How we handle your information

1. Who is responsible

Injosoft AB (organisation number 556728-9524), Viktoriavägen 3, 434 93 Vallda, Sweden, runs ToRecall and is the controller for the personal data in it. That means we decide what it is used for, and we answer for how it is handled.

Write to privacy@torecall.com with any question about this policy or about your data. We have not appointed a data protection officer; that address reaches the person who is responsible.

2. What we collect

Only what you give us, and what any web service has to see in order to answer.

• Your account: email address, the name you give us, your password (stored as a hash we cannot read back), your language and your plan.
• Your history: the objects, events, reminders, photos and documents you add, and whatever you write in them. Dates, costs, places, notes, and the fields each kind of event has.
• Sync details: each change records when it was made and a random identifier for the device that made it, so your phone and computer stay in step. The identifier is created by ToRecall and says nothing about the device.
• Technical information: your browser sends its IP address and a description of itself with every request. Cloudflare, which hosts ToRecall, uses them to deliver pages and stop attacks, and Supabase records them for each sign-in, as a security record of who signed in from where. When a request fails, our error log records what went wrong, which can include part of the request, such as a search term.
• Payment: if you buy Premium, Paddle tells us your name, email address, country, plan and whether payments have gone through. We never see your card details.
• Questions you ask Ask ToRecall, our help assistant: the question, with email addresses and numbers removed, and how it was answered. They are not linked to you (section 12).

Photos keep the date they were taken. Location and camera details stored inside the file are removed when we process it.

We use no analytics, advertising networks, tracking pixels or social media plugins, on this site or in the apps. What we see of the traffic is Cloudflare’s totals, such as visits a day, the pages visits begin on and the countries they come from. Cloudflare counts them on its servers for every request, and they never say who visited. Our pages load no scripts or fonts from anyone else, with one exception: Cloudflare’s bot check, Turnstile, which confirms that a person and not a script is sending the form or the question. The sign-in and sign-up pages load it, and so does Ask ToRecall once you open it. It sets no tracking cookies.

3. Why we use it, and on what basis

The GDPR allows personal data to be used only on a legal basis. These are ours.

Where we rely on legitimate interest, the interests are yours and ours: that you can keep your household’s history, that ToRecall stays running and safe, and that we can answer you, and answer better. You can object (section 11).

An email address is required to have an account. Everything else you add is up to you.

We make no automated decisions about you that have legal or similarly significant effects, and we do not build profiles of you.

We send no marketing email. If we ever start a newsletter, it will be something you sign up to separately.

ToRecall uses AI for two things: to turn what you type into a suggested event, and to answer the questions asked of Ask ToRecall, our help assistant, from our help texts. A suggestion is made only when you ask for one, and only the sentence you are writing is sent, with email addresses and numbers removed; nothing you keep under My life is ever sent. That text, and your questions to Ask ToRecall, go to our AI provider, OpenAI, only to get the answer back. By contract OpenAI may not train its models on it. It may keep a request for up to 30 days to detect misuse, and then deletes it. We do not train AI on it either: what you record is never used to train an AI model. You can switch the suggestions off in Settings and type every event in yourself.

4. Sensitive information and other people

A record of your own life can include things the law treats as especially sensitive, above all your health. A treatment, a diagnosis, a vaccination or a timeline of your weight is health information, whether it is an object of its own or mentioned in a note.

When you create your account, we ask for your explicit consent to keep health information about you, wherever in your history you write it. It is a separate choice from accepting the terms. You can withdraw that consent at any time by deleting that information or closing your account, and it is then removed as described in section 8. A pet’s vet visits are not personal data and need no consent.

Your history will involve other people, such as a partner or a child starting school. Keeping your own household’s record is a private matter, but record only what you think they would not mind reading, and do not record health information about another adult without their agreement.

You must be at least 13 to have an account. If you are under 18, a parent or guardian must agree before you buy Premium.

5. Who can see your history

Only you, unless one of the following applies:

• People you share an object with. Those you let edit can add and change its events, photos and documents, but cannot create, move or delete objects. Viewers can only read it. When you remove someone, their access ends at once.
• Us, when you ask. We open the contents of an account only to deal with a support request you have made, only as far as that request needs, and we record each time we do.
• The service providers in section 6, who store and process data for us and may not use it for anything else.
• Paddle, when you buy Premium.
• Authorities, when Swedish law obliges us to hand information over. We check that a request is lawful, disclose only what it covers, and tell you unless we are forbidden to.

We do not sell personal data, and we do not share it for advertising.

6. Service providers

These companies process personal data on our behalf, as processors. Each is bound by a data processing agreement that allows it to use the data only on our instructions.

Paddle.com Market Ltd in London sells Premium on our behalf as Merchant of Record. Paddle handles payment and tax information as a controller in its own right, under its own privacy notice: paddle.com/legal/privacy. To have your payment data deleted, ask Paddle as well as us.

If we add a provider that handles your history, it will be listed here before it starts.

7. Transfers outside the EU

Your history is stored in the EU, and the emails we send, reminders included, go out through Lettermint in the EU. OpenAI in the United States reads the questions asked of Ask ToRecall and what you type for a suggestion. Some of our other providers are based outside the EU too, and their systems or staff may reach data from the United States, the United Kingdom or Singapore, for example to run the service or fix a fault. Each such transfer is covered by one of these:

• The EU–US Data Privacy Framework, for Cloudflare, which is certified under it.
• The European Commission’s standard contractual clauses, for Supabase and OpenAI, and as a fallback for the others.
• The European Commission’s adequacy decision for the United Kingdom, for Paddle.

Write to privacy@torecall.com for a copy of the safeguards that apply.

8. How long we keep it

Closing your account deletes the objects you own, and the access others have to them. Events you added to an object someone else owns stay in their history, without your name.

9. Cookies and local storage

ToRecall stores only what it needs to work. None of it tracks you or is shared with anyone. That is why there is no cookie banner: under the Swedish Electronic Communications Act (chapter 9, section 28), storage needed to provide a service you have asked for does not require consent.

The mobile version keeps a copy of its own program files on your device so that it opens quickly. Anything you record without a connection waits there until it can be sent.

10. Security

• Everything sent to and from ToRecall is encrypted in transit with TLS, and our providers encrypt it where it is stored.
• Every request is checked on the server against the objects you own or have been given access to, not just against whether you are signed in. The apps never query the database themselves: everything goes through our API, which checks each request.
• Photos and documents are reached through links that expire.
• Only the people who run ToRecall can reach the production systems, and they sign in with a second factor.

If a breach affects your data, we report it to the Swedish Authority for Privacy Protection within 72 hours of discovering it and tell you directly if it puts you at high risk.

11. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you, and get a copy of it
• have wrong information corrected
• have your data deleted
• have its use restricted while a question about it is being settled
• take your data with you in a machine-readable format
• object to uses that rest on our legitimate interest
• withdraw a consent you have given, without affecting what was done before

Most of this you can do yourself. Edit or delete anything in the app, export all of it as a file from Settings, and close your account from the same page. For anything else, write to privacy@torecall.com. We answer within a month, or tell you within that month why we need longer, and we do not charge for it. We may ask you to confirm who you are first, so that we do not hand your data to someone else.

If you think we handle your data wrongly, tell us, and we will try to put it right. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, imy@imy.se, or Box 8114, 104 20 Stockholm.

12. Ask ToRecall, the help assistant

Ask ToRecall answers questions about ToRecall from our own help texts. It is automatic: AI works out what you are asking, finds the help texts that answer it, and words the answer from them and nothing else. An answer that states a figure the help texts do not have is not shown, and where there is more to read, a link leads there.

What happens to a question:

• Email addresses, phone numbers, personal identity numbers and card numbers are removed from it first, before it is sent anywhere or stored.
• OpenAI reads it to work out what you mean, and writes the answer from the help texts that fit. Cloudflare turns it into numbers that let our help texts be searched by meaning. Neither may train AI models on it.
• We keep it for 12 months, with the answer it got, whether you said the answer helped and what you wrote about it, and what answering it cost, so that we can see which answers work and which are missing. Then it is deleted.

A question is not linked to you. We store no account, IP address, cookie or device identifier with it, and its time only to the hour. A conversation gets a random number of its own, so that a follow-up can be read together with the question before it, and nothing else connects it to anyone. Cloudflare uses your IP address only for a moment, to limit how many questions can be asked a minute.

Please write no personal details in a question. The assistant does not need them, and what it removes by itself cannot be everything. It cannot see your account either: for anything about your own history or payments, write to support@torecall.com and a person will answer.

13. Changes to this policy

When we change this policy, the date at the top changes with it. If a change affects what we do with information you have already given us, we email you at least 30 days before it takes effect. Earlier versions are available on request.

This is the first version.