Toohoo Ltd. (“Toohoo,” “we,” “our,” or “us”) is committed to protecting your privacy and personal data.
This Privacy Policy describes how we collect, receive, use, store, share and otherwise process personal data when you visit our websites, use the Toohoo platform and related services, communicate with us, or otherwise interact with Toohoo (collectively, the “Services”).
Toohoo provides an AI-powered platform designed to support procurement and supply-chain operations, including by automating supplier communications, monitoring purchase orders, identifying exceptions and changes, supporting procurement workflows, facilitating collaboration between organizations and their suppliers, and integrating with enterprise systems.
If you do not agree with this Privacy Policy, you should not use the Services.
1.Scope of this Privacy Policy
This Privacy Policy applies to personal data processed by Toohoo in connection with our websites, platform, applications, integrations and Services.
In providing the Services to business customers, Toohoo may process certain information on behalf of and under the instructions of its customers. In such circumstances, the customer is generally the controller of the relevantch personal data and Toohoo acts as a processor or service provider.
Such processing may also be governed by the applicable agreement, data processing agreement or other contractual terms between Toohoo and the customer.
2.Information We Collect and Process
The information we collect and process depends on how you interact with Toohoo and the Services.
Information You Provide to Us
We may collect information that you provide directly to us, including your name, business email address, company or organization, job title, account and profile information, communications with Toohoo, feedback, support requests and other information you choose to provide.
Account and Usage Information
When you use the Services, we may collect information relating to your account and use of the platform, including features used, actions performed, dates and times of access, and other information concerning your interaction with the Services.
Customer Data
In providing the Services, Toohoo may process information, documents, communications and other data provided by customers or users, or received through systems and services integrated with Toohoo (“Customer Data”).
The nature of Customer Data processed by Toohoo depends on how each customer uses and configures the Services and the integrations it chooses to enable.
Communications and Collaboration Data
When users communicate or collaborate through the Services, Toohoo may process and store messages, conversations, shared files and attachments, participant information, and other content submitted through the communication and collaboration features of the Services.
Communications are encrypted in transit and at rest. Toohoo processes this information as necessary to provide, maintain, secure and support these features and related workflows.
Email Data
The Toohoo platform may connect with business email accounts and email services, including Google Workspace/Gmail and Microsoft Outlook/Microsoft 365.
When an authorized user connects an email account, Toohoo may access and process information associated with the account as necessary to provide the Services. Depending on the applicable integration and customer configuration, this may include email metadata, calendar information, sender and recipient information, subject lines, email content and attachments. In addition, Toohoo may process email communications to identify and analyze information relevant to the Services and may read, create and send emails from a connected account. Toohoo may store email headers, subject lines, distribution lists, aliases, emails metadata, timestamps.
Toohoo may also send authorized communications through a connected email account, including automated reminders and follow-up communications.
Customers may configure the Services to limit the communications processed and the automated reminders and follow-up communications sent by Toohoo.
Toohoo requests access only to permissions reasonably necessary to provide the applicable functionality.
Information from Third-Party Integrations
Customers may connect Toohoo with third-party systems and services, including email providers, ERP systems and other business applications.
When an integration is enabled, Toohoo may receive and process information from that third-party service as necessary to provide the requested functionality.
Permissions and access levels are determined on a customer-by-customer basis and may vary depending on the scope and nature of the integration. For example, an integration may be configured as one-way, allowing the Toohoo Services to retrieve purchase order data from the customer’s ERP, or as two-way, also enabling purchase order revisions to be sent back to the ERP. The specific level and nature of access are determined in consultation with the customer’s IT team.
Device, Log and Technical Information
When you access the Services, we may automatically collect certain technical information, such as IP address, browser and device type, operating system, access dates and times, application activity, diagnostic information, and security and server logs.
We may use this information to operate, maintain, secure, troubleshoot and improve the Services.
3.How We Use Personal Data
We may use personal data and other information processed through the Services to:
provide, operate and maintain the Services;
create, authenticate and manage user accounts;
provide and maintain integrations requested by customers;
process and analyze information in connection with the Services;
identify relevant events, changes and exceptions;
generate alerts, notifications and workflow information;
display relevant information and communications to authorized users;
enable communications and collaboration through the Services;
send authorized communications and reminders;
integrate information with third-party business systems;
provide technical and customer support;
monitor, maintain and improve the performance, reliability and functionality of the Services;
protect the security and integrity of the Services;
detect and prevent fraud, misuse and unauthorized activity;
communicate with users regarding the Services;
comply with legal and regulatory obligations; and
enforce our agreements and protect our legal rights.
Where required by applicable law, we will process personal data only where we have an appropriate legal basis.
Artificial Intelligence and Automated Processing
Toohoo uses automated technologies, including artificial intelligence and machine-learning technologies, as part of the Services.
These technologies may be used to analyze information, communications and documents processed through the Services, identify relevant information and events, detect exceptions and changes, generate alerts and support other workflows provided through the Services.
Outputs generated through automated processing may be presented to authorized users for review and action.
Toohoo does not use Customer Data, including Google Workspace user data, to develop, improve or train generalized artificial intelligence or machine-learning models for use across unrelated customers.
Google Workspace Data
Where Toohoo accesses information through Google Workspace APIs, our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.
Google Workspace user data is used only as necessary to provide or improve user-facing functionality associated with the Services requested or authorized by the user or the user’s organization.
Toohoo does not sell Google Workspace user data or use Google Workspace user data for advertising purposes.
Consistent with the above, Toohoo does not use Google Workspace user data to develop, improve or train generalized artificial intelligence or machine-learning models for use across unrelated customers.
Users may revoke Toohoo’s access to their Google account at any time through their Google Account settings.
4.How We Share Personal Data
Toohoo does not sell personal data.
We may share personal data with service providers that support the operation, hosting, security, development, maintenance and delivery of the Services. Such providers may process personal data on our behalf only as necessary to provide their services and subject to appropriate confidentiality, privacy and security obligations.
Information may also be shared with third-party systems and applications that a customer chooses to connect with Toohoo, in accordance with the customer’s configuration and instructions.
We may disclose information where required by applicable law, regulation, legal process or governmental request, or where reasonably necessary to protect the rights, security or integrity of Toohoo, our customers, users or others.
Information may also be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets or similar corporate transaction, subject to applicable legal and contractual requirements.
We may otherwise share information where you or the applicable customer directs or authorizes us to do so.
5.Data Retention
We retain personal data for as long as reasonably necessary to provide the Services and fulfill the purposes described in this Privacy Policy, including to satisfy contractual, legal, security and operational requirements.
The applicable retention period may depend on the type of information, the customer’s configuration, the nature of the Services and applicable contractual or legal requirements.
Where Toohoo processes Customer Data on behalf of a customer, retention and deletion may also be governed by the customer’s instructions and the applicable agreement with Toohoo.
When information is no longer required, we may delete, anonymize or otherwise securely dispose of it, subject to applicable legal and technical requirements. Certain information may remain for a limited period in secure backup systems following deletion.
6.Security
Toohoo implements technical and organizational measures designed to protect personal data against unauthorized access, use, disclosure, alteration, destruction or loss.
Such measures may include, as appropriate, encryption of data in transit and at rest, access controls, authentication mechanisms, restricted personnel access, logging and monitoring, data isolation and other administrative, technical and organizational safeguards.
Access to Customer Data is limited to authorized persons and systems where reasonably necessary to provide, maintain, secure or support the Services.
While we implement industry-standard security measures to protect your data, it's important to understand that no storage system or digital transmission is completely secure.
7.International Data Transfers
Toohoo and its service providers may process or store information in Israel and other countries.
Where required by applicable law, we take appropriate measures designed to provide adequate protection for personal data transferred internationally.
The privacy and data-protection laws applicable in the countries where information is processed may differ from those applicable in your country.
8.Legal Bases for Processing
Where applicable data-protection law requires a legal basis for processing personal data, we may rely on performance of a contract, legitimate interests, compliance with legal obligations, consent where applicable, and other lawful bases permitted by applicable law.
Where Toohoo processes personal data solely on behalf of a customer, the customer is generally responsible for determining the applicable legal basis for such processing.
9.Cookies and Similar Technologies
We may use cookies, local storage and similar technologies to operate and secure our websites and Services, maintain user sessions, remember preferences, understand use of the Services and improve functionality.
You may control certain cookies through your browser settings. Disabling cookies may cause some features of the Services to function improperly.
10.Your Privacy Rights and Choices
Depending on where you are located and applicable law, you may have certain rights regarding your personal data, including rights to access, correct or delete personal data; object to or restrict certain processing; request portability of certain information; withdraw consent where processing is based on consent; and lodge a complaint with an applicable data-protection authority.
These rights may be subject to exceptions and limitations under applicable law.
Where Toohoo processes personal data on behalf of a customer, individuals should generally direct requests concerning such data to the applicable customer. Toohoo will reasonably assist its customers in responding to such requests where required.
11.Children’s Privacy
The Services are designed for businesses and professional users and are not intended for children under the age of 16.
Toohoo does not knowingly collect personal data from children under the age of 16 through the Services.
If we become aware that personal data has been provided to Toohoo by a child under 16 in circumstances where such collection is not permitted, we will take reasonable steps to delete the information.
If you believe that a child under the age of 16 has provided personal data to Toohoo, please contact us using the contact information below.
12.Third-Party Services and Links
The Services may contain links to or integrations with third-party websites, applications and services.
The privacy practices of those third parties are governed by their own privacy policies and terms. Toohoo is not responsible for the independent privacy practices of third parties.
We encourage users to review the applicable privacy policies and permissions before connecting or using third-party services.
13.Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our Services, technology, legal requirements or privacy practices.
The “Last Updated” date at the top of this Privacy Policy indicates when it was most recently revised.
Where required by applicable law, we will provide appropriate notice of material changes.
14.Contact Us
If you have questions about this Privacy Policy, our privacy practices, or wish to exercise applicable privacy rights, please contact us at:
info@toohoo.io