Privacy Policy

1. Who is responsible for your data?

TOIMU is operated by TOIMU Technologies OÜ, an Estonian private limited company with registry code 17596572. TOIMU Technologies OÜ is the controller of personal data processed through TOIMU.

Contact: hello@toimu.ee

2. Data we may process

• Account data, including your email address, authentication identifier and profile information you choose to provide.
• Activity data, such as saved places, Private Concierge plans, business claims, reports and account preferences.
• Content you submit, including corrections, descriptions and other information you send to TOIMU.
• Location data when you allow location access or choose a location in the service.
• Search data, such as search terms and filters you submit to find places or experiences.
• Technical and usage data, such as pages visited, device and browser information, approximate location, IP address, diagnostic events, security logs and pseudonymous service or telemetry identifiers where used by our service providers.
• Communications you send to us, including support and privacy requests.

3. Why we use personal data

Depending on the activity, processing is based on performance of our agreement with you, our legitimate interests in operating and securing the service, your consent, or compliance with legal obligations. You may withdraw consent at any time where consent is the applicable basis.

• To create and secure accounts and provide requested features.
• To save places, create and store Private Concierge plans, provide search and discovery results and personalise your experience.
• To review business claims, reports and corrections.
• To operate, troubleshoot, protect and improve TOIMU.
• To respond to questions and privacy-rights requests.
• To comply with legal obligations and prevent misuse.

4. Service providers

TOIMU uses Supabase for authentication, database and backend services; Vercel for hosting and, where enabled on web builds, analytics and performance services; Sentry for error and performance monitoring on web builds; Mapbox for maps, location display, address search and map/session telemetry; Google Places for place information and verification; Stripe for subscription checkout, payment processing, billing and invoices; and Resend for sending transactional account emails.

These providers may process limited technical, usage or request data needed to perform their services. Provider availability and processing may differ between the website and mobile app. Their processing is also governed by their own privacy terms. We do not sell personal data.

5. Storage and similar technologies

TOIMU may use cookies, browser storage and similar technologies to maintain authentication, remember preferences, protect the service and understand general usage and performance. Blocking essential storage may prevent account features from working.

6. Retention

Account-linked data is generally kept while your account is active. Account deletion removes your authentication account, profile, saved places, Private Concierge plans, access roles and submitted claims and reports. Business listings and necessary moderation or security history may remain, but direct user references are removed or anonymised where appropriate. Limited technical logs may remain temporarily under provider schedules or where needed for security and legal compliance.

7. International processing

Some providers may process data outside Estonia or the European Economic Area. Where required, appropriate safeguards are used, such as adequacy decisions or approved contractual protections.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection to processing. You may withdraw consent where processing relies on consent.

Send requests to hello@toimu.ee. You may also complain to the Estonian Data Protection Inspectorate or another competent supervisory authority in the EEA.

9. Children

TOIMU is not intended for children under 16, and we do not knowingly collect their personal data. Contact us if you believe a child has created an account.

10. Security and changes

We use reasonable technical and organisational measures to protect data, but no online service can guarantee absolute security. We may update this policy as TOIMU develops. Material changes will be shown by updating the date on this page and, where appropriate, providing an additional notice.