Privacy Policy

1. Scope and roles

This Policy covers website visitors, account holders, Team users, support contacts, and other people who interact with the Service. For account, website, billing, and support information, ToolsInVision generally acts as the business or controller. For personal information contained within a customer’s uploaded dataset, the customer determines the purpose and means of processing and ToolsInVision generally acts as its service provider or processor.

2. Information we collect

Information you provide

• Account information such as email address, authentication provider, password hash, verification status, and account role.
• Customer Data including images, video frames, annotations, classes, projects, comments, chat messages, review decisions, QA records, activity history, exports, and storage metadata.
• Team information including invitations, memberships, roles, permissions, seats, presence, ownership requests, and collaboration activity.
• Billing information such as plan, subscription status, seat quantities, transaction references, and customer identifiers. Full payment-card information is processed by Stripe and is not stored by ToolsInVision.
• Support requests, suggestions, correspondence, and information you choose to include.
• BYOS configuration and credentials you submit. Sensitive credentials are encrypted before storage where the feature is configured as designed.

Information collected automatically

• IP address, browser, device, operating system, user agent, timestamps, requested routes, and security events.
• Login history, recognized-device identifiers, failed attempts, session activity, and abuse-prevention information.
• Usage and operational information such as storage consumption, image counts, project actions, export status, errors, and feature interactions.
• When you accept optional analytics, Google Analytics receives website interaction information such as pages viewed, approximate location, device and browser details, referrer, and engagement events. Analytics remains disabled when you decline.
• When advertising is enabled on eligible public pages, Google AdSense may receive device, browser, IP address, page, cookie, consent, ad-impression, and ad-interaction information needed to select, deliver, measure, secure, and report advertisements. Availability and personalization depend on your location and privacy choices.
• Strictly necessary cookies and local browser storage used for sessions, CSRF protection, device recognition, preferences, recovery, and application state.

Social login

If you sign in with Google or GitHub, we receive the verified email address, provider account identifier, and authentication information necessary to create or connect your account. Those providers separately process information under their own privacy policies.

3. How we use information

• Provide image ingestion, annotation, tracking assistance, collaboration, review, QA, storage, billing, support, and exports.
• Create and authenticate accounts, verify email, reset passwords, manage sessions, recognize devices, and enforce permissions.
• Operate plans, quotas, seats, subscriptions, invoices, payment status, and fraud prevention.
• Monitor reliability, diagnose errors, prevent abuse, secure users and infrastructure, and investigate incidents.
• Respond to support, billing, privacy, and product-feedback requests.
• Improve usability, performance, and features using operational information and feedback.
• Display, measure, secure, and report advertisements in the free Vision & Media Tools experience when advertising is enabled.
• Comply with law, enforce agreements, protect rights and safety, and establish or defend legal claims.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use private Customer Data to train general-purpose models without explicit customer permission.

4. Legal bases

Where applicable law requires a legal basis, we rely on performance of our contract to provide the Service; legitimate interests in security, reliability, support, fraud prevention, and product improvement; consent where requested; and compliance with legal obligations. You may withdraw consent for future processing where consent is the basis, without affecting prior lawful processing.

5. How information is disclosed

We disclose information only as reasonably necessary:

• Service providers: infrastructure, cloud storage, database, email, authentication, payment, security, and support providers acting for us.
• Customer-directed services: storage or integrations selected and configured by the customer, including BYOS providers.
• Team workspaces: information is visible to authorized Team members according to role, project, review, chat, comment, and administrative settings.
• Legal and safety: where reasonably necessary to comply with valid legal process, enforce agreements, prevent fraud, protect the Service, or protect rights and safety.
• Business transfers: in connection with financing, acquisition, merger, reorganization, bankruptcy, or sale, subject to appropriate confidentiality and notice where required.
• With direction or consent: when you request or authorize disclosure.

6. Current service-provider categories

The Service currently uses providers that may include Render for application hosting; PostgreSQL-compatible database hosting; Cloudflare R2 and customer-selected S3-compatible services for media storage and generated exports; Stripe for payments; SMTP2GO for transactional email; Google Analytics for optional, consent-based website measurement; Google AdSense for advertising on eligible public pages for guests and Free-plan users when enabled; and Google and GitHub for optional authentication. Provider use may depend on your plan, consent, location, and chosen features. Providers process information under contracts and their own applicable privacy terms. We may replace providers while maintaining materially appropriate protections.

7. Dataset privacy and BYOS

Annotrack projects are intended to remain accessible only to authorized users and Team members unless a customer intentionally exports or shares data outside the Service. Customers control dataset content and must avoid uploading personal or sensitive information unless they have a lawful basis and suitable safeguards. With BYOS, the customer controls the external bucket and remains responsible for access policies, encryption, regions, retention, provider contracts, and deletion.

7A. Professional annotation-service data

When you request professional annotation, we process your contact and organization information, dataset name, requested classes, instructions, private cloud link, uploaded dataset or samples, quotation details, progress, payment references, revision request, delivery metadata, and service correspondence. Authorized ToolsInVision personnel and platform administrators may access this information only as needed to inspect samples, prepare a quotation, perform and review annotations, deliver files, support the order, prevent abuse, or meet legal obligations.

Direct service uploads are stored privately under service-specific storage keys and do not become Annotrack projects or count against Annotrack subscription storage. Private cloud links remain governed by the access settings you choose. Signed service links expire and must not be shared with unauthorized people. Delivered service files and eligible source uploads are scheduled for removal after the stated 30-day delivery-retention period; limited transaction, quotation, audit, and legal records may be retained longer where reasonably necessary.

8. International processing

ToolsInVision operates from the United States, and information may be processed in the United States and other countries where providers operate. Those countries may have different privacy laws. Where required, we and our providers use recognized transfer mechanisms and contractual or technical safeguards. Customers needing a data-processing agreement or specific regional commitments should contact support before uploading regulated data.

9. Retention

We retain account and Customer Data while the account or workspace is active and as needed to provide the Service. Users and authorized Team administrators can delete certain projects, images, annotations, and storage objects through available controls. After account closure or a verified deletion request, we delete or de-identify eligible active data within a commercially reasonable period. Residual copies may remain temporarily in backups until normal backup rotation completes.

Security, audit, review, support, billing, transaction, and legal records may be retained longer where reasonably necessary to prevent abuse, preserve workspace integrity, meet tax/accounting obligations, resolve disputes, or comply with law. We minimize retention when records are no longer required.

10. Security

We use measures designed to protect information, including TLS transport, password hashing, email verification, secure and restricted cookies, CSRF protection, rate limiting, session expiration, login monitoring, recognized devices, role-based permissions, encryption of supported stored credentials, and access controls. No system is perfectly secure. You must use a unique password, secure your email account, limit Team permissions, and report suspected compromise to security@toolsinvision.com.

11. Your rights and choices

Depending on location, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about disclosure. You may also have the right to appeal a denied request or complain to a regulator. We do not discriminate against users for exercising applicable privacy rights.

Submit a request to support@toolsinvision.com with “Privacy Request” in the subject. We will verify identity and authority before responding. Authorized agents must provide proof of authority. Rights are subject to legal exceptions and the rights of others. We respond within the period required by applicable law.

12. Cookies and browser storage

We use essential cookies and browser storage for login sessions, security, device recognition, OAuth state, CSRF protection, preferences, recovery, and core application functions. Blocking them may prevent the Service from working. Optional analytics and advertising technologies may use cookies or similar storage only when enabled and subject to applicable consent or opt-out controls. Advertising may appear on eligible public pages, including the homepage, Vision & Media Tools, AI Studio, published Learning Center content, and the public annotation-service information page. It is not placed inside private annotation projects, account or administration screens, or private professional annotation-service orders. The new reading courses are currently ad-free. We do not sell personal information. Available privacy controls depend on location and applicable law.

13. Children

The Service is intended for adults and business, professional, and research users. It is not directed to anyone under 18. We do not knowingly create accounts for children. Contact us if you believe a child provided personal information, and we will investigate and take appropriate action.

14. Changes to this Policy

We may update this Policy for legal, security, provider, or product changes. We will update the effective date and provide reasonable notice of material changes by email or prominent notice. Where required, we will obtain consent before applying a materially different use to previously collected information.

15. Contact

Privacy and general requests: support@toolsinvision.com. Security incidents: security@toolsinvision.com. Billing questions: billing@toolsinvision.com. ToolsInVision operates from Tennessee, United States.