Privacy Policy

1. Scope and roles

This Policy covers website visitors, account holders, Team users, support contacts, and other people who interact with the Service. For account, website, billing, and support information, ToolsInVision generally acts as the business or controller. For personal information contained within a customer’s uploaded dataset, the customer determines the purpose and means of processing and ToolsInVision generally acts as its service provider or processor.

2. Information we collect

Information you provide

• Account information such as email address, authentication provider, password hash, verification status, and account role.
• Customer Data including images, video frames, annotations, classes, projects, comments, chat messages, review decisions, QA records, activity history, exports, and storage metadata.
• Team information including invitations, memberships, roles, permissions, seats, presence, ownership requests, and collaboration activity.
• Billing information such as plan, subscription status, seat quantities, transaction references, and customer identifiers. Full payment-card information is processed by Stripe and is not stored by ToolsInVision.
• Support requests, suggestions, correspondence, and information you choose to include.
• BYOS configuration and credentials you submit. Sensitive credentials are encrypted before storage where the feature is configured as designed.

Information collected automatically

• IP address, browser, device, operating system, user agent, timestamps, requested routes, and security events.
• Login history, recognized-device identifiers, failed attempts, session activity, and abuse-prevention information.
• Usage and operational information such as storage consumption, image counts, project actions, export status, errors, and feature interactions.
• When you accept optional analytics, Google Analytics receives website interaction information such as pages viewed, approximate location, device and browser details, referrer, and engagement events. Analytics remains disabled when you decline.
• Strictly necessary cookies and local browser storage used for sessions, CSRF protection, device recognition, preferences, recovery, and application state.

Social login

If you sign in with Google or GitHub, we receive the verified email address, provider account identifier, and authentication information necessary to create or connect your account. Those providers separately process information under their own privacy policies.

3. How we use information

• Provide image ingestion, annotation, tracking assistance, collaboration, review, QA, storage, billing, support, and exports.
• Create and authenticate accounts, verify email, reset passwords, manage sessions, recognize devices, and enforce permissions.
• Operate plans, quotas, seats, subscriptions, invoices, payment status, and fraud prevention.
• Monitor reliability, diagnose errors, prevent abuse, secure users and infrastructure, and investigate incidents.
• Respond to support, billing, privacy, and product-feedback requests.
• Improve usability, performance, and features using operational information and feedback.
• Comply with law, enforce agreements, protect rights and safety, and establish or defend legal claims.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use private Customer Data to train general-purpose models without explicit customer permission.

4. Legal bases

Where applicable law requires a legal basis, we rely on performance of our contract to provide the Service; legitimate interests in security, reliability, support, fraud prevention, and product improvement; consent where requested; and compliance with legal obligations. You may withdraw consent for future processing where consent is the basis, without affecting prior lawful processing.

5. How information is disclosed

We disclose information only as reasonably necessary:

• Service providers: infrastructure, cloud storage, database, email, authentication, payment, security, and support providers acting for us.
• Customer-directed services: storage or integrations selected and configured by the customer, including BYOS providers.
• Team workspaces: information is visible to authorized Team members according to role, project, review, chat, comment, and administrative settings.
• Legal and safety: where reasonably necessary to comply with valid legal process, enforce agreements, prevent fraud, protect the Service, or protect rights and safety.
• Business transfers: in connection with financing, acquisition, merger, reorganization, bankruptcy, or sale, subject to appropriate confidentiality and notice where required.
• With direction or consent: when you request or authorize disclosure.

6. Current service-provider categories

The Service currently uses providers that may include Render for application hosting; PostgreSQL-compatible database hosting; Cloudflare R2 and customer-selected S3-compatible services for media storage and generated exports; Stripe for payments; SMTP2GO for transactional email; Google Analytics for optional, consent-based website measurement; and Google and GitHub for optional authentication. Provider use may depend on your plan, consent, and chosen features. Providers process information under contracts and their own applicable privacy terms. We may replace providers while maintaining materially appropriate protections.

7. Dataset privacy and BYOS

Annotrack projects are intended to remain accessible only to authorized users and Team members unless a customer intentionally exports or shares data outside the Service. Customers control dataset content and must avoid uploading personal or sensitive information unless they have a lawful basis and suitable safeguards. With BYOS, the customer controls the external bucket and remains responsible for access policies, encryption, regions, retention, provider contracts, and deletion.

8. International processing

ToolsInVision operates from the United States, and information may be processed in the United States and other countries where providers operate. Those countries may have different privacy laws. Where required, we and our providers use recognized transfer mechanisms and contractual or technical safeguards. Customers needing a data-processing agreement or specific regional commitments should contact support before uploading regulated data.

9. Retention

We retain account and Customer Data while the account or workspace is active and as needed to provide the Service. Users and authorized Team administrators can delete certain projects, images, annotations, and storage objects through available controls. After account closure or a verified deletion request, we delete or de-identify eligible active data within a commercially reasonable period. Residual copies may remain temporarily in backups until normal backup rotation completes.

Security, audit, review, support, billing, transaction, and legal records may be retained longer where reasonably necessary to prevent abuse, preserve workspace integrity, meet tax/accounting obligations, resolve disputes, or comply with law. We minimize retention when records are no longer required.

10. Security

We use measures designed to protect information, including TLS transport, password hashing, email verification, secure and restricted cookies, CSRF protection, rate limiting, session expiration, login monitoring, recognized devices, role-based permissions, encryption of supported stored credentials, and access controls. No system is perfectly secure. You must use a unique password, secure your email account, limit Team permissions, and report suspected compromise to security@toolsinvision.com.

11. Your rights and choices

Depending on location, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about disclosure. You may also have the right to appeal a denied request or complain to a regulator. We do not discriminate against users for exercising applicable privacy rights.

Submit a request to support@toolsinvision.com with “Privacy Request” in the subject. We will verify identity and authority before responding. Authorized agents must provide proof of authority. Rights are subject to legal exceptions and the rights of others. We respond within the period required by applicable law.

12. Cookies and browser storage

We use essential cookies and browser storage for login sessions, security, device recognition, OAuth state, CSRF protection, preferences, recovery, and core application functions. Blocking them may prevent the Service from working. We do not currently use them to sell information or serve cross-context behavioral advertising. If we introduce non-essential analytics or advertising technologies, we will update this Policy and provide consent controls where required.

13. Children

The Service is intended for adults and business, professional, and research users. It is not directed to anyone under 18. We do not knowingly create accounts for children. Contact us if you believe a child provided personal information, and we will investigate and take appropriate action.

14. Changes to this Policy

We may update this Policy for legal, security, provider, or product changes. We will update the effective date and provide reasonable notice of material changes by email or prominent notice. Where required, we will obtain consent before applying a materially different use to previously collected information.

15. Contact

Privacy and general requests: support@toolsinvision.com. Security incidents: security@toolsinvision.com. Billing questions: billing@toolsinvision.com. ToolsInVision operates from Tennessee, United States.