Privacy Policy

Last Updated: August 15, 2026

This privacy policy explains how Toggles handles your personal information and data, and applies to all of the products, services and websites offered by Toggles and their affiliates (collectively, “Toggles”), except where otherwise noted. Toggles products, services and websites are collectively referred to as the “services” in this policy. Unless otherwise noted, all services are provided by Toggles, which is based in the United States.

In this policy, “you” refers to those who use and/or interact with any or all of our products, services, and websites, and “we”, “us”, and “our” refer to Toggles. “Customer”(s) refers specifically to those who use Toggles services.

INFORMATION WE COLLECT

From Our Customers

• Registration information. When you register for an account with us so you can use our email add-in or extension, we collect your email address.
• Billing information. If you make a payment to Toggles, we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date). If you provide a billing address, we will regard that as the location of the account holder. Our integrations with third party payment gateways are for processing only. We don't store or log any sensitive cardholder data provided by you. We follow industry-standard best practices to protect the security of cardholder data during processing and transmission.
• Account settings. Our customers can set various preferences and personal details on pages, such as your account settings page. For example, your default language, timezone and communication preferences (e.g. opting in or out of receiving marketing emails from us).
• Data you use to create workflows and actions is owned by you. Toggles treats your workflows and actions as private, unless you make them available to members of the public. We don't sell or make workflows or actions you've created available to anyone for purposes unrelated to you or our services, except in a limited set of circumstances (e.g. Toggles is compelled by a subpoena or court order, or if you've given us permission to do so). Images embedded in workflow email content are an exception: they are stored at public URLs so recipients' email clients can retrieve and display them. Anyone with an embedded image's URL can retrieve it, so you should not place sensitive or confidential information in embedded images. During ordinary compose or reply use, current-draft content remains local to Outlook. When you explicitly save a workflow from a draft, the draft's body, subject, recipients, attachments, and embedded images, when present, are transmitted to and stored by Toggles to build the workflow template.
• For organizational customers, groups and teams are owned by the customer. Toggles treats your groups and teams as private. We don't sell or make groups or teams you've created available to anyone for purposes unrelated to you or our services.
• Workflows and actions data is stored on servers located in the United States. More information is available if you are located in Europe - Please contact our Customer Support Team for more information if you reside in Europe. Toggles will process your workflows and actions data on your behalf and under your instructions and pursuant to this privacy policy. This US-region statement applies to primary customer application, workflow, and file data stored in AWS and Supabase. Analytics, billing, identity, and transactional-email providers may process service data under their own infrastructure, terms, and privacy notices.

From Visitors to Our Websites

• Usage data. We collect usage data when you interact with our services. This may include which web pages you visit, what you click on, when you performed those actions, and so on. Additionally, like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, and timestamps.
• Device data. We collect data from the device and application you use to access our services, such as your IP address, operating system version, device type, system and performance information, and browser type. We may also infer your geographic location based on your IP address.
• Referral data. If you arrive at a Toggles website from an external source (such as a link on another website or in an email), we record information about the source that referred you to us.
• Information from third parties. We may collect your personal information or data from third parties, if you have given permission to those third parties to share your information.
• Website analytics and browser storage. We use Google Analytics 4 and PostHog to understand how visitors find and use our websites and how users interact with product and marketing features. Depending on the service and browser settings, these tools may process page URLs, referring URLs, UTM campaign parameters, interaction events, timestamps, browser and device information, IP addresses or IP-derived location information, and identifiers stored in cookies or browser storage. We also use session storage to retain initial referral and campaign attribution during a browser session.
• How analytics are configured. PostHog automatic element capture and session recording are disabled on the Toggles website. We send defined events such as page views, workflow-library interactions, and clicks to AppSource, signup, or walkthrough destinations. These website analytics are not intended to include the contents of Outlook emails, email drafts, recipients, attachments, workflow text, or values entered into workflow templates.
• Analytics providers. Google and PostHog process analytics information as service providers under their applicable terms and privacy notices. You can review the Google Privacy Policy and the PostHog Privacy Policy.

HOW WE USE AND DISCLOSE YOUR INFORMATION

Customers

We treat workflows and actions as information that is private, unless a party other than Toggles has made that information public. We don't use workflow or action data other than as described in this privacy policy without our Customers' consent. We don't sell Customers' workflow or action data, nor do we make it available to third parties without the Customer's permission.

We use information gathered from and provided by our Customers to do the following for our Customers:

Provide services and technical support, assist them with workflow and action creation, provide technical troubleshooting, manage our relationship with them, and to gather information on how they use our services.

To manage our services. We use your information, including certain workflow and action data, for the following limited purposes:

• To monitor, maintain, and improve our services and features.We internally perform statistical and other analysis on information we collect, including usage data, device data, referral data, workflows and actions data and information from page tags, to analyze and measure user behavior and trends, to understand how people use our services, and to monitor, troubleshoot and improve our services, including to help us evaluate and design new features. We may use your information internally in order to keep our services secure and operational, such as for troubleshooting and testing purposes, and for service improvement, marketing, research and development purposes.
• To enforce our Terms of Use.
• To prevent potentially illegal activities.

To create new services, features or content. We may use your workflow and action data for our internal purposes to create and provide new services, features or content. Regarding workflow and action data, we may look at statistics like types of workflows and usage, and publish interesting observations about these for informational or marketing purposes. When we do this, no data will be identified or identifiable unless we have obtained the user's permission.

To contact you about your service or account. We will occasionally send you communications of a transactional nature (e.g. service-related announcements, billing-related matters, changes to our services or policies, a welcome email when you first register). You are prevented from opting out of this type of communication since it is required to provide our services to you.

To contact you for marketing purposes. We will send you promotional emails at times about new features and company information. You may opt out of these communications at any time by clicking on the “unsubscribe” link in them, or changing the relevant setting on your Account page.

To respond to legal requests and prevent harm. If we receive a subpoena or other legal request for information, we may need to inspect the data held to determine the appropriate response.

Website visitors

See the section above regarding information related to visitors to our websites. We use that information, including but not limited to cookies, customer data, usage data, device data, referral data and information from page tags, to manage and improve our services, to serve and support our Customers, for research purposes, and for the other various purposes described in this privacy policy.

No Sale or Leasing of Your Information

We will not sell or lease your personal information to any third party. We may disclose aggregate demographic and statistical information with our business partners, but this information is not specific to the identification of you as an individual.

Generally

We may disclose information with third parties, for limited purposes, as follows:

• Your information to our service providers. We use service providers who help us to provide you with our services. We give some personnel of these providers access to your information, but only to the extent necessary for them to perform their services for us. Our contracts with our service providers require them to maintain technical protections to ensure the confidentiality of your personal information and data, to use it only for the provision of their services to us, and to handle it in accordance with this privacy policy. Examples of service providers include payment processors, hosting services, email service providers, and web traffic analytics tools. Current providers include Amazon Web Services (cloud hosting), Supabase (authentication, database, and storage), Microsoft Azure (Microsoft app registration and identity integration), Resend (transactional email), PostHog and Google Analytics (analytics), and Stripe (subscription billing and payment processing).
• Your account details to your billing contact. If your account holder details are different from the billing contact listed for your account, we may disclose your identity and account details to the billing contact upon their request. We typically will attempt to notify you of such requests. By using our services and agreeing to this privacy policy, you consent to this disclosure.
• Your email address to your organization. If the email address under which you've registered your account belongs to or is controlled by an organization, we may disclose that email address to that organization in order to help it understand who associated with that organization uses our services, and to assist the organization with its business accounts.
• Aggregated or de-identified (anonymized) information to third parties to improve or promote our services.We do this so that no individuals can reasonably be identified or linked to any part of the information we share with third parties to improve or promote our services.
• Your information if required or permitted by law. We may disclose your information as required or permitted by law, or when we believe that disclosure is necessary to protect our rights, protect your safety or the safety of others, and/or to comply with a judicial proceeding, court order, subpoena, or other legal process served on us.
• Your information if there's a change in business ownership or structure.If ownership of all or substantially all of our business changes, or we undertake a corporate reorganization, including a merger, acquisition or consolidation or any other action or transfer between Toggles entities, you expressly consent to Toggles transferring your information to the new owner or successor entity so that we can continue providing our services.
• Information you expressly consent to be shared. For example, Toggles may expressly request your permission to provide your contact details to third parties for various purposes, including to allow those third parties to contact you for marketing purposes. If you give your permission, you may later revoke your permission, but if you wish to stop receiving communications from a third party to which we provided your information with your permission, you will need to contact that third party directly.

Please note that, if you're a Customer who has entrusted us with safeguarding the privacy of your personal information, we will not disclose or share it with third parties unless we have (a) given you notice, such as in this privacy policy, (b) obtained your express consent, such as through an opt-in checkbox, or (c) de-identified or aggregated the information so that individuals or other entities cannot reasonably be identified by it. Where required by law to disclose your information, we will notify you of this before disclosing it.

By using our services or visiting our websites, you consent to the above-described disclosures.

In some cases, the applications or user interfaces you encounter while on our sites are managed by third parties, who may require that you provide your personal information. We are not responsible for the privacy practices of these third party services or applications. We recommend carefully reviewing the user terms and privacy statement of each third party service, website, and/or application prior to use.

HOW LONG WE RETAIN YOUR INFORMATION

We generally retain your information and uploaded files for as long as you have an account with us, or as long as necessary to provide services to you, comply with our legal obligations, resolve disputes, or enforce our agreements. Canceling a subscription or allowing it to expire does not automatically delete account data or uploaded files. You may request account deletion through support. After we verify the request, we delete associated account data and uploaded files from production systems. Deleted database data may remain in backups for up to seven days before expiring through the backup cycle. We may retain limited records where required by law or reasonably necessary for legitimate business purposes, such as billing, tax, fraud-prevention, and legal-compliance records.

REQUESTS TO DELETE, AMEND OR WITHDRAW CONSENT – NON-EEA OR UK RESIDENTS

You may be entitled to request that we delete or amend your personal information. You may also be entitled to withdraw your consent, when consent is the basis for processing your personal information.

Legal Basis for Use of Your Information

Personal information that we collect is processed under the following legal basis:

Our legitimate interests. This includes:

• to enable us to provide our products and services and website use and access to you
• for analytics, to gather metrics to better understand how users use the our websites, and to evaluate and improve our websites
• to prevent fraud and other illegal activity
• the legitimate interests of others (for example, to ensure the security of our website)
• to comply with legal obligations, as part of our general business operations, and for other internal business administration purposes
• if we collect demographic information from you (such as gender and ethnic origin) in order to carry out diversity monitoring and such information is not collected in an anonymous format, then we rely on our legitimate interest to do so.

Contractual obligations. For the performance of contractual obligations between you and Toggles, including the Toggles Terms of Use and/or in our separate written contract with you.

Consent. Where required by law, we may process your personal information in some cases for marketing purposes on the basis of your consent (which you may withdraw at any time after giving it, as described in this privacy policy).

Your Rights

Deletion of Personal Information

You may be entitled to request that we delete your personal information in certain specific circumstances. If you wish to exercise this right, please contact our Customer Support Team. We will consider all such requests and provide our response within a reasonable period (but no longer than one calendar month from our receipt of your request unless we tell you that we are entitled to a longer period under applicable law). We may require you to verify your identity before we respond to your request. Certain personal information may be exempt from such requests in certain circumstances, including as provided for in this privacy policy.

Access, Update, Data Portability and Other Rights

You may also be entitled to access your information, update your personal information which is out of date or incorrect, restrict use of your personal information in certain specific circumstances, place a data portability request (applicable only when we use your personal information on the basis of your consent or performance of a contract, and where our use of your information is carried out by automated means), and ask us to consider any valid objections which you have to our use of your personal information where we process it on the basis of our or another person's legitimate interest. Requests should be directed our Customer Support Team.

We will consider all such requests and provide our response within a reasonable period (but no longer than one calendar month from our receipt of your request unless we tell you we are entitled to a longer period under applicable law). We may require you to verify your identity before we respond to any of your requests. Certain personal information may be exempt from such requests in certain circumstances, including as provided for in this privacy policy.

Children's Privacy

Use of our websites is intended for adults at least eighteen (18) years of age. We do not knowingly collect personally-identifying information from children under the age of thirteen (13).

HOW TO CONTACT US REGARDING YOUR PERSONAL INFORMATION

If you have any questions about this privacy policy, you may contact our Customer Support Team.

Last Update: April 10, 2024