Privacy Policy

BARS AI LTD (“we”, “us”, “controller”) operates Toolsy at toolsy.tools. Registered address: 128 City Road, London, EC1V 2NX, United Kingdom.

This Privacy Policy explains how we process personal data when you use the website, account features, paid plans, OCR API, and embed widgets. It is written for the UK GDPR and the Data Protection Act 2018. If you are in the EEA, we apply equivalent standards where required.

Privacy questions: hello@toolsy.tools.

This Policy covers:

• Visitors to toolsy.tools (with or without an account).
• Registered users (email/password or Google sign-in), including Pro and Plus subscribers.
• Developers and site owners who create API keys or embed widgets.
• End users who upload files through a Toolsy embed widget on a third party site (we process the upload to run the tool; the site owner is typically a separate controller for how they collect and use results).

By using Toolsy you acknowledge this Policy. Where we rely on consent (for example optional analytics cookies), we ask for it separately — see the Cookie Policy.

3.1 Account data — email address; display name; password hash (we never store plaintext passwords); Google account identifier if you choose “Continue with Google”; plan status and expiry; favourites; optional product settings (for example saved charts or widgets you create).

3.2 Payment data — handled by Stripe. We store subscription/payment status and Stripe customer and subscription ids, not full card numbers. Stripe may process billing address and tax details as needed for checkout.

3.3 Technical data — IP address (for example at signup, rate limits, security logs); User-Agent; session identifiers; API key identifiers and usage counters; approximate request timestamps; daily freemium limit counters tied to technical identifiers and/or your account.

3.4 Activity metadata — for signed-in users we may keep a short activity history (tool used, original filename, time). History does not store the full file contents. Retention: about 30 days (see section 9).

3.5 Content you submit — text you paste, files you upload (PDF, images, documents), and the machine-generated outputs returned to you. Content may include personal data about you or third parties; you are responsible for having a lawful basis to submit it.

3.6 SEO research inputs — keywords, location/language choices, and related query parameters you send when using Plus SEO research tools (processed via DataForSEO).

3.7 Communications — messages you send to hello@toolsy.tools, and transactional emails we send (password reset, billing notices).

We do not treat OCR as biometric identification under UK GDPR special-category rules: handwriting/print recognition extracts text; it is not used to uniquely identify a person by biological characteristics.

Many tools work without registration. In that case we still process technical data (IP, User-Agent, request metadata, freemium counters) to provide the feature, enforce daily limits, and protect the service.

Client-side tools (for example many text/QR utilities) process content in your browser and do not upload the paste to our servers. Tools that need a server (OCR, document conversion, image pipelines, AI text, SEO research, and similar) send content only when you run that tool. Product pages state when a server or AI provider is involved.

When you (or a visitor to your embed widget) upload a file for OCR or another server-side tool:

• We process the file to produce the requested output and return it to the client.
• For vision/OCR and certain AI features, image or text content is sent to our AI gateway (OpenRouter) and underlying model providers so the model can generate the result.
• Uploaded files are processed for the request and are designed to be discarded shortly afterwards (typically within about one hour). We do not use your uploads to train our own models.
• Operational logs may keep non-content metadata (tool slug, truncated filename, token/cost metrics, latency) for reliability, abuse prevention, and cost control.
• OCR API and embed usage count against the account owner’s quotas. API request logs may record key id, status, and timing — not the full document body.

Do not upload content you are not allowed to process. Avoid sending secrets, passwords, or highly sensitive special-category data unless you accept the residual risk of cloud AI processing.

We use personal data to:

• Provide tools, accounts, sessions, API keys, and widgets.
• Enforce freemium limits and paid entitlements.
• Process payments and manage subscriptions via Stripe.
• Send essential service emails (security, billing, account).
• Prevent fraud, spam, scraping abuse, and security incidents.
• Improve reliability using aggregated or non-identifying metrics where practical.
• Comply with law and respond to lawful requests.

Legal bases (UK GDPR) include: contract (providing the service you request); legitimate interests (security, abuse prevention, product reliability — balanced against your rights); legal obligation (for example tax/accounting retention of billing records); and consent where we ask for it (optional analytics cookies). You may withdraw consent for analytics at any time without affecting core tools.

We do not sell your personal data. We use service providers who process data on our instructions, including:

• Stripe — payments, invoices, tax calculation where enabled, customer portal.
• Hosting / infrastructure — servers, databases, and Redis used to run Toolsy (accounts, sessions, limits, keys).
• Google — only if you use Google sign-in (authentication).
• OpenRouter and model providers — content needed for OCR / AI tools you run.
• DataForSEO — keyword/SERP research queries for Plus SEO tools.
• Email delivery — transactional mail (password reset, plan notices).
• Google Analytics 4 (GA4) — only if you accept analytics cookies (see Cookie Policy). Analytics may not be active until we enable the script.

We may disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction (with appropriate safeguards).

BARS AI LTD is established in the United Kingdom. Some processors (including AI model providers, Stripe, Google, and SEO data providers) may process data in the UK, EEA, United States, or other countries.

Where UK GDPR requires a transfer mechanism, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses (where applicable), or an adequacy decision. Details for a specific processor are available on request at hello@toolsy.tools.

• Account data — while your account exists, then deleted or anonymised within a reasonable period after closure, except records we must keep (for example billing).
• Session cookie — about 30 days of inactivity, or until you sign out.
• Uploaded files for processing — typically discarded within about one hour after the job completes; not kept as a long-term content archive.
• Activity history — about 30 days (metadata only).
• Security / rate-limit logs — short rolling windows needed for abuse prevention.
• Billing records — as required for accounting and tax (often several years).
• Cookie consent choice — up to 12 months (or until you change it).

To delete your account, email hello@toolsy.tools from the registered address. We will remove or anonymise personal data that is no longer needed.

We use appropriate technical and organisational measures, including hashed passwords, session cookies with security attributes, access controls on infrastructure, and rate limiting. No online service is perfectly secure; please use a strong unique password and protect API keys.

Under UK data protection law you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw consent. These rights are subject to legal exceptions (for example we may retain billing records).

You may complain to the UK Information Commissioner’s Office (ICO): ico.org.uk. EEA users may also contact their local supervisory authority.

To exercise rights, email hello@toolsy.tools. We may need to verify your identity.

Toolsy is not directed at children under 16 (or the higher digital consent age in your country). We do not knowingly create accounts for younger children. If you believe a child has provided personal data, contact us and we will take appropriate steps.

We use cookies and similar technologies as described in the Cookie Policy. Strictly necessary cookies support sign-in and security. Optional analytics cookies load only if you accept them in the banner.

We may update this Policy when the product or law changes. The “updated” date at the top of the page will change. Material changes may also be highlighted on the site or by email to registered users where appropriate. Continued use after the effective date means the new Policy applies to future processing.

BARS AI LTD
128 City Road, London, EC1V 2NX, United Kingdom
hello@toolsy.tools

Related documents: Terms of Service, Cookie Policy, Pricing.

Last updated: 25 August 2026.