owner of the account concerned; see the DPA for agencies.
12. Changes to this policy
Evolution of the document.
- Informing users of substantial changes: email to the owner at least 30 days before they take effect; continuing to use the service counts as acceptance.
- Version date shown at the top of the page.
13. Contact
For any question about this policy.
- hello@tolus.app, with GDPR in the subject line, Digitz, 73 Cours Albert Thomas, 69003 Lyon, France.