Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Toolend ("we", "us") collects, uses, stores and protects your personal data when you use our service at toolend.app (the "Service").

1. Who we are

Toolend is operated by an independent business based in Spain. For any data protection inquiry contact legal@toolend.app.

2. Data we collect

We collect only what is necessary to run the Service:

• Account data: your email address, password (hashed), display name if provided.
• Workspace data: tool names, photos, descriptions, categories, people you lend to, loan history. Provided by you.
• Subscription data: plan tier, billing status, renewal date. Payment data itself is handled by LemonSqueezy and we never see your card details.
• Technical data: IP address, browser type, basic logs. Retained for up to 30 days for security and debugging only.

3. Why we use it

• To provide the Service (manage your account, store your workspace data).
• To send transactional emails (password resets, workspace invitations, billing notifications).
• To respond to support requests when you contact us.
• To comply with legal obligations (tax, accounting).

We do not sell your data, share it with advertisers, or use it for advertising profiling.

4. Legal basis (GDPR)

• Contract: processing required to deliver the Service.
• Legitimate interest: security, fraud prevention, service improvement.
• Legal obligation: tax invoices, accounting records.
• Consent: only for optional features like push notifications.

5. Service providers (sub-processors)

We use the following companies to operate the Service:

• Vercel (USA / EU) — hosting and CDN.
• Supabase (EU - Ireland) — database, auth, storage.
• Resend (EU) — transactional emails.
• LemonSqueezy (EU / USA) — payments and invoicing (Merchant of Record).
• Cloudflare (global) — DNS and security.
• Google (USA / EU) — optional sign-in.

All transfers outside the EU rely on Standard Contractual Clauses where applicable.

6. Data retention

• Account and workspace data: while your account is active.
• If you delete your account: removed within 30 days.
• Backups: kept for up to 30 days, then permanently erased.
• Invoices: 6 years (Spanish accounting law).

7. Your rights

Under GDPR you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your account and personal data.
• Export your data (we provide CSV export of loan history).
• Restrict or object to processing.
• Withdraw consent at any time.
• Lodge a complaint with the Spanish Data Protection Agency (AEPD).

Most rights are exercised directly in the app (Settings → Account → Delete account, CSV export). For anything else write to legal@toolend.app.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Row Level Security isolates each workspace. We follow industry best practices and rely on providers with SOC 2 / ISO 27001 certifications.

No system is 100% secure. If we discover a breach affecting your data we will notify you within 72 hours where required by law.

9. Cookies

We use only strictly necessary cookies (session authentication, theme preference). No advertising or third-party tracking cookies are used.

10. Children

The Service is not directed to children under 16. We do not knowingly collect data from them.

11. Changes

We may update this Privacy Policy. Material changes will be notified by email or in-app banner. The "Last updated" date at the top reflects the current version.

12. Contact

Data protection contact: legal@toolend.app
General support: support@toolend.app