1. Who is responsible for your data
Controller: Daniel Ortega Ortega, an individual Email: support@tonemateai.com I am the data controller for the personal data described in this policy. I have not appointed a Data Protection Officer because the law does not require it for this activity. ToneMate AI is currently a free beta and nobody is charged yet. The parts of this policy about purchases will apply from the day sales open.
2. What this policy covers, in short
This policy covers the website tonemateai.com, the ToneMate licensing service (api.tonemateai.com) and the ToneMate AI app for macOS. The short version: • The text you process with ToneMate goes to the AI model you choose. With a local model (Ollama or vllm-mlx) it is processed on your Mac. With a cloud model (OpenAI, Anthropic, Google, Mistral or xAI) it travels directly from your Mac to that provider, using your own API key. It does not pass through my servers and I do not receive it. • Audio transcription runs on your Mac. • Your history is stored in a database on your Mac. I cannot see it. • What I do receive from the app is limited to licence checks and, in release builds, crash reports (section 3). • I do not sell your personal data and I do not use it for advertising.
3. What data I process, why and for how long
Website visits (analytics) Data: pages viewed, approximate location, device and browser type, language, how you arrived (referrer, campaign parameters). Why and legal basis: understanding how the site is used. Only with your consent (art. 6.1.a GDPR), through Google Analytics 4. Retention: up to 14 months. If you decline, no analytics cookies are set and no analytics events are sent. Website security and delivery Data: IP address, browser user agent, requested URL and timestamps, kept in the technical logs of the hosting and network providers (section 4). Why and legal basis: delivering the site and protecting it against abuse (legitimate interest, art. 6.1.f). Retention: the short periods those providers apply to their logs. Beta licence requests Data: email address, language, the page you asked from and how you arrived (the campaign parameters in the link you used and the site that referred you, if any). Why and legal basis: handling your request and sending you the licence key you asked for (art. 6.1.b). The licence itself is then covered under "Beta access" below. Retention: until I have answered the request, and in any case no longer than 12 months from the request. If I do not issue a key, I delete it. Contact form and emails you send me Data: first name, last name, email address, your message and how you arrived (the campaign parameters in the link you used and the site that referred you, if any). Why and legal basis: answering your request (pre-contractual measures, art. 6.1.b, or legitimate interest, art. 6.1.f). Retention: while I need it to answer you, plus 12 months. Free trial Data: email address (and a normalised form of it, so the same mailbox cannot get several trials), IP address at the time of the request, the trial licence key and, when you activate it, the device data described under "Licence activation". Why and legal basis: delivering the trial (contract or pre-contractual measures, art. 6.1.b) and preventing abuse, since there is one trial per mailbox and per Mac (legitimate interest, art. 6.1.f). Retention: 3 years from the request, so repeated trials can be prevented. Beta access Data: email address, a licence key that I issue to you, and the device data described under "Licence activation". Why and legal basis: letting you take part in the beta you asked for (art. 6.1.b). Retention: for the life of the licence plus 3 years. Purchases (when sales open) Data: name and email address entered at checkout, Stripe customer and payment identifiers, amount, currency and status, the IP address and browser user agent used at checkout, and the licence keys issued. Why and legal basis: processing the order and delivering the licences (art. 6.1.b), complying with accounting and tax obligations (art. 6.1.c) and preventing fraud and handling disputes (art. 6.1.f). Retention: order and payment records for 6 years, as required by commercial and tax law. The IP address and user agent of the checkout for up to 18 months. Abandoned checkout attempts for up to 90 days. I never see or store your card number: it is handled by Stripe. Licence activation and checks Data: licence key, a device identifier (a hash derived from your Mac's hardware identifier; the hardware identifier itself never leaves your Mac), the Mac's name as set in System Settings (which may contain your own name), the macOS and app versions, activation and deactivation dates, and your IP address in server logs. Why and legal basis: making "one licence, one Mac at a time" work, letting you move a licence between your Macs and preventing licence sharing (art. 6.1.b and 6.1.f). Retention: for the life of the licence plus 3 years, for disputes and abuse prevention. Customer account (when the web account area is available) Data: email address, a hash of your password (the password itself is never stored), and temporary verification and reset tokens (valid 24 hours and 1 hour). Why and legal basis: letting you see your licences and move them between Macs (art. 6.1.b). Retention: until you delete the account or ask me to; temporary tokens expire on their own. Transactional emails I send the emails needed to run the service: licence keys, trial keys, account verification and password reset. I do not send marketing emails. I write to you about the beta only when it affects your licence, for example when it is about to end. Error and diagnostic data Data: technical details of errors in the API and in release builds of the app (error type, stack trace, app and macOS version, device model, language). I configure the API's error monitoring not to collect personal data by default. Crash reports can occasionally include identifiers such as a licence key or an email address if they are part of an error message. Why and legal basis: finding and fixing problems (legitimate interest, art. 6.1.f). Retention: 90 days. Server logs and monitoring Data: IP addresses, requested URLs (licence checks include the licence key in the URL) and error messages in the logs of the server, which I forward to a monitoring service. Why and legal basis: keeping the service secure and available (legitimate interest, art. 6.1.f). Retention: up to 30 days. Backups Data: a copy of the database (everything above), encrypted before it leaves the server. Why and legal basis: being able to restore the service after a failure (art. 32 GDPR and legitimate interest). Retention: 14 days. If you ask me to delete your data, copies in backups disappear within that period. Internal alerts When the server detects a problem (for example, a failed payment webhook or a failed backup), it sends a technical message to a private Telegram chat that only I can read. These messages can occasionally contain identifiers such as an email address.
4. Who receives your data
I do not sell your data. I share it only with the providers that make the service work, each under an agreement that limits what it can do with it: • Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA): payments. Stripe also acts as an independent controller for fraud prevention and its own legal obligations. • Mailgun (Mailgun Technologies, Inc., USA, part of Sinch): sends the transactional emails. I use its EU region. • DigitalOcean, LLC (USA): hosts the API and the database, in Frankfurt (Germany). • Cloudflare, Inc. (USA): DNS, content delivery and security filtering in front of the API and the media files. Your IP address and requests pass through its network. • Vercel Inc. (USA): hosts the website. • Backblaze, Inc. (USA): stores the encrypted database backups in a data centre in Europe. Backups are encrypted before upload and Backblaze cannot read them. • Functional Software, Inc. (Sentry, USA): error monitoring in the API and in the macOS app. The app's project is hosted in the EU (Germany). • New Relic, Inc. (USA): server monitoring and logs, stored in the EU. • Google Ireland Limited and Google LLC: Google Analytics 4, only if you accept analytics. • Telegram (Telegram Messenger Inc. / Telegram FZ-LLC): delivers to a private chat that only I can read the messages sent through the beta licence request and contact forms, and the internal alerts mentioned above. Telegram operates globally and may store messages outside the European Economic Area. • My accountant or tax adviser, for tax and accounting obligations, and public authorities when the law requires it. If you use a cloud AI model, your text goes to the provider you chose (OpenAI, Anthropic, Google, Mistral or xAI) under your own account and your own agreement with it. I am not involved in that exchange; please read that provider's privacy policy.
5. International transfers
Several of the providers above are based in the United States. For each of them the transfer relies on the EU–US Data Privacy Framework when the provider is certified under it and, otherwise, on the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR), together with technical measures such as encryption in transit and, for backups, before upload. You can ask me for a copy of the safeguards that apply by writing to support@tonemateai.com.
6. Cookies and local storage on the website
• Strictly necessary: the website stores your cookie choice in your browser's local storage (tm_cookie_consent). It is not shared with anyone and does not require consent. When the account area is available, a login token is also kept in your browser so you stay signed in. • Analytics (Google Analytics 4): the cookies _ga and _ga_* are set only after you accept. They measure visits and last up to 2 years. Separately, the beta licence request and contact forms attach how you arrived (campaign parameters and referring site), whether or not you accepted analytics; that information is saved in your browser, for the session only, if you accepted analytics. • I do not use advertising cookies and I do not track you across other sites. You are asked for your choice on your first visit, and you can change it at any time with the "Cookie settings" link at the bottom of every page. Withdrawing consent removes the analytics cookies from your browser. You can also block or delete cookies in your browser settings.
7. The ToneMate app on your Mac
• Permissions. macOS Accessibility lets the app read the text you select and insert the result in the app you are using and, if you turn on the inline assistant, observe the text field you are typing in, only in the apps you allow. Input Monitoring lets it notice when you stop typing. Microphone and Speech Recognition are used for dictation. Reading text from other apps happens on your Mac; where that text goes next depends on the model you chose (section 2). • Clipboard. To capture and insert text the app uses copy and paste and restores your previous clipboard afterwards. • Reply. The Reply action reads the conversation visible on screen to suggest an answer. That text goes to the model you chose, like any other text. • History. Your actions, inputs and outputs are stored in a local database on your Mac so you can search them. You can delete entries in the app. The app does not send this data to me. • API keys. Your cloud API keys are stored in the macOS Keychain on your Mac. • Licence checks. The app contacts api.tonemateai.com when you activate or deactivate a licence, when it starts, every 2 hours while it runs and when your Mac wakes up. It sends the licence key and the device data described in section 3. The server answers with a signed lease that lets the app work offline for up to 7 days. • Crash reports. In release builds the app sends crash and error reports to Sentry (section 3). • Updates. The app checks for updates through Sparkle; the update server sees your IP address and the app version. • Downloads you start. If you download local models (from Hugging Face, Ollama, GitHub or Homebrew) your Mac connects directly to those services, which receive your IP address under their own policies. • The app contains no advertising or analytics SDKs. The only third-party components that contact the internet on their own are Sentry (crash reports) and Sparkle (updates). If you process text that includes other people's personal data, for example a conversation you reply to, you are responsible for having a legitimate reason to do so and for choosing a model that fits that use.
8. Security
• Connections to the website and the API use HTTPS. • Passwords are stored as hashes, never in clear text; device identifiers are hashes. • Licence checks are rate-limited to make licence keys impractical to guess. • Database backups are encrypted before leaving the server. • Access to servers and providers is limited to me and protected with credentials and keys. • Card data never reaches my systems. If a data breach is likely to put your rights at risk, I will notify the Spanish Data Protection Agency within 72 hours and, when the risk is high, you as well.
9. Your rights
Under the GDPR and Spain's LOPDGDD, you have the right to: • Access your personal data. • Rectify inaccurate or incomplete data. • Erase your data ("right to be forgotten"), except what I must keep by law, such as invoices. • Restrict the processing of your data. • Data portability: receive the data you gave me in a common format. • Object to processing based on legitimate interest. • Withdraw your consent at any time (analytics), without affecting what was done before. To exercise any of these rights, write to support@tonemateai.com. I may ask you to confirm your identity first. I will answer within one month. If you think I have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the authority of your country. Giving me your email address is necessary to get a licence or a trial. Without it I cannot provide them. Everything else you give me is optional.
10. Automated decisions
I do not take decisions that have legal effects on you based solely on automated processing and I do not profile you. One automatic action exists: a licence is revoked when its payment is fully refunded or charged back. If you think this happened by mistake, write to support@tonemateai.com.
11. Age requirement
ToneMate AI is intended for users aged 16 and over. I do not knowingly collect personal data from people under 16. If you believe I have collected data from a minor, contact me at support@tonemateai.com and I will delete it.
12. Changes to this policy
I may update this policy, for example when I add a provider or a feature. The date at the top shows the latest version. If a change is material, I will tell you by email (if I have your address) or with a notice on the website.
13. Contact
For any question about this policy or your data: Email: support@tonemateai.com