Privacy policy
This policy explains what information Toolsmate collects, why, how it is stored and protected, who it is shared with, and what you can ask us to do with it. It is written to be read, not skimmed.
1. Who we are
Toolsmate is operated by INTEGRATE AI LTD, a company registered in England and Wales, of 20 Wenlock Road, London, England, N1 7GU ("we", "us"). We are the data controller for the information described in this policy. Questions about privacy go to frazier@toolsmate.ai.
2. What Toolsmate is
Toolsmate is an AI office assistant for small trade businesses. A business owner (our customer, "you") connects Toolsmate to their business. It then keeps the business's records, reads the messages that reach the business, records what they are about, and drafts replies for the owner to approve. To do this it handles information about you and about the people your business deals with.
3. Information we collect
3.1 About you and your business
- Your name, email address and phone number, so you can sign in and we can contact you.
- Your business profile: trading name, address, services, areas covered, prices, opening hours, and how you like messages worded. You give us this, or confirm it after we read it from your own website.
3.2 About your customers and suppliers
- Names, contact details and addresses of the people and companies your business deals with, and the record of jobs, quotes, invoices and payments between you.
- The messages between you and them that reach Toolsmate, and what Toolsmate learned from them (for example, that a customer prefers a morning visit).
You are responsible for having a lawful basis to hold this information about your customers, as you would with any filing system. Toolsmate processes it on your instructions.
3.3 From your Google account, if you connect it
If you choose to connect your Google account, Toolsmate asks Google for three permissions and receives the following:
| Permission | What we receive | What we use it for |
|---|---|---|
gmail.readonly (read your email) | The content, sender, recipients, subject, date and attachments of messages in the mailbox you connect. | To find customer enquiries, customer replies and supplier invoices, sort them, and record them against the right customer, job, quote or invoice on your books; and to show you a summary of what needs doing. |
gmail.send (send email on your behalf) | The ability to send a message from your address. | Only to send a reply that you have read and approved. |
calendar.freebusy (see when you are busy) | Only the start and end times of busy periods in your main calendar, up to four weeks ahead. Never the titles, attendees, locations or any other details of your events, and never anyone else's calendar. | To know when you are already booked, so the appointment times Toolsmate suggests to customers do not clash with what is in your calendar. |
We also receive the email address of the connected mailbox, and a refresh token: the key Google issues that lets Toolsmate act on the permissions above without you signing in each time.
4. How we use Google user data
Toolsmate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice that means:
- We use data from your Google account only to provide and improve the Toolsmate features you can see: reading and sorting your mail, recording it on your books, summarising it for you, sending replies you approve, and avoiding your busy times when suggesting appointments.
- We do not use data from your Google account to develop, improve or train generalised artificial intelligence or machine learning models.
- We do not sell it, and we do not share it with anyone for advertising or marketing.
- No person at INTEGRATE AI LTD reads your email, except: where you ask us to help with a specific problem and agree to it first; where it is needed for security or to investigate abuse; where the law requires it; or where the content has been combined with other data so it no longer identifies anyone.
- We transfer it only to the service providers listed in section 6, only so they can process it for us in providing Toolsmate, and under contracts that hold them to these same limits.
5. How we store and protect it
- Your business records and the messages Toolsmate has processed are held in a database hosted by Supabase in London, United Kingdom. Every business's data is walled off from every other business's at the database level.
- The Google refresh token is held only in Supabase Vault, an encrypted secret store inside that database. It is never written to an ordinary database column, a log or a file. Only the Toolsmate service can read it, and only for the business it belongs to.
- Your busy times are held as a single record per connected calendar, bare start and end times only, replaced each time they are refreshed. Nothing about what the events are is ever received or stored.
- All connections to and from Toolsmate are encrypted in transit.
- Every change to a record keeps a history of what changed, when and why. Sensitive actions, including sending an email, wait for your approval.
6. Who we share it with
We use these service providers to run Toolsmate. Each processes data only on our instructions.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database and encrypted secret store | London, UK |
| Railway | Runs the Toolsmate service | Amsterdam, Netherlands |
| Provides the Gmail connection you authorise | Per Google's own terms | |
| AI model providers (TypeSafe; models reached through OpenRouter) | Judge what a message means, so Toolsmate can sort and summarise it and draft a reply | Contracted not to retain or train on the content |
| Context.dev | Reads your own business website, once, at set-up | Receives only your website address |
We do not share your information with anyone else, except where the law requires it or to protect the rights and safety of people using Toolsmate.
Where a provider is outside the UK, the transfer is covered by the UK International Data Transfer Agreement or an adequacy decision.
7. How long we keep it
- The Google refresh token is deleted from the vault the moment you disconnect your Google account, whether you do that in Toolsmate or by removing Toolsmate's access in your Google account settings. Your stored busy times are removed with it.
- Business records and processed messages are kept while your account is open, because they are your books.
- When you close your account, or ask us to, we delete your business's data within 30 days, except what we must keep by law (for example, our own invoices to you).
8. Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it, delete it, or restrict how we use it;
- give you a copy in a form you can take elsewhere;
- stop processing it where we rely on legitimate interests.
Email frazier@toolsmate.ai and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk. Our lawful bases are: performing our contract with you; your consent, for the Google connection; and our legitimate interest in running and securing the service.
9. Cookies
This website sets no cookies. The Toolsmate service uses only the cookies needed to keep you signed in.
10. Changes
If we change this policy in a way that matters, we will tell you by email before the change takes effect. The date at the top is the date of the current version.
11. Contact
INTEGRATE AI LTD, 20 Wenlock Road, London, England, N1 7GU.
frazier@toolsmate.ai