Privacy should follow the task boundary
This local-release notice explains the intended data boundaries; production publication remains blocked until owner and legal approval.
Public visits and advertising
Public content may use first-party, allowlisted measurement and policy-eligible Google advertising only after consent and account gates are approved. Analytics must not contain document contents, file names, hashes, raw social URLs, email addresses, tokens, provider payloads or private paths.
- Legal, contact, processor, media-runtime, customer, staff, error and transaction pages remain ad-free.
- Advertising identity and first-party product analytics stay separate.
- Unknown event fields and route classes fail closed.
Documents and customer records
Tooleni document tools are designed to process files locally in an isolated browser workspace with no server upload. Commerce and personalisation data use separate private systems, purpose limits, access controls and bounded retention described before collection.
- Do not send document contents through the public contact surface.
- Payment providers receive only the data required for hosted checkout and authoritative verification.
- Production retention and rights procedures require final owner/legal approval.
Optional ChatGPT-assisted custom-work review
The custom-work form offers an explicit choice between ChatGPT-assisted review and human-only review. If assistance is accepted, Tooleni may send only the request type, product reference, requirements, platform and target date to the owner-controlled Tooleni Custom Work Manager in ChatGPT so it can prepare a non-authoritative recommendation for staff.
- Name, email and order reference are never sent to the ChatGPT manager.
- Choosing human-only keeps the request out of manager Actions and does not prevent submission.
- ChatGPT is an external processing service; its applicable account, privacy and retention terms must be reviewed before production activation.
- A customer may ask authorised Tooleni staff through the owner-approved support channel to withdraw manager consent; staff revocation prevents later manager reads. There is no self-service withdrawal link in this release.