Legal
Data Processing Addendum
Last updated: November 14, 2026
This is the standard data processing addendum (DPA) Toolzum offers to customers who need one for their own compliance obligations — GDPR Article 28, the UK GDPR, or India's DPDP Act, 2023. It describes what we actually do; it does not add obligations we do not already meet. To get a signed copy, see the last section.
1. Roles
- Account and billing data (email, session, order records): Toolzum acts as the controller / data fiduciary.
- Content you submit to cloud tools (a document sent to an AI tool, an image sent for generation): you are the controller and Toolzum acts as a processor, acting only on your instruction — which is the request you make by using the tool.
- Local tools are not processing by us at all. The file never leaves your browser, so there is nothing for a DPA to govern. That is most of the catalog.
2. What we process and why
We process personal data only to provide the service you asked for: authenticate you, meter credits, deliver the output, send receipt and account email, prevent abuse, and (with consent) measure aggregate usage. We do not sell personal data, and we do not use your content to train models.
3. Subprocessors
These are the third parties that can touch data on our behalf. The full privacy narrative is in the Privacy Policy.
| Subprocessor | Purpose | When it applies |
|---|---|---|
| Cloudflare | Hosting, edge delivery, D1 database, KV/R2 storage, Turnstile bot checks | Global edge network |
| Dodo Payments | Payment processing and receipts. Dodo is an independent controller for payment data — we never see card details. | Payment flows |
| Google (Gemini API) | Cloud AI processing for marked AI tools. Content is transient: sent for the request, not stored by us. | AI tools only |
| PostHog | Product analytics. Loaded only while analytics consent is active. | Consent-gated |
| Microsoft Clarity | Heatmaps and session replays. Same consent gate as analytics. | Consent-gated |
| Pollinations | Generates free AI images and serves them directly to your browser. | Image generation only |
| Public CDNs (jsDelivr, unpkg, cdnjs, Google storage) | Serves open-source libraries and on-device models. Sees standard request metadata (IP, user agent). | Library delivery |
| Email transport | Sends transactional email such as receipts and password resets. | Account email only |
We will give at least 30 days' notice on this page before adding a subprocessor that handles personal data, so you can object before it takes effect.
4. Security measures
- Encryption in transit (TLS) for every request, enforced by a strict Content Security Policy.
- Encryption at rest for stored records, provided by our infrastructure host.
- Least-privilege credentials; admin actions are scoped and audit-logged.
- No retention of content submitted to cloud AI tools beyond the request itself.
- Local-first architecture: most tools never transmit the file at all.
We do not hold SOC 2 or ISO 27001 certification, and this page does not claim it. What we can do is answer a security questionnaire and share the public security documentation.
5. Data subject requests
We help you answer access, correction, deletion, and portability requests. If a request reaches us directly and concerns your account data, we handle it ourselves and tell you. If it concerns content you processed through us, we redirect the requester to you unless legally required otherwise. Our target response time is 30 days.
6. Personal data breach
If we become aware of a breach affecting personal data we process for you, we notify you without undue delay and within 72 hours, with what we know at that point, what we are doing, and what we recommend you do. If the facts change, we send an update rather than staying quiet.
7. Deletion and return
On request or on account closure, we delete account data within 30 days, except records we must keep for tax, accounting, or legal reasons (typically invoice records). You can trigger deletion yourself from the account page.
8. International transfers
Our host runs on a global edge network, so requests may be served outside your country. Where a transfer needs a safeguard, we rely on the Standard Contractual Clauses or an equivalent mechanism offered by the provider.
9. Requesting a signed copy
Email [email protected] with the subject DPA request, your legal entity name, and the data categories you need covered. We aim to respond within 5 business days. These terms are governed by the laws of India, matching our Terms of Service.