ToGoOven Privacy Policy

1. The essentials

In the current free offer, ToGoOven's local tools process your files on your device. They do not send them to our servers to carry out that processing. The website, the PWA, the local assistant and the MCP server are the channels covered by this offer. The MCP does communicate technical installation and usage data, as explained below. Remote processing and remote planning features are planned for a future offer: before enabling them we will update this policy, state what information will be sent and obtain the decision or authorization that applies. They are different features.

You do not need to create an account to use the free tools. The service may still process technical connection, security and preference data, and advertising services may process information according to your choices and the applicable law. Processing documents locally does not mean that the whole application works without external connections.

We do not sell the content of your files or your conversations. We do not use that content for advertising, to infer your political affiliation or to train artificial intelligence models. Advertising may involve other processing, explained in section 7.

2. Who is responsible and how to contact us

The controller of the data needed to run the service is the operator of ToGoOven:

• Domicile: Bogotá D. C., Colombia.
• Area in charge of data requests: Privacy Desk (Atención de Privacidad).
• Email: [email protected].

Email is the usual channel for privacy and support. We do not publish the private address of the mailbox to which messages may be forwarded. If the operator changes, we will identify the change as described in section 12.

When an organization entrusts us with processing other people's data through a remote feature, our role is determined by the specific activity. If we process that data on the organization's behalf, we act as a processor under its instructions and the applicable data processing agreement. This policy does not automatically turn an individual user into a business controller, nor does it replace that agreement.

When content stays exclusively on your device, we do not receive that content to process it on our servers. The data we do receive is explained below.

3. What information is processed and for what purpose

A. Local documents and preferences

Your browser or application may store the documents you keep, thumbnails, recognized text, folders, tags, working copies, signatures and initials, assistant conversations and results, the scanning session, preferences, files needed for offline use and models you decide to download. The vault protects the items covered by that feature according to its description and settings.

Random device or installation identifiers and local license, privacy-decision and usage data may also be stored. The identifiers do not necessarily include your name, but they may be personal data if they allow activities or devices to be linked.

You can manage local information with the available features and delete it from Account. Deleting local data does not remove files you downloaded, shared or kept outside the application, nor information that other services must manage separately. The browser or operating system may also delete storage; ToGoOven is not a backup of your documents.

B. Connection, language and security

Delivering the site and requests to the server involve receiving connection data, such as the IP address, technical browser information and the request date. We may use the approximate country of connection to suggest a language and apply regional rules where appropriate.

To protect the service, prevent fraud and apply limits, we process proportionate identifiers and technical signals, using pseudonymization where appropriate. Pseudonymizing is not the same as anonymizing. We do not use these signals to learn the content of your files or for political advertising. For security reasons we do not publish the thresholds or the precise detection rules.

C. Licenses and devices

If you activate a license, we process its identifier, plan, validity, the identifiers of authorized devices, a technical description and the usage needed to validate access, manage devices and prevent abuse. The license must be kept confidential when it works as a credential. You do not need to send us a full key by email to ask for help.

D. Optional server-side file processing

This mode is described as a future one and is not part of the current free offer. Before enabling it we will publish its terms and verify the applicable providers and retention. Before sending, the operation and the necessary data will be shown; a remote operation may need the file, its name, type and parameters. Transport encryption does not prevent the receiving server from accessing the content needed to process it.

Remote processing is not activated by having accepted the general terms. The file and the result are used for the requested operation and are handled according to the retention table. If a feature needs additional storage, this is explained before it is used; it is not presented as processing done exclusively in memory.

E. Local assistant and remote planning

The current mode interprets instructions on your device. Remote planning is a future feature. If it is enabled and you choose it, the instruction and the minimum necessary context may be sent, such as file names, types and sizes or the steps of a plan. That planning does not by itself authorize uploading the content of a file: any feature that requires it must state so separately.

Do not write passwords, license keys, tokens or secrets in a conversation that may be sent to a server. Secrets that a local tool needs are requested in specific fields and are kept out of remote planning. If that separation cannot be preserved, that operation must not be enabled with a remote assistant.

You can withdraw the choice of remote planning from its settings. Withdrawal prevents new transmissions based on that choice; it does not reverse processing already carried out lawfully, nor does it cancel legal retention obligations.

F. Advertising, rewards and security checks

The website provides for advertising through Google AdSense in an environment separate from the area that processes documents. Advertising is loaded only where it is actually enabled and under the applicable choices. Android and AdMob are not presented as active channels of this offer; their processing will be explained before their launch. ToGoOven does not pass the content of files to the ads.

Providers may process the IP address, advertising or device identifiers and interaction data. Ad rewards may require an installation identifier to verify that they correspond to a valid interaction. Security checks, such as Turnstile, may receive technical browser and connection signals.

The active features and providers, their role and the available controls are described in the public provider annex of this policy (section 8). Visually or technically separating an ad does not remove the ad's own data processing.

G. MCP and third-party clients

The MCP server processes files on your computer and communicates to our server an installation identifier, the requested tool and usage units, in order to authorize operations and apply quotas. If a license is activated, it also uses its credential. That control message does not include the content of your files. The AI client you connect may have its own processing, including transmissions to another provider. The permissions given to ToGoOven do not replace reviewing that client, nor do they allow us to control what it does outside our service.

H. Support, requests and communications

If you write to us, we process your contact address, your message and any documents you decide to send in order to handle it, verify a request proportionately and manage the related obligations. Email is received in Gmail, by Google; when the forwarding configured through Cloudflare is used, both take part in the delivery. Messages received by email are not exclusively local processing. Avoid attaching full documents if a description without personal data is enough. We do not ask for passwords or tokens by email.

Statistics kept only on your device are not sent as service analytics. If remote analytics are added in the future, this will be announced beforehand and the applicable decisions and legal bases will be applied.

4. Sensitive information and third-party documents

We do not request sensitive data for ordinary operation. However, a document, file name, message or request you voluntarily send may contain it. That information does not lose its protection because it is processed automatically or for a short time.

Do not send medical records, biometric data, professional secrets, information about minors or other specially protected information to remote features, unless the feature is enabled for that use and the necessary legal and contractual conditions have been established. When a special authorization is required, it will be requested separately and its optional nature will be explained. We do not make the local tools conditional on providing that data.

If you use other people's information, you must have the power and a valid legal basis for the operation. This does not remove our obligations regarding security, purpose, confidentiality or handling of rights.

5. Legal bases and decisions

In Colombia we request prior, express and informed authorization when it is required, and we apply the legal exceptions only in the cases they cover. Accepting the contract, being informed of this policy and authorizations for optional processing are presented as distinguishable decisions. The notice informs; it does not by itself replace a valid authorization.

Technical processing that is essential to deliver the site before a choice is made requires its corresponding legal basis; we do not use a later acceptance to retroactively justify processing that required prior authorization.

If the GDPR applies, we rely on performance of a contract for processing objectively necessary for the requested service; legal obligation where applicable; legitimate interest for security and abuse prevention where appropriate, assessing the rights affected; and consent for optional processing that requires it. Special categories additionally require a specific enabling condition.

We keep, or make available to you, the minimum evidence of the relevant decisions, with version, date and scope, according to the retention table. We do not record the content of your documents to prove that you accepted. Revocation or withdrawal is available through the indicated mechanisms and does not affect processing that must continue under another valid legal basis.

6. Retention and deletion

The following table applies. The periods include the deletion cycle of the systems under our control. Processing by independent providers is identified in the public annex. We do not promise to control copies outside our scope.

Counters, signals and quotas are kept in our hosting provider's storage, which allows earlier states to be recovered for thirty days. We do not use those recovery copies for any other purpose, and they cease to exist when that period ends.

When a legal retention obligation or the defense of a specific claim requires keeping certain data, we restrict its use to that purpose and delete it when the applicable duty ends. This exception does not authorize the general collection of documents we never received, nor keeping them indefinitely because of an abstract possibility of litigation.

7. Cookies, storage and advertising

The main tools area uses device storage for the features described. Local storage is no less relevant to privacy because it is not called a cookie. Advertising and security services may use cookies, identifiers or equivalent technologies depending on the product and the applicable choice.

Before using non-essential technologies that require consent, we offer an effective choice. Rejecting personalized advertising does not automatically mean that all remaining advertising is free of cookies or identifiers: decisions about storage and other purposes are also respected.

When advertising is enabled, you can change your options in Account and in the corresponding advertising notice. Where legally applicable, we recognize valid opt-out signals such as Global Privacy Control and apply them to the relevant advertising flow. We do not treat them as a mere preference about how an ad looks.

When Google ads are shown, Google and other advertising providers may use cookies to select ads based on previous visits to this or other sites. You can manage personalization in Google's ad settings and check other providers' options at aboutads.info/choices. See also how Google uses information from sites or apps that use its services. These links complement, and do not replace, the consent or opt-out options available here.

We do not use document content to profile users for advertising purposes. We do not run behavioral advertising aimed at minors whose age we know. The annex identifies Google's policies and the specific controls available.

8. Recipients and international operations

We give providers access only when it is necessary for the features described, under the applicable legal and contractual conditions. A provider may be a processor for some operations and an independent controller for others. The following list is the public provider annex: it states each provider and its function, the relevant information, its role and its policy.

International operations are classified according to what they actually are. For Colombia we document whether there is a transmission on our behalf or a transfer to another controller, and the corresponding enabling mechanism. When the GDPR or another regime applies, the legally relevant instruments actually in force for that flow are used. We do not assume that all operations or countries are covered by the same adequacy decision or certification.

You can request information about the applicable safeguards, with the restrictions needed to protect security secrets and third-party rights. We do not make legally required information conditional on disclosing confidential technical details.

9. Confidentiality, security and authorities

We limit access to non-public information to the people who need it for the authorized purpose, and we require appropriate confidentiality obligations from those who act on our behalf. We apply technical and organizational measures proportionate to the information and the risk. We do not offer absolute security.

We do not review content that stays exclusively on your device. When a remote feature needs to process it, access and use are restricted to that feature, to valid instructions and to the applicable legal obligations. We do not use a support request as a general permission to review other files.

We review requests from authorities according to identity, competence, legal basis and scope. We disclose only existing information whose delivery is legally required or covered by a valid legal basis. We inform the affected person when possible and permitted; we may not do so when there is a legal prohibition or another applicable exception. We do not promise to disobey valid orders or to produce local files we do not have.

If a notifiable incident occurs, we act, document it and make the communications to data subjects and authorities required by the applicable rules, with their content and deadlines. We do not publish details that would worsen the exposure while an incident is being contained.

10. Your rights

Depending on the applicable regime, you can know, access, update and rectify your data; know how it is used; ask for proof of authorization; request deletion and revocation where appropriate; and file complaints with the competent authority. Where applicable, you can also request portability, restriction or objection and withdraw consent without affecting its earlier lawful use. We do not require you to waive rights to use the basic tools.

Write to [email protected]. State the type of request and a means of contact. If we need to locate a license or installation, we will ask for a non-secret identifier or a secure and proportionate method. Do not send passwords or full keys. We will not request excessive identity documentation if another adequate means exists.

For information that is only on your device, we offer local controls and explain how to use them; we do not claim to be able to access it remotely.

In Colombia:

• Inquiries: answered within ten business days of receipt; a justified extension of up to five additional business days, announced before the deadline.
• Claims: answered within fifteen business days from the day after receipt; a justified extension of up to eight additional business days, announced before the deadline.
• If a claim is incomplete, we ask for it to be completed within the following five days; after two months without an answer it may be deemed withdrawn. If we are not competent, we forward it to whoever is within two business days and let you know.
• Once the complete claim is received, we add the note «claim in progress» within two business days in the relevant database while it is resolved, where applicable.
• You can go to the SIC (Superintendencia de Industria y Comercio) after completing the applicable procedure with us. This does not limit other available legal mechanisms.

When the GDPR applies, we generally answer within one month and extend only in the cases and terms legally permitted, letting you know. You can contact your data protection authority. We have not designated a representative in the European Union or the United Kingdom; if their designation becomes mandatory for our activity, we will identify them here.

For the United States, additional rights depend on the state and on whether its laws apply. Where applicable, we offer the options of access, deletion, correction, opting out of sale or sharing for advertising, and appeal against decisions on requests, under the relevant regime. We do not claim that an LLC is automatically subject to all state laws, nor do we use their possible inapplicability to break express commitments made here.

11. Minors

The service is offered to people aged thirteen and over. Children under thirteen may not use it under these terms, even with their representative's permission. For now we do not offer a children's mode or a mechanism to admit them through parental consent.

People aged thirteen to seventeen may only use permitted features with the involvement and authorization of their representative where the applicable law requires it. The age to consent to certain processing and the capacity to enter into contracts may differ; being thirteen does not automatically establish both. We use understandable information and privacy measures suitable for adolescents. We do not enable optional features for them without the necessary legal basis and safeguards.

If we learn that we hold data of a child under thirteen, we stop the non-permitted processing, restrict access as appropriate and handle its deletion according to the law, except for the minimum information that must be kept under a valid exception. For other minors we act when a required legal basis or authorization is missing. A mere statement of permission by an adult does not replace the special requirements. You can report a situation to [email protected].

The offer is aimed at Latin America, the United States, Canada and the United Kingdom and may reach users in other countries, including European markets. The English or Spanish language does not determine the applicable rules. In the EEA, the threshold for parental authorization of digital consent varies between thirteen and sixteen years depending on the country; in the United Kingdom the age-appropriate design rules for under-eighteens may apply. In Canada, the relevant federal or provincial rules and the capacity to consent are observed. United States or European rules do not replace the local requirements of other countries.

12. Changes and a possible new operator

Each version states its date and relevant changes. We announce material changes in advance through the site or the available channel. We ask for a new authorization when the change requires it; being informed of a notice does not always amount to consenting to a new purpose.

If an LLC or another entity takes over the operation or the responsibility for the processing, we will identify its name, domicile, contact, role and effective date, explain the changes and apply the corresponding safeguards for the assignment and circulation of data. A transfer of intellectual property does not by itself change all those roles or extend the authorized purposes.

Previous versions will be available at togooven.com/legal/versiones. Inquiries about this policy are handled at [email protected].