Privacy Policy

Last updated: September 9, 2025

Tovee.AI is owned by Cytisum Digital Consulting Inc.
Cytisum Digital Consulting Inc. is the controller for this website.

This Policy explains how we collect and use personal data.
Please read it before using the site or the service.

We respect your privacy.
We use safeguards that are reasonable for our size and risk.

Scope

This Policy covers the tovee.ai website and service.
The service lets you create an MCP endpoint.
You may connect Gmail, Google Calendar, Slack, or WhatsApp.
You control which tools you expose to AI models.

What we collect

Device data. We collect IP address, browser type, time zone, and cookies.
We also collect pages viewed and referrers.

Account data. If you register, we collect your email and profile details.
We may collect your name and billing data if you buy a plan.

Service data. We store MCP endpoint metadata.
We store tool configuration and usage counters.
We store audit hashes for tool calls, not message content by default.

Connected app tokens. We store OAuth tokens you authorize.
We encrypt tokens at rest using envelope encryption.
We do not read your content unless a tool call needs it.
We cache only what is needed to run the call.

Support data. If you contact us, we receive the data you send.

We do not collect sensitive personal data on purpose.
Please do not send us sensitive data.

How we use data

We use data to provide and improve the service.
We authenticate users and secure accounts.
We run tools you enable for your endpoint.
We measure usage and enforce plan limits.
We detect abuse and prevent fraud.
We provide support and billing.
We comply with law.

We do not sell personal data.

Legal bases for EEA and UK users

We process data to perform a contract with you.
We process data for our legitimate interests.
We process data to comply with legal duties.
We ask for consent where required.

Your responsibilities

You choose which apps to connect.
You choose which scopes to grant.
You decide which tools to expose.
You are responsible for your API keys.
You must protect your credentials.
You must review outputs before sending.
You must follow the terms of each connected app.

Security

We use encryption at rest for secrets.
We use transport encryption in transit.
We apply access controls and logging.
We limit egress to needed providers for the MVP.

No security method is perfect.
We cannot guarantee absolute security.
You use the service at your own risk.

Third parties and no liability for them

Our service connects to third party platforms.
Examples include Gmail, Google Calendar, Slack, and WhatsApp.
Those platforms process your data under their own policies.
We do not control them.

We are not responsible for their acts or omissions.
We are not responsible for your account settings on those platforms.
We are not responsible for any breach or exposure on those platforms.
You must review and accept their terms and privacy policies.

Sharing

We use vendors to host and operate the service.
We share personal data with vendors only as needed.
We require vendors to protect the data and follow the law.

We may disclose data if required by law.
We may disclose data to protect our rights or users.
We may disclose data to investigate fraud or abuse.
We may disclose data during a merger or sale.

We will not share your content with AI model providers.
You connect our endpoint to your AI client yourself.

International transfers

We may transfer data to Canada, the United States, and other regions.
We use safeguards that the law allows for such transfers.

Data retention

We keep data for as long as needed for the service.
We keep logs and audit hashes for a limited period.
You can ask us to delete your account.
We may keep some data to meet legal duties.

Your rights

Your rights depend on your region.
These may include access, correction, deletion, and portability.
You may object to processing.
You may withdraw consent where we rely on consent.

To exercise rights, contact info@cytisum.com.
We may ask you to verify your identity.

EEA and UK users can lodge a complaint with a supervisor.
You can also contact the Office of the Privacy Commissioner of Canada.

Cookies and similar tech

We use cookies to run the site.
We use analytics to understand usage in aggregate.
You can control cookies in your browser.
Some features may not work without cookies.

Children

The service is not for children under 16.
We do not knowingly collect data from children.

Links

The site may link to other websites.
We are not responsible for their privacy practices.

Changes

We may update this Policy from time to time.
We will post the new date at the top of this page.
Material changes will be noted in the product or by email.

Contact

For questions or requests email info@cytisum.com.
Mailing address available on request.