TogaAI

GDPR overview

GDPR implementation is concrete and documented rather than merely claimed. The privacy policy, last updated in March 2026, is written explicitly under Regulation (EU) 2016/679 and names TogaAI, Lda. as controller. Six rights are set out with their articles: access (15), rectification (16), erasure (17), portability (20), restriction and objection (18 and 21), plus consent withdrawal. Rectification, erasure and data export are available as self-service in the account settings; other requests are answered within thirty days. The Portuguese supervisory authority, the CNPD, is named with its address for complaints, and the vendor commits to notifying it of incidents within statutory deadlines. All processing and storage take place inside the European Union with no declared transfers to third countries. No Data Protection Officer is named and no Article 27 representative is designated, the latter being consistent with an EU-established company.

Who owns the data?

Under clause 4.2 of the terms, the user keeps every right over the documents and matters they submit, which the vendor calls Dados do Cliente. Clause 4.3 grants TogaAI only a limited licence to process that material as far as running the platform requires. The vendor retains ownership of its own interface, logos and software. In practice the vendor also limits what it can do with the content: files are encrypted in the browser with a key derived from a four-digit PIN that never reaches the server, so TogaAI states its staff see nothing but opaque ciphertext. TogaAI, Lda. is the named data controller. The PIN cannot be recovered by the vendor.

Reuse rights

The user can reuse their own material freely: they keep all rights over uploaded documents and generated output, and no permission clause restricts what they do with it afterwards. The vendor's own reuse is narrow and explicitly bounded. The privacy policy lists six purposes: delivering the SaaS service, processing payments and tax obligations, personalising answers through an optional user-memory feature, sending transactional messages, providing support, and improving the service on aggregated and anonymised data only. Four legal bases are cited: contract performance, consent for analytics cookies and user memory, a legal obligation to keep billing records for ten years, and legitimate interest for security and fraud prevention. The vendor states it neither sells nor shares personal data commercially, and that uploaded files are never used to train AI models.

Data retention & training

Hosting summary

All processing and storage take place on servers located in the European Union, and the vendor states there are no transfers to third countries. The database and file storage are provided by Supabase on AWS infrastructure in Frankfurt, Germany. The anonymisation step that strips personal data before a request reaches the generation model is also run by a European model in Frankfurt, and it is fail-closed: if anonymisation does not succeed, the request is blocked. Audio submitted for transcription is processed on European infrastructure and deleted immediately once the transcript is produced. Data in transit is protected by TLS 1.2 or above. Data at rest is encrypted with AES-256-GCM, using a per-user key that is itself wrapped by a key derived from the user's PIN, so the stored ciphertext is unusable without it. Named subprocessors are Supabase, Anthropic and Google under a zero-retention enterprise policy, and Stripe for payments.