Privacy Policy
Last updated: 2 July 2026
Introduction
Tomi.ai commits to protecting user privacy through transparent practices. This policy governs data collection on https://tomi.ai/and related channels. It outlines what personal information is gathered, how it's used, and user rights.
Scope:The policy applies when visiting the site, contacting the company, or obtaining services. It does not cover customer data processed on behalf of clients ("Customer Data").
Children:The platform is not intended for users under 16. Parents concerned about a child's account can contact sales@tomi.ai for deletion.
1. Definitions
- Platform: The online service at Tomi.ai offering services per Terms of Use.
- Personal data: Information about an identified or identifiable person (name, email, location, etc.).
- Data subject: An identified or identifiable person whose data is processed.
- Customer: An entity signing up to receive services.
- Visitor: Someone browsing without creating an account.
- Account: A customer account enabling service access.
- Controller: The entity determining processing purposes and methods.
- Processor: An entity processing data on the controller's behalf.
- Processing: Any operation performed on personal data (collection, storage, disclosure, etc.).
- Third party: Any entity other than the subject, controller, processor, or authorized personnel.
2. What Data We Collect
2.1 Directly Provided Personal Data
Contact Information: When registering, contacting support, or requesting demos, users may provide names, login credentials, company names, phone numbers, and email addresses.
Message Information: Additional personal data shared through email or forms—users should avoid disclosing sensitive information.
Survey Information: Feedback provided when users voluntarily complete user experience surveys.
Payment Information: Credit card or bank account details for purchases. A third-party processor handles this data solely for payment processing.
CV Information: Job applicants submit names, photos, phone numbers, email addresses, birthdates, education, and specialization.
2.2 Automatically Collected Personal Data
Identifiers:
- IP addresses
- Identification numbers
- Operating system details
- Browser ID
- Device and connection information
Usage Data:
- Time spent on site
- Visit frequency
- Language preferences
- Content interaction types
- Pages visited
- Features used
- Click data
- Referral sources and timestamps
The company uses cookies and tracking technologies (see the Cookie Policy). Google Analytics is employed for analytical purposes.
2.3 Data from Other Sources
Tomi.ai may purchase contact information (names, emails, phone numbers) about potential American customers from third parties.
2.4 Customer Data
Customers may provide personal data about their end-users through pixel technology. Tomi.ai acts as a processor, not a controller, and is not responsible for this collection. The customer determines collection purposes and must provide appropriate notices.
3. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Account management and service provision | Performance of contract |
| Customer support and request handling | Performance of contract |
| Payment processing and invoicing | Performance of contract |
| Marketing communications to customers | Legitimate interest |
| Survey analysis for improvement | User consent |
| Security and fraud prevention | Legitimate interest |
| Site improvement and personalization | User consent |
| Targeted advertising and campaigns | User consent |
| Legal compliance and record-keeping | Legal obligation |
Legal Grounds Explained
Performance of Contract: Processing is necessary to fulfill contractual obligations.
Consent: Users expressly authorize certain data processing. Users may withdraw consent anytime by contacting the company, though withdrawal doesn't invalidate prior processing.
Legitimate Interest: Processing serves the company's essential interests, such as platform security and user experience, using only strictly necessary data.
Legal Obligation: Processing complies with GDPR or national law requirements.
5. Data Sharing and Disclosure
Sharing with Other Controllers
Google Ads (Google LLC, USA): Delivers relevant online advertising. Privacy policy.
Sharing with Data Processors
Tomi.ai partners with third parties for specialized services under data processing agreements and NDAs:
- Google Analytics (Google LLC, USA): Statistical site usage analysis.
- Google Cloud Platform (Google LLC, USA): Secure data transfer and storage.
- Google Workspace (Google LLC, USA): Communication and survey tools.
- Stripe Payment System: Payment processing.
- HubSpot CRM (HubSpot, Inc., USA): Customer relationship management.
- Seamless.AI (Seamless Contacts Inc., USA): Sales lead development.
- PandaDoc (PandaDoc, Inc., USA): Document management and e-signature.
- TypeForm (TYPEFORM, S.L., Spain): Survey creation.
- Contractors in the US, Mexico, Spain, Portugal, Kazakhstan, and Turkey (technical specialists, sales/marketing staff, legal/accounting professionals).
Google API Compliance: Tomi.ai adheres to Google API Services User Data Policy and Limited Use requirements.
6. Transferring Data Outside the European Economic Area
Personal data may be transferred to countries outside the EU/EEA. Where adequate protection standards don't apply, Tomi.ai implements Standard Contractual Clauses (SCC) and supplementary safeguards per GDPR Articles 45-46.
Under GDPR Article 49, transfers may occur based on:
- User consent
- Contract performance or performance of user requests
- Vital interest protection
7. Data Security, Integrity, and Retention
Retention Periods
| Data Type | Retention Period |
|---|---|
| Contact & Payment Info | Active account + 6 months after deletion |
| Survey Information | 6 months (then deleted/anonymized) |
| Message Information | Duration of communication + 2 months |
| CV Information (No Offer) | 6 months after hiring process ends |
| CV Information (Job Offer) | Employment period + legally required duration |
| Automatically Collected Data | Per Cookie Policy |
Users may request deletion at sales@tomi.ai.
Security Measures
Tomi.ai implements organizational, technical, administrative, and physical safeguards against unauthorized access, disclosure, and modification. Security procedures are regularly reviewed, though no system is 100% secure.
8. Your Rights
Note: If a Tomi.ai customer provided your data and acts as controller, exercise rights against that customer.
Right of Access
Users may request copies of their personal data and information about processing, recipients, retention periods, automated decision-making, data sources, and international transfers.
Right to Rectification
Users may request correction or updating of inaccurate or incomplete information.
Right to Erasure ("Right to Be Forgotten")
Users may request deletion except where prohibited by law. Deletion applies when:
- Data is unnecessary for original purposes
- Consent is withdrawn with no other legal basis
- User objects to processing with no overriding grounds
- Data was unlawfully processed
- Deletion is required for legal compliance
Note: After deletion, the company likely cannot provide services.
Right to Restriction of Processing
Users may request processing restrictions when:
- Data is inaccurate or outdated
- Processing is unlawful (opposing erasure)
- Data is no longer needed except for legal claims
- User objects under GDPR Article 21 pending verification
Right to Data Portability
Users may request data transfer to another organization in a structured, machine-readable format when processing is based on consent or contract and performed automatically.
Right to Object
Users may object to processing based on legitimate interests or direct marketing. The company will cease processing unless it demonstrates compelling grounds overriding user rights or establishing legal claims.
Right Against Automated Decision-Making
Users have the right not to be subject solely to automated decisions producing legal or similarly significant effects, except where necessary for contracts, authorized by law with safeguards, or based on explicit consent.
Note: Tomi.ai does not currently use automated decision-making.
Right to Withdraw Consent
Consent withdrawal is possible anytime, though it doesn't retroactively invalidate prior processing.
Right to Lodge a Complaint
Users may file complaints with their national supervisory data protection authority.
Exercising Rights
Submit requests to sales@tomi.ai. The company may request additional information to verify identity.
9. Additional Disclosures for California Residents
This section supplements the main policy for California residents under the California Consumer Privacy Act (CCPA).
9.1 Categories of Personal Data Collected (Past 12 Months)
- Identifiers: Full names, login credentials, phone numbers, company names, email addresses, online identifiers.
- Commercial Information: Purchase records of services.
- Internet Activity Information: Usage data from browsing.
- Professional/Employment Information: Education and work-related details.
- Other Data: Communication records, payment information, survey responses.
The company will not collect additional categories or use data for materially different purposes without prior notice.
9.2 Sources of Collection
- Direct submission (site visits, registration, purchases, communication, job applications).
- Automatic collection through server and analytics services.
- Third-party service providers (payment processors, survey platforms).
- Third parties selling contact information.
9.3 Collection Purposes
See Section 3 ("Purposes and Legal Bases").
9.4 Third-Party Sharing
See Section 5 ("Data Sharing and Disclosure").
9.5 California Resident Rights
9.5.1 Right to Access. Users may request disclosure of:
- Categories of personal data collected
- Sources of collection
- Business purposes for collection or sale
- Categories of third-party recipients
- Specific pieces of collected personal data
9.5.2 Right to Deletion. Users may request deletion of collected personal data, subject to legal exceptions. The company will delete data from records upon verified request.
9.5.3 Right to Non-Discrimination. Exercising privacy rights will not result in discriminatory treatment.
Exercise of Rights: California residents may submit requests to sales@tomi.ai or designate an authorized agent. The company will verify identity appropriately.
Definition: "California resident" means individuals in California for purposes beyond temporary or transitory, or those domiciled there while temporarily elsewhere.
10. Changes to the Privacy Policy
The company may update this policy due to new technologies, industry practices, legal requirements, or other reasons. Changes are posted on this page; major changes receive prior notice via email, account alerts, or conspicuous site notices.
Users are encouraged to regularly review the policy for updates.
12. Contact Us
Email: sales@tomi.ai
Address: 440 N. Wolfe Rd., Sunnyvale, CA 94085
Phone: (+1) 917-720-3264