Scope and contact
This policy covers the ToBase website, console, API gateway, Playground and related account and payment services. In this policy, “we” refers to ToBase as the provider of these services. Personal information includes information that identifies or can be linked to you. Contact hello@tobase.ai about privacy or personal information requests.
This policy describes processing by ToBase. Identity, payment, model and other third-party services you use may independently process information under their own privacy policies.
Account, sign-in and contact information
We process your account identifier, username, sign-in method, provider identity, email and verification status, avatar, language and theme preferences to maintain your account, authenticate you, support workspace collaboration and deliver service notices. Email-code sign-in verifies the address and code you submit. You may set a password for a verified email; we retain a salted password hash rather than retrievable plaintext. Setting or resetting a password uses a dedicated email code and invalidates prior sessions. Service notices may also use a separate notification email you configure.
When you sign in through Google or GitHub, we obtain necessary identity, public profile and email information within the granted permissions. We mark an email as verified only when supported by trusted verification information. Your account may lack a verified email if the provider does not supply it or the required permission is absent. We do not infer that a public email, notification email or another account belongs to the same identity.
Model inputs, outputs and training
Text, images, audio, tool calls and other model inputs pass through the ToBase gateway for the time needed to process your request and are forwarded to the provider serving it. Provider responses pass through the gateway back to you. Routing, protocol handling and usage calculation require temporary processing of this data.
The current service does not persist new model request or response bodies or include them in request logs, databases, disks, object storage or backups, and does not use those inputs or outputs to train or fine-tune models. Request details do not provide historical request or response bodies; Playground displays responses through the live connection. This does not mean that no data is processed or that the usage and billing metadata described below is not retained.
Upstream providers may retain inputs or outputs, or specify uses such as model improvement and abuse prevention, under their own policies. ToBase's non-retention of bodies does not replace an upstream commitment. Consider the actual provider's data practices when choosing a service. A model or channel ZDR flag records an administrator's zero data retention declaration; it is not a universal guarantee or independent certification of all providers or channels.
Usage, billing and security metadata
We retain metadata needed for billing, reconciliation and diagnostics, including request ID, account and workspace, API key identifier, model and provider, channel, timestamps, status, latency, token usage, prices, discounts, charges and necessary diagnostic categories. An API key identifier is not the full secret. Full keys, session credentials, sign-in codes and model bodies are not written to operational logs.
Access control, rate limits and abuse prevention also involve processing network addresses, security verification results and relevant access and administration events. Usage statistics and financial records support service operations and accounting. Non-retention of model bodies does not delete these separate records.
How information is used
We use information to provide the service, maintain accounts and workspaces, route requests, calculate charges, process top-ups and refunds, send necessary notices, answer support requests, prevent fraud and protect security. Necessary records may also be retained and used to meet applicable legal obligations, resolve disputes or exercise lawful rights.
Processing must have a basis required by applicable law, such as providing the service you request, meeting legal obligations or, where permitted, protecting legitimate interests of the service and its users. Where separate consent is legally required, we will seek it as required. Withdrawal of consent does not automatically undo earlier lawful processing.
Workspaces and service providers
Workspace owners and administrators can view and manage member information, quotas, usage and spending within their permissions. Ordinary members can access only resources and spending information authorized for them. Platform staff access for operations, security and finance is separately authorized. Consider a shared workspace's administration arrangements before joining.
Information needed for particular functions is shared with the actual model provider and relevant infrastructure, storage, identity, email and payment services. For example, email delivery requires the recipient address and necessary code, invitation or notice content. Information you voluntarily send to support is used to handle that communication. Do not send full API keys or other sign-in credentials in support messages.
Where required by applicable law, or to lawfully address fraud, security incidents or rights disputes, relevant records may be disclosed to competent authorities or other necessary recipients. Such disclosures are limited by applicable law and necessity.
Avatars and object storage
User avatars you upload, and model icons and supplier avatars uploaded by administrators, are stored in Cloudflare R2 for display on the website and console. Current images can be accessed through their public display URLs. External avatars supplied by identity providers may also be served directly by those providers. You can replace or remove your own avatar in account settings.
Removing or replacing an avatar in the interface is distinct from final cleanup of objects, caches and backups. Requests to delete stored personal information are handled under this policy's retention rules and applicable law. Model request and response bodies are not stored with avatars.
Payments, invoices and financial information
Payments use Stripe's hosted checkout. ToBase does not collect full card numbers or CVCs. We receive and retain necessary orders, payment identifiers, amounts, currencies, payment methods, statuses, payer information and refund and dispute results for verification, billing, financial audit and dispute handling. Stripe and the relevant payment method providers also govern their collection and processing of payment information.
Where a recharge has a Stripe invoice, a download verifies the original order's association with the invoice and retrieves the file from Stripe. Necessary audit records are retained for top-ups, adjustments, refunds and downloads. Removing account information does not automatically erase financial records still needed under law or for disputes.
Cookies, preferences and security checks
Sign-in and authentication use necessary session, security and temporary third-party sign-in cookies. Your browser also stores language, theme and current workspace preferences. You can manage storage through browser settings; blocking essential cookies may prevent sign-in or security checks. Signing out revokes the corresponding server-side session.
When email sign-in security verification is enabled, the page loads Cloudflare Turnstile. Cloudflare processes necessary device, browser and network signals to distinguish legitimate visits from automated abuse. Our server submits the verification token and trusted client IP for validation. Cloudflare's Turnstile privacy information applies to that processing. This check is not used for personalized advertising by ToBase.
Processing locations and security
ToBase serves users across regions, and model providers and infrastructure may be located outside your jurisdiction. Processing locations depend on the actual provider and related services. A domain, an individual server location or an R2 endpoint does not mean all information is processed only in that region. A ZDR flag is not a data localization arrangement.
We use controls such as access restrictions, credential protection, authorization checks and audit trails to reduce unauthorized access risks. Networks and third-party systems cannot be guaranteed absolutely secure. If your use requires a particular processing region, data agreement or other compliance arrangement, contact us to confirm the applicable conditions before submitting the relevant data.
Retention, deletion and your rights
Account information is retained as needed to maintain your account and provide related services. Usage metadata and financial and security audit records are retained as needed for accounting, diagnostics, security, disputes and applicable legal obligations. Retention needs differ by record type, and backup and cache cleanup may follow removal from live systems. Model bodies are not included in these retained records.
To the extent provided by applicable law, you may request access, correction, deletion or a copy of personal information, or request restrictions, object to processing or withdraw consent. Send requests to hello@tobase.ai. We will verify your identity and authority and explain the applicable process and retention exceptions. Profile editing does not replace other requests available under law.
Closing an account or leaving a workspace does not automatically cancel existing charges, disputes or required audit records. Requests involving other members, third-party information or necessary financial evidence may require lawful restrictions or separate handling. Any right to complain to a supervisory authority under applicable law remains available.
This policy describes current service practices. Data or historical backups that may have been created by earlier versions are handled separately according to retention needs and applicable deletion requests. Removing body storage does not mean every historical copy was immediately physically erased.
Children and policy updates
The service is primarily intended for developers and organizations and is not specifically directed to children. Use must meet the contractual capacity and provider eligibility requirements in the terms of service. If you believe a child submitted personal information without meeting the applicable requirements, contact hello@tobase.ai so that we can review and address it.
This policy may change with the service and legal requirements, and we will update the date on this page. Material changes to personal information processing will be brought to your attention in the service or through an appropriate service contact channel. Any legally required consent will be handled as required. Policy changes do not arbitrarily cancel retention obligations for financial records or your mandatory statutory rights.