Toevan ("we", "us") builds deterministic code-governance software. This policy explains what personal data we collect when you visit this website, submit an enquiry, or hold a Toevan account, and how we handle it. For this data, Toevan is the data controller.
Personal data that flows through the product on behalf of our customers (source code and its contents) is a separate matter: there Toevan acts as a data processor, and that processing is governed by our Data Processing Agreement, not by this policy.
Who we are
Toevan OÜ, an Estonian private limited company (osaühing), is the data controller for the personal data described in this policy.
- Registry code: 17583678.
- Contact: [email protected] for privacy and general enquiries.
- Registered address: Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia.
What we collect and why
We collect the minimum personal data needed to run this website, respond to enquiries, and provide accounts. Each category has its own lawful basis under Article 6 of the GDPR.
- Website visitors. When we enable cookieless analytics we will measure only aggregate traffic; no such tool is enabled yet. We do not build profiles of visitors and we set no tracking cookies (see Cookies and analytics). Lawful basis: our legitimate interest (Article 6(1)(f)) in understanding and securing our own website.
- Leads. When you submit the enterprise contact form we collect your name, work email, company, engineer-count band, an optional field describing what is driving your interest, and your message. Lawful basis: our legitimate interest in responding to business enquiries and, where you ask us to, taking steps prior to entering a contract.
- Account users. When you or your organisation creates a Toevan account we process your name, work email, and authentication identifiers. You sign in with your own GitHub account, so those identifiers come from your GitHub identity. Lawful basis: performance of a contract (Article 6(1)(b)) to provision and secure your account.
- Security. Our servers process your IP address transiently to rate-limit and protect our endpoints against abuse. Lawful basis: our legitimate interest in the security of the service. We do not store your IP address against your enquiry.
We rely on consent (Article 6(1)(a)) only where we actually ask for it. Today no feature of this website relies on consent.
Data location and transfers
We host this website and our controller data in the European Union: compute in Helsinki (Hetzner) and CDN, DNS, and edge services on Cloudflare's EU configuration.
Controller personal data is processed in the European Union. You authenticate with your own GitHub account (GitHub is US-based), and our payments processor (Stripe) processes billing data; those flows can involve a transfer outside the European Economic Area (EEA), which relies on the provider's adequacy decision or the European Commission's Standard Contractual Clauses.
How long we keep it
- Leads. We keep contact-form submissions for up to 24 months from your last contact, unless an ongoing relationship or a legal obligation requires longer. If you ask us by email to delete yours sooner, we delete them within 30 days of your request.
- Account data. Retained for the life of your account. To have your account deleted, ask us by email at [email protected]; we delete your account data within 30 days of your request, except the records the law requires us to keep, such as billing records. Lawful basis: performance of our contract with you (Article 6(1)(b)).
- Billing and invoice records. Kept for the statutory retention period (approximately seven years) as required by law. Lawful basis: compliance with a legal obligation (Article 6(1)(c)).
Product and customer data (the source code and its contents processed inside the product) is not covered by this policy. Its retention is governed by our Data Processing Agreement.
Sub-processors
A small set of providers processes the personal data described above on our behalf, under data processing agreements. These are distinct from the product sub-processors that handle customer source code, which are listed on our Sub-processors page and governed by the Data Processing Agreement. We do not sell your personal data.
- meetergo (Germany, EU). Scheduling for the enterprise Book a pilot call. It processes a prospect's name, email, and meeting metadata. meetergo hosts booking data in the EU, primarily Germany, with limited non-EU sub-processor transfers under Standard Contractual Clauses and the EU-US Data Privacy Framework. Booking data is automatically deleted after 24 months, matching the leads-retention window below. The call-to-action is a cookieless link-out (see Cookies and analytics), under meetergo's standard Article 28 data processing agreement.
- Mailgun (EU). Outbound transactional and alert email, for example new-lead alerts. It handles account and lead email addresses and message content, in the EU. A legacy SendGrid integration remains in the codebase but is disabled by default and is being removed.
- mailbox.org (Berlin, Germany, EU). Hosts our human mailboxes ([email protected] and [email protected]) and receives inbound email: contact enquiries, security and vulnerability disclosures, and sub-processor-change subscribe messages. It handles the email address and message content of anyone who emails us.
- Stripe. Payments and billing. Billing is live: Stripe handles the billing-contact and payment metadata of the organisations whose billing is enabled (self-service billing is enabled on request), under an EU contracting entity, with onward transfer to the United States under Standard Contractual Clauses and the EU-US Data Privacy Framework.
Changes
This policy is versioned. The current semantic version and the date it last changed appear at the top of this page, and the full history is in the changelog below. When we make a material change we update the version and the Last updated date.
Historique des modifications
- v1.0.0
Initial draft: controller identity, data collected and lawful bases, cookieless analytics, EU data residency, retention, GDPR rights, the Estonian supervisory authority, and the controller-data processors (meetergo for scheduling, Mailgun and mailbox.org for email, Stripe for billing) moved here from the product sub-processors page.
- v1.1.0
Billing is live: Stripe processes billing data for the organisations whose billing is enabled (self-service billing on request). The statements that billing was simulated and not yet live are removed.
- v1.2.0
Account data and contact-form submissions are deleted on request: ask by email and we delete them within 30 days of the request, except the records the law requires us to keep. The statement that account data is deleted within 90 days after an account is closed is removed: there is no self-service account closure in the product yet.