Last updated October 21, 2026. This policy explains what information Toodlebox collects, how we use it, and the choices you have. It also covers how our AI features handle your company's data.
Toodlebox is a governed AI platform that runs inside Microsoft Teams, built and operated by Toodlebox. This policy applies to our website (toodlebox.com), our assessment and consulting services, the Toodlebox AI platform, and our legacy mobile platform for long-standing customers.
Information you give us. When you contact us, book an assessment, or take part in an AI Tools Assessment, we collect the details you provide: name, work email, company name, team size, and anything you tell us about your environment and workflows.
Platform content. If your organization runs Toodlebox, the platform processes the content your organization chooses to connect: messages, forms, documents, and the structured company information that powers your Company Brain. This content belongs to your organization. It is stored in your organization's own hosting environment - your own cloud space or on-site hardware - not on Toodlebox-owned web infrastructure.
Legacy mobile platform. Long-standing customers of our mobile platform have their data stored on infrastructure we operate and manage. Every protection in this policy applies to that data equally - the only distinction is that the hosting is ours rather than yours. On the Toodlebox AI platform, hosting stays in your environment, as described above.
Usage data. Like most websites, we collect standard technical data when you visit: pages viewed, browser type, approximate location derived from IP address, and referring pages. Within the platform, we keep operational logs and audit records of AI and user actions - this is a built-in governance feature that your administrators control.
We use the information we collect to:
- Respond to inquiries and deliver assessments, proposals, and services
- Operate, maintain, and support the Toodlebox platform for your organization
- Operate AI features you have enabled, such as Company Brain and Daily Briefing, under your configuration and access rules
- Maintain security, enforce role-based access controls, and keep audit trails
- Understand how the platform and website are used, and improve them
- Meet legal and contractual obligations
We do not sell personal information. We do not use your contact details or your platform content for advertising.
AI is what we do, so we hold it to a stricter standard than a standard privacy policy would require:
We do not train on your data. We do not use your company's content or personal information to train foundation models or any shared or general-purpose AI model, and we never will without your explicit agreement. (What third-party providers do with content sent to them is covered below.)
Your data stays in your environment. Toodlebox runs in your own cloud space or on-site hardware. The content your organization feeds the platform - and what the AI produces from it - lives in your environment, under your control, permanently.
Governed by design. Every AI action runs against role-based access controls and is captured in an audit trail. Bots only do what they are allowed to do. Your administrators decide what information the AI can see, and who can see AI output.
Third-party AI providers. Which third-party AI services and infrastructure your deployment uses is your organization's choice to make and manage. Those providers handle content sent to them under their own terms of service and privacy policies. We do not control what third-party providers do with your content - including whether they train on it - so we recommend reviewing each provider's policies before you connect it.
Local AI option. Your deployment can also run local AI entirely on your organization's own infrastructure, using open-source LLM runtimes such as Ollama or vLLM. In that case no third-party provider is involved: content does not leave your environment, and the model- and training-related concerns above are mitigated.
Assessment work. Information gathered during an AI Tools Assessment is used to produce your assessment and implementation plan. It is not used to build products for other customers or shared outside the Toodlebox team delivering your work.
Our website uses Google Analytics to understand traffic and usage, and similar technologies to make the site work. You can block or delete cookies in your browser settings; the site remains usable. We do not run advertising or cross-site tracking cookies.
We keep this simple: we do not run your data through a chain of service providers. When you contact us, your message comes to us. When your organization runs Toodlebox, your content stays in your own hosting environment - your organization's VM or hardware - and we do not share it with anyone.
We do not add third-party analytics, advertising trackers, or data-collection tools to the platform. The platform does keep audit logs of system and AI activity, however - logging is part of the platform's governance, controlled by your administrators and kept in your environment. We may still disclose information if required by law, or to protect the rights, property, or safety of Toodlebox, our customers, or the public.
We keep website and business contact information only as long as needed for the purposes above, or as required by law. Platform content is governed by your organization's retention decisions and your agreement with us. On the Toodlebox AI platform, your data lives in your environment, so deleting your deployment removes your content. For legacy mobile platform customers, we remove data from our infrastructure when your account closes, or earlier on request - subject to legal retention requirements.
We apply layered technical and organizational safeguards: encryption in transit and at rest, role-based access control, audit logging, and least-privilege access for the Toodlebox team. No system is perfectly secure, but security and governance are the core of our product, not an afterthought. If a data incident affects your information, we will notify you as required by law and without undue delay.
You may ask us to access, correct, export, or delete the personal information we hold about you, and you may object to or restrict certain processing. Depending on where you live (including under US state privacy laws or the EU/UK GDPR), you may have additional rights. To exercise any right, contact us using the details below. If your organization runs Toodlebox, your organization's administrators are the primary controller of your workspace content, and we will support them in fulfilling your requests.
We will not discriminate against you for exercising your privacy rights.
Toodlebox is built for businesses. We do not knowingly collect information from children under 13 (or under 16 in the EEA/UK). If you believe a child has provided us information, contact us and we will delete it.
We may update this policy as our services or the law change. Material changes will be noted on this page with a new "last updated" date, and for platform customers we will provide notice through your administrator or directly when required.
Questions or privacy requests? Reach us at:
Email: sales@toodlebox.com
Website: toodlebox.com/contact