[PRIVACY NOTICE · DRAFT FOR LEGAL REVIEW]
Privacy notice.
What personal data ToneBridge collects, why, where it is processed and for how long, and how to exercise your rights. Questions go to hello@tonebridge.io.
Who we are
ToneBridge is provided by [M7 legal entity name], [Registered address] (“M7”, “we”).
- For this website and the enquiries sent through it, M7 is the controller of your personal data.
- For the content a client puts into its ToneBridge workspace, the client is the controller and M7 processes that content on the client’s behalf, under the client’s agreement with us. A data processing agreement is available on request.
What we collect
| [WHERE] | [WHAT] |
|---|---|
| Brand Language Audit form | Your name, work email, organisation, the languages or markets you choose, your message, and the plan or request type you came from. |
| Workspace accounts | Your name, work email, role and workspace; sign-in events; and an audit trail of what you create, change, approve or send back. |
| Workspace content | Text and documents you adapt, their translations, terminology, voiceprints, segments and audiences. This is the client's data, processed for the client. |
| Technical data | IP address, browser and request details in the logs our hosting providers keep for security and troubleshooting. |
ToneBridge sets only the cookies needed to keep you signed in. It uses no analytics, advertising or tracking cookies. Bridge keeps an unsent draft in your own browser’s storage so you don’t lose work; it never leaves your device until you run it.
How we use it
- To reply to your enquiry and arrange an audit, demo or call. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering.
- To provide the service: sign-in, adaptation, review, export and support. Legal basis: our contract with your organisation.
- To keep it secure: detecting abuse, investigating incidents and keeping the audit trail. Legal basis: legitimate interests, and legal obligations where they apply.
We don’t sell personal data, and we don’t send marketing email without your consent.
AI processing
When you run an adaptation, the source text, the terminology and voice that apply, and the settings you chose are sent to an AI model provider to produce the output. By default that is Anthropic. A client can instead use its own Anthropic account or its own Azure OpenAI deployment, in which case the content goes to that account under the client’s own agreement.
Your content is not used to train models: Anthropic does not train on API inputs or outputs by default, and an Azure OpenAI deployment stays inside the client’s own subscription.
Service providers
| [PROVIDER] | [WHAT IT DOES] | [WHERE] |
|---|---|---|
| Supabase | Database, sign-in and file storage | Frankfurt, Germany (EU) |
| Vercel | Hosting and application servers | Frankfurt, Germany (EU), with a global edge network |
| Anthropic | AI model that produces adaptations | United States |
| Resend | Sign-in and notification emails | United States |
Where data leaves the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses or an equivalent safeguard.
How long we keep it
- Enquiries: [24 months], unless they lead to a contract.
- Workspace accounts and content: for as long as the client’s agreement runs. Each workspace can set a retention period after which uploaded source documents are destroyed automatically.
- When an agreement ends, the client can export its data for [30 days]; the workspace and its content are then deleted.
- Hosting and security logs: as long as each provider keeps them, typically days to weeks.
Security
- Data is encrypted in transit and at rest.
- Every workspace is isolated at the database level, and roles decide who can view, edit or approve.
- AI keys a client supplies are encrypted before they are stored.
- Approvals, changes and deletions are recorded in an audit trail.
Your rights
Depending on where you live, you can ask to access, correct or delete your personal data, to restrict or object to how it is used, and to receive a copy in a portable format. Email hello@tonebridge.io. If your data is in a client’s workspace, we’ll pass your request to that client, as it decides what happens to it.
You can also complain to your data protection authority. We’d appreciate the chance to put things right first.
Changes
If this notice changes, the new version appears here with its effective date. If a change affects how we use data you’ve already given us, we’ll tell affected clients before it takes effect.