Privacy Policy

1. Who we are

Toucan Intelligence is operated by Toucan International (“we”, “us”). This policy explains what personal data we collect when you use the service, why, and the choices you have. For privacy questions or requests, contact enquiries@toucan.international.

2. Data we collect

Account data: your name, email address, password (stored as a hash by our authentication provider), and organisation details you provide at signup.

Product configuration: the brands, competitors, queries, and regions you set up for analysis. These describe businesses rather than individuals, but are stored against your account.

Analysis results: responses returned by third-party AI systems for your configured queries, and the reports we derive from them.

Google Analytics data (optional): if you connect a GA4 property, we store encrypted access credentials and import aggregate referral-traffic metrics. We never access it without your explicit OAuth consent, and you can disconnect at any time from Settings, which stops further imports.

Usage and technical data: standard server logs (IP address, browser, timestamps) needed to run and secure the service.

3. How we use data

To provide the service: run the analyses you request, generate reports, and show them in your dashboard.

To operate and secure the platform: authentication, fraud and abuse prevention, debugging, and service communications (such as password-reset emails).

To improve the product: aggregated, de-identified usage statistics. We do not sell personal data, and we do not use your private configuration or reports to market to third parties.

4. Where data goes (processors)

We use a small number of infrastructure providers to run the service: Supabase (database and authentication, hosted in the EU), Netlify (application hosting), and — to perform the analyses you configure — the AI providers OpenAI, Anthropic, Google, and Perplexity, which receive only the query text you configured, never your account details.

If you connect Google Analytics, data is exchanged with Google under your OAuth consent. A current list of processors is available on request.

5. Legal bases

We process account and configuration data to perform our contract with you; usage and security data under our legitimate interest in running a safe service; and GA4 data with your consent, which you can withdraw by disconnecting the integration.

6. Retention and deletion

We keep your data while your account is active. Historical reports are retained according to your plan's history window. When you close your account — or on request to enquiries@toucan.international — we delete your account data within 30 days, except where a longer period is required by law.

7. Your rights

Depending on where you live (including under UK and EU GDPR), you have rights to access, correct, export, restrict, object to, and delete your personal data. Email enquiries@toucan.international to exercise them; we respond within one month. You also have the right to complain to your supervisory authority.

8. Security

Data is encrypted in transit; database access is isolated per organisation; Google Analytics credentials are additionally encrypted at rest. No system is perfectly secure — if we become aware of a breach affecting your data we will notify you as required by law.

9. Cookies

The application uses strictly necessary cookies for authentication and session management. We do not run third-party advertising or tracking cookies.

10. Changes

We will post updates to this policy here and, for material changes, notify you by email or in-app. The date above shows the latest revision.