Who we are
ToolzerHub (also written Toolzer Hub) runs toolzerhub.com, the dashboard at app.toolzerhub.com, the docs at docs.toolzerhub.com and the API at api.toolzerhub.com, and is operated from India. In this policy “we” and “us” mean ToolzerHub.
We decide how and why your account, billing and website data is used, so we are the data controller (the data fiduciary under India’s Digital Personal Data Protection Act) for it.
For any privacy question or request, email contact@toolzerhub.com.
What this policy covers
It covers our websites, the dashboard, the docs and the API. It does not cover Apify, where our Actors are listed and billed; Apify’s own privacy policy applies there.
The data that API results contain about other people is covered under “Personal data in API results”.
What we collect and why
Each item says why we use it and the legal basis we rely on under the GDPR and UK GDPR. “Contract” means we need it to provide the service you signed up for.
Account. Your name, email address and password (we store only a hash of it), email verification codes, your workspace, team members and their roles, and answers you give during onboarding, such as what you plan to build. Used to run your account. Basis: contract.
API keys. We store a hash of each key, its name, and its first and last characters so you can recognise it. We show the full key only once, when you create it. Basis: contract.
Billing. For each credit purchase: the pack, amount, currency, status, PayPal order, capture and payer IDs, refunds and disputes, and when we sent your receipt. PayPal handles your card, bank and PayPal login details; we never see them. Basis: contract, and our legal duty to keep accounting records.
API usage. For each request: the endpoint, the parameters you sent (values under names such as password, token or key are removed), the time, how long it took, response size, status and error code, the credits charged, and which workspace and key made it. Used for billing, your usage history, support, and to find faults and abuse. Basis: contract and legitimate interests.
Security. Your IP address and browser details when you sign up, sign in or reset a password. We use them to limit repeated attempts and to check that a person is signing up. We do not store your IP address with your account or in API request logs. Basis: legitimate interests in keeping accounts safe.
How you found us. When you sign up we save how you first reached us: campaign tags (UTM parameters), the referring site, the page you landed on, the last page you viewed, any ad click ID (gclid, gbraid, wbraid, fbclid, msclkid), and the source you pick when you sign up. Used to learn which marketing works. Basis: consent where the law requires it; otherwise legitimate interests. The answer you pick yourself is optional.
Website and product analytics. Pages you view, clicks, scrolls, device and browser type, approximate location from your IP address, cookie IDs, and events such as signing up, creating a key or buying credits. Microsoft Clarity records sessions and builds heatmaps. When you are signed in, PostHog links events to your account ID, name and email. Session recording in PostHog is off. Basis: consent in the EU, EEA, UK and Switzerland; legitimate interests elsewhere, with an opt-out at any time.
Support. The emails you send us and our replies. Basis: contract and legitimate interests.
Actor runs. When you run one of our Actors on Apify, the Actor reports run details to us, such as your Apify user ID, the run ID, which Actor ran, its settings and usage. Used to operate and improve the Actors. Basis: legitimate interests.
We send service email: sign-up verification, password resets, team invites, receipts and notices about your account or these terms.
Personal data in API results
The API returns publicly available data from third-party sites, such as public profiles, posts and ads. Some of it is about people.
You choose what to request and what to do with the results, so for that data you are the controller and we process it on your behalf. You must have a lawful basis to collect and use it. Our Terms of Service set out these duties.
We do not keep a copy of the results we return. We keep the parameters of each request, which may include a username or link you looked up, in request logs for 7 days. Some lookups are cached for up to 7 days so repeated requests are faster; caches expire on their own.
If you appear in data our API returns and want us to delete what we hold about you, such as a username in our request logs or a cached item, email contact@toolzerhub.com. We will delete it. We cannot remove data from the site it came from or from copies our customers keep; ask the site or the customer for that.
International transfers
Our servers are run by a cloud hosting provider, and we operate from India. Several providers above process data in the United States and other countries. Where data leaves the EU, EEA, UK or Switzerland, we rely on an adequacy decision or the provider’s standard contractual clauses and other safeguards the law allows.
How long we keep data
- Detailed API request logs, including parameters: 7 days, then deleted.
- Hourly usage totals per endpoint and key, without parameters: while your workspace exists, to show your usage history.
- Request traces used to find faults: 2 days.
- Sign-in sessions: 30 days, or until you sign out.
- Account, workspace, keys and how you found us: while your account is open.
- Billing records: as long as tax and accounting law requires.
- Support emails, other logs and Actor run details: as long as needed for billing, security and support, then deleted or anonymised.
- Analytics and advertising data: held by the providers above under their own retention settings.
You can delete your account in the dashboard under Settings. That closes it at once. To have the remaining personal data erased, email contact@toolzerhub.com. We will delete or anonymise it within 30 days, except records we must keep by law.
Security
Traffic to our sites and API is encrypted with HTTPS. Passwords and API keys are stored as hashes, and sign-in cookies cannot be read by page scripts. Access to production systems is limited to the people who run the service. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.
Your rights
Email contact@toolzerhub.com to use any of these rights. We may ask you to confirm your identity, usually by replying from the email on your account. We answer within one month, or sooner where the law sets a shorter time.
EU, EEA, UK and Switzerland. You can ask to see, correct, delete or receive a copy of your data, and to restrict or object to how we use it. Where we rely on consent, you can withdraw it at any time, for cookies with Cookie settings. You can complain to your data protection authority; in the UK that is the ICO.
California. You can ask what personal information we collect, use and disclose, and ask us to delete or correct it. We collect identifiers, commercial information (purchases), internet activity and approximate location, for the purposes listed under “What we collect and why”. We do not sell personal information for money. Our advertising cookies may count as “sharing” for cross-context behavioural advertising under California law. To opt out, choose “No thanks” in Cookie settings or turn on Global Privacy Control in your browser; we honour it. We do not use sensitive personal information to infer things about you. We will not treat you differently for using these rights. An authorised agent may make a request for you with your signed permission.
India. Under the Digital Personal Data Protection Act, 2023 you can ask for a summary of your personal data and how we use it, ask us to correct, complete, update or erase it, withdraw consent as easily as you gave it, and nominate a person to use these rights for you if you die or cannot act. You have the right to have your grievance addressed by us first. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Grievance Officer
The Grievance Officer, ToolzerHub, contact@toolzerhub.com. Put “Grievance” in the subject line. We acknowledge each grievance and respond as soon as we can, and in any case within the period the Digital Personal Data Protection Act and its rules allow, which is at most 90 days.
Children
Toolzer Hub is not for anyone under 18, and we do not knowingly collect data from them. If you believe a child has given us personal data, email us and we will delete it.
Changes to this policy
We will post any change on this page with a new date. If a change is material, we will also email account holders before it takes effect.
Contact
ToolzerHub, operated from India. Email contact@toolzerhub.com.