Legal
Privacy Policy
Last updated: 31 July 2026
This explains what Toori collects, why we collect it, who else touches it, and how to get it back or get it deleted. It covers toori.ai and any account you create there.
Who we are
Toori, Inc. is a company in San Jose, California. We build an AI phone answering service for small businesses. For anything in this policy, reach us at hello@toori.ai.
What we collect
When you create an account
Your email address and a password. Passwords are stored hashed — we never see or store the password itself. If you sign in with Google instead, we receive your name, email address, and profile picture from Google. We do not receive your Google password and we do not get access to your Gmail, Drive, or anything else in your Google account.
When you fill in the setup form
Information about your business that you choose to give us: business name, location, hours, services, pricing rules, how you want urgent calls handled, and similar. This is what the AI agent needs in order to answer your phone correctly. It saves as you type so you don't lose work, which means partial answers are stored even if you never finish.
Automatically, when you visit the site
We use Cloudflare Web Analytics to see roughly how many people visit and which pages they look at. It does not use cookies, does not follow you to other websites, and does not build a profile of you. It is not loaded at all for visitors in the European Union.
Cloudflare also handles our DNS and hosting, and keeps standard server logs (IP address, browser type, time of request) for security and abuse prevention.
Cookies
We use one kind: a token that keeps you signed in after you log in. Without it you would be logged out on every page. We do not use advertising cookies, tracking pixels, or session recording, and we do not run a cookie consent banner because we have nothing to ask consent for.
What we don't collect
- We do not sell your information, and we do not share it for advertising.
- We do not buy information about you from data brokers.
- We do not track you across other websites.
Why we use it
- To create and secure your account, and to sign you in.
- To build and run the AI agent that answers your business phone.
- To send you email you'd expect — confirming your address, resetting a password, telling you about your account.
- To understand, in aggregate, whether the website is working.
- To meet legal obligations and to investigate abuse or fraud.
Who else handles it
We keep the list short on purpose. Each of these companies processes data on our instructions, for the job named, and nothing else.
| Company | What it does for us |
|---|---|
| Supabase | Accounts, sign-in, and our database. Hosted in the United States. |
| Cloudflare | DNS, website hosting, and privacy-first analytics. |
| Resend | Sends our account and confirmation emails. |
| Microsoft | Our own business mailbox, so we can receive your email. |
| Sign in with Google if you choose it, and the fonts this site is set in. |
We may also share information if the law requires it, or to protect our rights, safety, or property. If Toori is ever acquired or merges with another company, account information would transfer as part of that — we'd tell you before it happened.
Recorded calls
The phone service is not live yet. No calls have been answered, recorded, or transcribed, and no call data exists.
When the service does launch, calls answered on your behalf may be recorded and transcribed so the agent can take messages and book appointments. Recording a call in California and several other states requires telling everyone on the line. Before we turn the service on for any business, we will publish exactly how that disclosure is made, who is responsible for it, how long recordings are kept, and how to delete them. We will update this policy at that point, and account holders will be told directly rather than left to notice.
How long we keep it
Account and setup information is kept for as long as your account exists. Delete your account and we delete it, along with your setup answers, within 30 days — except anything we're required to keep for legal or accounting reasons.
Analytics data is aggregate and is not tied to you. Server logs are kept for a short period for security purposes.
Your choices
Whatever state or country you're in, you can ask us to:
- Tell you what we hold about you.
- Send you a copy of it.
- Correct it if it's wrong.
- Delete it and close your account.
Email hello@toori.ai and we'll handle it. We won't charge you, and we won't treat you differently for asking. We may need to confirm you are who you say you are before acting on a request about an account.
California residents have specific rights under state privacy law, including the right to know, delete, and correct, and the right to opt out of the sale or sharing of personal information. We don't sell or share personal information, so there's nothing to opt out of — but the other rights are available to you above, and we honour them regardless of whether we're legally required to.
Security
Data is encrypted in transit and at rest. Our database uses row-level security, which means an account can only ever read its own rows — the restriction is enforced by the database itself rather than by application code that could have a bug in it. Access to production systems is limited and protected by separate credentials.
No system is perfectly secure. If we ever discover a breach affecting your information, we will tell you.
Children
Toori is a service for businesses and is not directed at children. We don't knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.
Changes to this policy
When we change this policy we'll update the date at the top. If a change materially affects how we handle your information — the call recording section, for instance — we'll email account holders rather than relying on you to check.
Contact
Questions, requests, or complaints: hello@toori.ai.
Toori, Inc., San Jose, California.