Privacy policy
Tooduu is an email assistant for freelancers, run from the UK. You send us email; we turn it into organised work. That means we handle your data, and here is exactly how.
What we collect
- Your email address, used to run your account.
- The emails you choose to send or forward to todo@tooduu.com, including attachments.
- The structured data our AI extracts from those emails — jobs, deadlines, to-dos, notes, and anything you ask Tooduu to remember.
We don't buy data about you, track you across the web, or use advertising cookies. The marketing site sets no tracking cookies at all.
How your data is processed
Emails you send to Tooduu are processed automatically: each message is passed to our server, an AI model extracts the useful details, and the result is stored in your account. No human reads your email. Raw inbound messages are processed and discarded — they never sit in a browsable inbox.
Tooduu runs on a small number of vetted service providers acting under our instructions — email delivery, secure UK/EU cloud database hosting, AI processing, and (once billing is live) payment processing. We never sell your data.
Where it's stored, and how it's protected
- Structured data lives in our database, hosted in London (UK/EU region), with row-level security so your rows are only ever yours.
- Sensitive material — the verbatim source emails attached to jobs, and anything you save as sensitive (passcodes, logins) — is additionally encrypted with AES-256-GCM before it is stored. Even our database administrators cannot read it.
- Attachment files themselves are never stored, only the text we extract from them.
How long we keep it
- Your data is kept while your account is active.
- Email conversation logs are pruned automatically after 90 days.
- If your trial ends without you subscribing, or a subscription lapses or is cancelled, nothing disappears straight away: your account enters a 35-day grace period. We'll email you a heads-up before the end of it, and picking Tooduu back up at any point during those 35 days restores everything exactly as you left it.
- After the grace period, your data is permanently deleted — everything, including encrypted source emails and saved items.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, or ask us to delete everything. Just email help@tooduu.com— or tell Tooduu “delete my account” and it will confirm and remove all of your rows within 30 days.
Lawful basis
We process your data on the basis of contract: you sign up so that Tooduu can read the emails you send it and organise your work. That's the whole arrangement.
Questions
Anything unclear? Email help@tooduu.com and a human (Dan) will reply.
Tooduu is a trading name of We Are Inhouse Ltd, the data controller for the information described above. Registered in England & Wales, company no. 16220264. Registered office: 66 Paul Street, London, England, EC2A 4NA.