Todaili Privacy Policy

At a glance

This summary is here to orient you. It is not a substitute for the full policy below, which is what legally applies.

1. Who we are and what this policy covers

Todaili is an app for creating, managing and sharing events and tasks, chatting with other people, and booking appointments with businesses that use Todaili to manage their calendars.

This Privacy Policy is issued by Todaili Ltd. (“Todaili”, “we”, “us”, “our”). We are the controller of the personal information described here, except where section 6.4 says otherwise.

It applies to:

• the Todaili mobile app for iOS and Android;
• the Todaili website at todaili.com and the web booking app at web.todaili.com; and
• our back-end services that support them.

It does not apply to a business’s own handling of your information outside Todaili, or to any other website or service that we link to. Please read this policy together with our Terms of Use, which govern your use of Todaili.

2. Where your information comes from

We obtain personal information in four ways:

• You give it to us — when you register, complete your profile, create content, set up a business, or contact support.
• It is generated as you use Todaili — device and diagnostic data, usage events, and the records that make features such as sync, reminders and read receipts work.
• Your device provides it with your permission — your contacts, photos or microphone recordings, and (for business owners only) your location.
• Other people provide it — if someone who has your phone number in their address book uploads their contacts, adds you to a chat, shares an event with you, or invites you to their business, your name and phone number can reach us before you ever install Todaili.

3. The information we collect

3.1 Account and profile information

• Your name (first and last) and phone number in international format. A phone number is required — it is how you sign in and how other people find you. We verify it by sending you a one-time SMS code.
• Profile photo, if you choose to add one.
• Language, country and time zone, taken from your device so that dates, reminders and the app’s language are correct.
• Settings and preferences, including which notifications you have enabled and which device permissions you have granted or refused.

We do not collect a password, an email address, a date of birth, a government identifier, or any payment-card details. We do not offer sign-in with Google, Apple or Facebook, so no social network is told that you use Todaili.

3.2 Content you create

• Events, tasks, goals, reminders and notes — titles, descriptions, dates, times, locations you type, recurrence, and whom you shared them with.
• Chat messages and their attachments — text, photos, videos, voice recordings and files you send, together with reactions, replies, and read and delivery receipts.
• Business information, if you operate a business in Todaili — its name, description, logo and cover image, contact details, address, the services you offer, their prices and durations, your working hours, your member list, and pending join requests.
• Appointments — who booked what, when, with which business, and any note attached to the booking.

3.3 Your contacts — please read this section

3.4 Technical and usage information

• Device and app information — device model, operating system version, app version and installation identifiers, used to support the app and diagnose problems.
• Push notification token — an identifier issued by Apple or Google that lets us deliver notifications to your device.
• Diagnostic and error reports — when something goes wrong, the app sends us the error, a stack trace and basic device details so we can fix it.
• Usage events — a record that the app was opened, which of the four tabs was opened, when a background refresh ran, and similar product events. These are keyed to your internal account identifier, not to your phone number.
• Server logs — records of requests to our servers, including IP address, time and the endpoint called, kept for security and troubleshooting.

Todaili contains no third-party analytics, advertising or crash-reporting SDK — no Firebase Analytics, no Crashlytics, no Sentry, no Mixpanel, no ad network, and no session-replay tool. Usage data goes only to our own servers.

3.5 Location — business owners only

If you run a business in Todaili, you can set your business address by tapping “Use my current location” while editing your business profile. Only then does the app read your device’s location, and it asks for precise location so that the map pin lands on your actual doorstep rather than somewhere in the neighbourhood. We store the resulting address and its coordinates as part of your business profile.

Todaili never collects your location in the background, never tracks your movements, and never asks for location anywhere else in the app. Setting an address this way is always optional — you can type the address instead, or leave it blank. Clearing the address deletes the stored coordinates with it.

3.6 Cookies and local storage

Todaili uses no advertising or analytics cookies, and shows no cookie banner because none is required. The web booking app stores a small amount of information in your browser’s local and session storage, all of it strictly necessary: your chosen language, your signed-in session (managed by Firebase Authentication), the page you were heading to before signing in, and whether you have already dismissed the “get the app” prompt. Clearing your browser storage removes all of it and signs you out.

3.7 Subscription information

Where paid plans are offered, subscriptions are sold and billed by Apple through the App Store or by Google through Google Play, and we use RevenueCat to keep track of what you are entitled to. We receive the purchase record — which plan, whether it is active, and when it renews or expires. We never receive or store your payment card, bank details or billing address.

4. Why we use your information, and our legal bases

Where the EU or UK General Data Protection Regulation applies to you, the table below gives our legal basis for each purpose. Otherwise, we process your information with your consent and as necessary to provide the service you asked for.

We do not use your personal information to make decisions about you by purely automated means that produce legal or similarly significant effects.

5. The Todaili AI assistant

Todaili includes an AI assistant chat that turns ordinary sentences such as “dentist next Tuesday at four” into a suggested event you can accept or discard.

• What is sent. When you send a message in the assistant chat, the text of that message is sent, together with your time zone, language and country code, to Google Cloud Vertex AI (the Gemini model family), which processes it on our behalf and returns a reply and any suggested events.
• What is not sent. Your ordinary chats with other people are never sent to the AI. Neither are your contacts, your other events and tasks, your location, or your phone number. Only the message you typed in the assistant chat leaves for this purpose.
• Where. This processing takes place on Google infrastructure in the United States. See section 9.
• Training. Google acts as our processor for these requests. Under the Google Cloud terms that apply to Vertex AI, this content is not used to train Google’s general-purpose models.
• Accuracy. AI output can be wrong. Suggestions are suggestions — nothing is added to your calendar until you accept it, and you should check dates and times before relying on them.
• Choice. The assistant is a chat like any other. If you do not want your words processed this way, do not message it; every other part of Todaili works without it.

6. What other people can see

6.1 Other Todaili users

• Your name and profile photo are visible to people you chat with, people you share events with, and businesses you join.
• Your phone number is how others find you. Someone who already has your number can see that you are on Todaili.
• Messages and attachments are visible to everyone in that chat, and can be copied, screenshotted or forwarded by them. When you join an existing group, you do not receive messages sent before you joined.
• Events and tasks are private to you unless you share them. Shared items, and any later changes to them, are visible to the people you shared them with.

6.2 Businesses you book with

When you join a business and book an appointment, the business owner sees your name, your profile photo, your phone number, your appointment history with them, and anything you write in a booking note or in your chat with them. They need this to run their calendar and to contact you about your appointment.

6.3 Businesses you run

Your business profile — its name, description, images, contact details and address — is shown to your members and to anyone who opens a booking link you share. Treat it as published business information.

6.4 Business owners are independent controllers

A business owner decides for themselves how to use the member and appointment information they see in Todaili, including outside the app. For that use they are an independent controller and we are not responsible for it. Their own privacy practices are a matter between you and them. Within Todaili, we process that information on their behalf as their processor, under our Terms of Use.

6.5 Other disclosures

• Service providers — as described in section 7.
• Legal requirements — where we are required to disclose information by law, by a court or by a competent authority. Where we are permitted to tell you, we will.
• Safety and enforcement — where we reasonably believe disclosure is necessary to investigate or prevent fraud, abuse, or a threat to the safety of any person, or to enforce our Terms of Use.
• Corporate transactions — if Todaili is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy continuing to apply. We will notify you of any such change of control.

7. Service providers who process data for us

We keep the list short on purpose. Each of these providers acts on our instructions, is bound by confidentiality and data protection obligations, and may use the data only to provide their service to us — never for their own purposes.

Requests to Google Maps are made by our servers, not by your device, so your Todaili account is not identified to Google Maps.

8. We do not sell or advertise

We have never sold personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act. Todaili contains no advertising, no ad identifiers and no ad or tracking SDK. We do not disclose your information to data brokers, and we do not use your content to build advertising profiles of you or of your contacts.

9. Where your information is stored and transferred

• Our main database is in Israel (Google Cloud’s Tel Aviv region).
• Uploaded media and database backups are stored in the European Union.
• AI assistant requests are processed in the United States (see section 5).
• SMS verification and push notifications are delivered through providers that operate internationally.

Israel benefits from an adequacy decision of the European Commission, which means personal data may be transferred from the European Economic Area to Israel without further safeguards. For transfers to the United States we rely on the European Commission’s Standard Contractual Clauses, or another approved transfer mechanism, as incorporated into our agreements with the relevant provider.

10. How long we keep information

11. How we protect information — and what we do not claim

We take security seriously, and we would rather be exact than impressive:

• In transit. All traffic between your device and our servers is encrypted with HTTPS/TLS 1.2 or above. Plain HTTP is redirected, never served.
• At rest. Our database, file storage and server disks are encrypted with Google-managed keys.
• Authentication. Sign-in requires possession of your phone number and a one-time SMS code. Sessions use short-lived tokens.
• Authorisation. Every request is checked on the server against what that specific account is allowed to see. Members of a business cannot see one another’s data, and joining a group does not reveal its earlier messages.
• Infrastructure. The database accepts no connections from the open internet: our servers reach it over a private network, and human access to it requires a Google identity rather than a password. Our servers sit behind a managed load balancer with attack protection, administrative pages require a separate login, and credentials are held in a managed secret store rather than in code.
• Internal access. Access to production data is limited to personnel who need it to operate and support the service.

12. Your choices and controls

• Device permissions — contacts, camera, photos, microphone, notifications and location can each be granted or refused when asked, and changed at any time in your device settings. Refusing one disables the feature that needs it; it does not disable Todaili.
• Notifications — manage them in Todaili’s settings and in your device settings. Notifications about your own appointments and security are part of the service and cannot be switched off entirely while you keep an account.
• Your content — edit or delete your events, tasks, messages, business profile and profile photo at any time in the app.
• Sharing — you decide what to share, with whom, and when to stop. Leaving a chat or a business ends the sharing going forward.
• The AI assistant — simply do not message it.
• Your account — delete it from Settings (see section 14).

13. Your legal rights

Subject to the law that applies to you, you have the right to ask us to: give you access to the personal information we hold about you; correct information that is wrong or incomplete; delete your information; restrict or object to our processing of it, including processing based on our legitimate interests; provide your information in a portable, machine-readable format; and withdraw any consent you have given, without affecting processing already carried out.

How to exercise them. Most of this you can do yourself in the app. For anything else, email support@todaili.com from the account you wish to act on, or tell us the phone number registered to it, so that we can verify the request. We will respond within 30 days. Exercising your rights is free; we may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain why.

13.1 If you are in the European Economic Area or the United Kingdom

The rights above are those given to you by the GDPR and UK GDPR. You also have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

13.2 If you are in Israel

You have the right under the Protection of Privacy Law, 5741-1981, to inspect information held about you and to request that it be corrected or deleted. Contact us at the address in section 18. You may also contact the Privacy Protection Authority.

13.3 If you are in California

You have the right to know what personal information we collect, use and disclose, to request its deletion or correction, and to opt out of its sale or sharing — of which there is none, as section 8 explains. We will not discriminate against you for exercising any of these rights. You may use an authorised agent; we will ask for proof of authorisation. The categories we collect, our purposes and the categories of recipient are set out in sections 3, 4 and 7. We do not knowingly collect or sell the personal information of anyone under 16.

14. Deleting your account

You can delete your account, permanently, from inside the app:

When you do, we delete your account record and your personal information within 30 days, including:

• your name, phone number, profile photo and settings;
• your events, tasks, goals, reminders and notes;
• the contacts you uploaded;
• the businesses you own, together with their services, hours and member lists; and
• your access to everything you were sharing.

A small amount of information may survive deletion where we are legally required to keep it, or where it is needed to resolve a dispute or enforce our agreements. It is kept only for that purpose and only for as long as necessary. Deleted data also disappears from our backups as the rolling backup window passes.

15. Children and young people

Todaili is not intended for children under 13, and you may not use it if you are under 13. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete the account and the information promptly. If you believe a child under 13 has given us personal information, contact us at support@todaili.com.

If you are in the European Economic Area or the United Kingdom and are under 16 (or under the age of digital consent in your country, where it is higher), you may use Todaili only with the consent of a parent or guardian, who must give that consent and accept our Terms of Use on your behalf. A parent or guardian may contact us at any time to review, correct or delete their child’s information.

16. Security incidents

If a security incident affects your personal information and is likely to result in a risk to your rights, we will notify you and the relevant authorities without undue delay, and within the time limits the applicable law requires. We will tell you what happened, what information was involved, and what we and you can do about it.

17. Changes to this policy

We may update this policy to reflect changes in the service, our practices, or the law. When we do, we will update the date at the top and post the updated policy here. If the change is material — for example a new category of data, a new purpose, or a new recipient — we will give you prominent notice in the app, and where the law requires it we will ask for your consent before the change applies to you.

18. How to contact us

For any question about this policy, about how we handle your information, or to exercise any of your rights:

• Email: support@todaili.com

We aim to reply promptly and in any event within 30 days.