Privacy Policy.

We collect personal data that you voluntarily provide to us, as well as data collected automatically when you use our website.

A. Information you provide directly

• Identity & contact data: name, email address, phone number, business name, job title.
• Project data: project briefs, brand assets, content, business goals, and any other information you share during consultations or via intake forms.
• Payment data: billing information processed securely by our third-party payment processors. We do not store full credit card numbers on our servers.
• Communications: messages, feedback, and correspondence you send to us.

B. Information collected automatically

• Device & usage data: IP address, browser type, operating system, referring URLs, pages visited, time on page, and click patterns.
• Cookies and similar technologies: see section 8 below.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• Performance of a contract: when processing is necessary to provide services you have hired us to perform.
• Consent: for marketing emails, non-essential cookies, and any optional data you choose to provide. You may withdraw consent at any time.
• Legitimate interests: for things like securing our website, preventing fraud, and basic analytics — where our interests are not overridden by your rights.
• Legal obligation: when we must process data to comply with applicable laws.

We are a globally distributed agency. Your information may be transferred to, stored, and processed in countries other than your own, including the United States and the European Union. When we transfer personal data across borders, we use appropriate safeguards as required by applicable law, including:

• European Commission’s Standard Contractual Clauses (SCCs).
• UK International Data Transfer Agreement (IDTA).
• Data Processing Agreements (DPAs) with all subprocessors.
• Reliance on adequacy decisions where applicable (e.g., EU-US Data Privacy Framework for certified recipients).

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — request deletion of your personal data.
• Restriction of processing — limit how we use your data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — at any time, where processing is based on consent.
• Opt-out of sale or sharing(CCPA/CPRA) — we do not sell personal data, but California residents may still submit opt-out requests to confirm.
• Non-discrimination— we will not deny service or charge different prices for exercising your rights.

To exercise any of these rights, contact us at privacy@toolanta.com. We will respond within 30 days (45 days under CCPA, extendable where permitted).

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, regular backups, and restricted employee access on a need-to-know basis. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Our services are not directed to individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us so we can delete it promptly.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the details below.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. For EU/UK residents, you can find your supervisory authority at edpb.europa.eu.