Privacy Policy
Version 12 October 2026 · Effective 12 October 2026
Previous versions: 13 July 2026
1. Who we are
Toucan Intelligence is provided by Toucan International Ltd, company number 16146873, registered office 251 Gray's Inn Road, London, England, WC1X 8QT. We are the controller of the personal data described in this policy and are registered with the Information Commissioner's Office under reference ICO:00015459701.
This policy covers intelligence.toucan.international. The toucan.international website has its own privacy policy.
For privacy questions or requests, contact enquiries@toucan.international.
2. Data we collect
| Category | What it includes |
|---|---|
| Account | Your name, email address, password (stored as a hash by our authentication provider), your role, and your organisation's name, domain, industry and account type |
| Product configuration | The brands, sites, competitors, queries and regions you set up. These describe businesses, and are stored against your organisation |
| Analysis results | Responses from third-party AI systems to your queries, the sources they cite, the public web pages we fetch to benchmark or audit, and the reports and audits we derive from them |
| Google Analytics (optional) | If you connect a GA4 property: the Google account email used to connect, the property name and ID, encrypted access credentials, and daily totals of users and sessions arriving from AI platforms. We do not import data about individual visitors |
| Requests to the Toucan team | When you use "Send to Toucan": your email address, your notes, budget range and timing, and the evidence attached to the request |
| Billing | Your plan, subscription status and billing contact. Card details are handled by Stripe and we do not store them |
| Support | The messages you send us and our replies |
| Usage and technical | Server logs (IP address, browser, timestamps) and records of the analysis runs and features each organisation uses |
| Terms acceptance | Which version of our Terms you accepted, when, and from where (sign-up, in-app prompt or checkout) |
| Marketing preferences | Whether you have asked to receive, or opted out of, product updates and research |
| Cookies | See our Cookie Policy |
3. How we use data and our legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Service: accounts, running analyses, reports, support | Account, configuration, results, support | Contract |
| Billing and keeping tax and accounting records | Billing | Contract; legal obligation |
| Security, abuse prevention and debugging | Usage and technical | Legitimate interests in running a safe service |
| Service emails, such as sign-in links, password resets and notices of changes | Account | Contract |
| Product updates and research by email | Email address, marketing preferences | Consent. You can opt out at any time |
| Responding to "Send to Toucan" requests | Request details | Legitimate interests in answering a request you made |
| Improving the product and compiling aggregated insights | Usage, configuration and results, in aggregated form | Legitimate interests in understanding and improving the Service |
| Referral reporting from Google Analytics | Google Analytics data | Consent, which you withdraw by disconnecting the integration |
| Usage analytics on our public pages and in the signed-in product: pages viewed, features used and buttons pressed, and session recordings on our public pages | Cookie and usage data | Consent, given through the cookie banner |
| Publishing aggregated insights in research and marketing | Aggregated insights only, with no personal data | Legitimate interests in publishing research about AI search |
| Processing AI responses and public web pages that may name people (see section 9) | Analysis results | Legitimate interests in providing the Service |
4. Aggregated insights and marketing
We do not sell personal data. We never use your account details or your Google Analytics data in our marketing. We use your organisation's name, logo or results in our marketing only if you have agreed.
We compile aggregated insights from activity across many customers, never from Google Analytics data, and may use them in research, reports, social media posts and other marketing. Each published figure rests on at least 10 organisations, with none contributing more than a set share of the data. Published insights do not name brands or sites, never reproduce a query a customer wrote, and never include personal data. Section 8 of our Terms sets out these safeguards in full.
You can opt out of your organisation's data being used in published insights by emailing enquiries@toucan.international.
Separately, we run our own research using query sets that we write, such as industry indexes. We write those query sets ourselves and do not copy customers' queries into them, and those runs do not draw on any customer account data.
5. Google Analytics data
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google Analytics data only to provide the referral reporting in your account. We do not use it for advertising, do not include it in aggregated insights, and do not transfer it except as needed to provide that feature or as the law requires. Our staff do not view it unless you ask us to, or it is needed for security or to comply with the law.
We only access a property after you grant access through Google's consent screen. You can disconnect it at any time from Settings, which stops further imports and deletes the data and credentials we had imported.
6. Who we share data with
We use a small number of providers to run the Service. Each receives only what it needs.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database and authentication | Account, configuration, results and usage data | EU (Ireland) |
| Netlify | Application hosting | Requests to the site, including IP address | United States, with a global edge network |
| OpenAI, Anthropic, Google and Perplexity | Generating the AI responses we analyse | The query text and region you configured | United States |
| Anthropic | Analysing AI responses and benchmarking pages | The AI responses to your queries and the brand names being tracked. For page benchmarks: your query text, and the URL, title and main text of your page and of the competitor pages compared, which can include author names shown on those pages. We do not send your name or email address | United States |
| Google (PageSpeed Insights) | Page performance audits | The URL of the page being audited | United States |
| Google (Analytics) | Referral reporting, if you connect a property | See section 5 | United States |
| Stripe | Payments | Billing contact and payment details | United States and Europe |
| Resend | Sign-in links, password resets and service emails | Email address | United States |
| Google (Analytics, via Google Tag Manager) | Usage analytics on our public pages and in the signed-in product, with your consent | Cookie and usage data: pages viewed, features used, plan and account type, and a pseudonymous account identifier. Never your queries, brands, results, name or email address | United States |
| Microsoft (Clarity) | Session analytics on our public pages, with your consent | Cookie and usage data | United States |
Requests you send with "Send to Toucan" go to Toucan International's own agency team, which is part of the same company.
We may also share data with professional advisers, with authorities where the law requires it, and with a buyer if our business is sold.
7. International transfers
Some of our providers process data outside the UK and the European Economic Area, mainly in the United States. Where they do, we rely on the UK-US data bridge and the EU-US Data Privacy Framework for providers certified under them, and otherwise on standard contractual clauses with the UK addendum.
You can ask us for a copy of the safeguards that apply.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account and configuration | While your account is open. To close your account, email enquiries@toucan.international; we delete this data within 30 days of your request |
| Reports and run history | Your plan's history window, and no longer than 30 days after your account closes |
| Google Analytics data and credentials | Until you disconnect the property or close your account |
| Terms acceptance records | Six years after your account closes, as evidence of the contract |
| Billing records | As long as tax and accounting law requires |
| Server logs | Up to 30 days |
| Backups | Daily backups are kept for 7 days |
| Marketing preferences | Until you opt out; we then keep a record of the opt-out so that we respect it |
| Send to Toucan requests and support messages | Up to two years after the request |
| Usage records | While your account is open; afterwards only in a form that no longer identifies your account |
| Aggregated insights | Kept, because they no longer relate to any customer or person |
9. People named in AI responses and web pages
AI systems sometimes name real people in their answers, and the public web pages we analyse often show an author's name. We store this as part of the reports for the account that ran the query, and send page text to our AI provider for benchmarking, on the basis of our legitimate interests in providing the Service. We do not use them to build profiles of individuals.
If you believe a stored response or page contains inaccurate or harmful information about you, contact us and we will look into it.
10. Your rights
Under UK and EU data protection law you can ask us to:
- give you a copy of your personal data;
- correct it;
- delete it;
- restrict how we use it;
- give it to you in a portable format;
- stop using it where we rely on legitimate interests, and stop using it for direct marketing in any case.
Where we rely on your consent, you can withdraw it at any time.
Email enquiries@toucan.international to use any of these rights. We respond within one month.
11. Complaints
If you are unhappy with how we have handled your personal data, tell us at enquiries@toucan.international. We will acknowledge your complaint within 30 days and give you our response without undue delay.
You can also complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live if you are in the EEA.
12. Security
Data is encrypted in transit. Database access is isolated for each organisation, and Google Analytics credentials are also encrypted at rest.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the regulator as the law requires.
To report a vulnerability, see our Security Disclosure Policy.
13. Cookies
Our Cookie Policy lists the cookies we use and how to change your choices.
14. Other things to know
The Service is for business users and is not intended for anyone under 18.
We do not make decisions about you by automated means that have a legal or similarly significant effect.
We will post changes to this policy here and, for material changes, tell you by email or in the Service. The dates at the top show the current version.