Toimur Privacy Policy
Version 1 — effective 24 September 2026
The short version
This summary is here to help you. It does not replace the full policy below.
- We are GÜNES CONSULTING OÜ, a company registered in Estonia, and we make Toimur (section 1).
- What you put into Toimur about your clients is yours. We store it for you and use it only to provide Toimur (section 2).
- About you, we keep what your account needs: your email address, your settings, a record of your sign-ins and your subscription (section 3).
- We do not sell personal data, use your content for advertising, or send it to a language model (sections 2 and 5).
- Payments are handled by Stripe through its Link service. We never see your full card number (section 4).
- Google Analytics runs only on our public pages, and only if you accept it — never inside the application (sections 3.6 and 7).
- Your data is stored in the European Union (section 6).
- You can export your data or delete your account yourself, at any time, from Toimur's settings (section 9).
1. Who we are
1.1 Toimur is made by GÜNES CONSULTING OÜ, a private limited company registered in Estonia (registry code 14536342, registered address Sepapaja tn 6, 15551 Tallinn, Estonia) — "we" or "us". For the personal data this policy describes, we are the controller.
1.2 For anything about this policy or your personal data, write to support@toimur.com.
1.3 This policy covers the Toimur website at toimur.com and the Toimur application. Our other websites and products have their own policies, listed at https://gunes.ee/legal/.
2. Your content
2.1 Toimur holds what you put into it about your work: clients and their contact people, projects, orders, tasks, time, rates, estimates, invoices, bank details, your logo and the details of your own business. We call this "your content".
2.2 For personal data in your content — your clients' names and email addresses, for example — you are the controller and we are your processor. We process it only to provide Toimur to you, as Annex A of the Toimur User Agreement (https://www.toimur.com/en/terms) sets out. If one of your clients asks us about their data, we pass the request to you.
2.3 We do not sell your content, use it for advertising, or send it to a language model or use it to train one.
2.4 We do not routinely look at your content. We look at it only when that is needed to provide or secure Toimur — for example to investigate a fault you report, a notice we receive or a security problem — or when the law requires it.
2.5 The rest of this policy is about personal data about you as our customer, and about visitors to our website.
3. What we collect, and why
3.1 Your account. Your email address, and a separate billing email address if you give one. Your password, which we store only as a salted hash and cannot read. Your settings: language, regional format, time zone and theme. The country you are based in, which decides whether we can offer Toimur to you.
Why: to give you an account and provide Toimur. Legal basis: our contract with you (Article 6(1)(b) GDPR).
3.2 Signing in. Each time you sign in, we keep a record of that session: when it started, and the IP address and browser it came from. A cookie keeps you signed in (section 7).
Why: to keep you signed in, and so that we can investigate if someone else uses your account. Legal basis: our contract with you, and our legitimate interest in keeping accounts secure (Article 6(1)(f)).
3.3 Your subscription. Your plan. The references our payment partner gives your customer record and your subscription. When you first moved to a paid plan and, if your subscription ends, when it ended. Which version of our terms you accepted before paying, and when.
Why: to provide the plan you pay for, apply the rules on plans, and be able to show what you agreed to. Legal basis: our contract with you, and our legitimate interest in being able to show what was agreed.
3.4 Emails we send you. The emails you need to use Toimur: to confirm your email address and to reset your password — each link expires after one hour — and about your account, security, subscription and changes to our terms. They are sent through our email provider (section 5).
Legal basis: our contract with you.
3.5 When you write to us. Your message, your email address and anything you include.
Why: to answer you. Legal basis: our contract with you when it concerns your account; otherwise our legitimate interest in answering.
3.6 Visiting our website.
- (a) Our hosting provider receives your IP address to deliver each page, and keeps technical logs for a limited period set by its service, to run and protect it. Legal basis: our legitimate interest in running a secure website.
- (b) We count visits to our public pages with Vercel Web Analytics, which uses no cookies and shows us only totals, such as how many people viewed a page. Legal basis: our legitimate interest in knowing how the website is used.
- (c) Google Analytics runs only if you accept it in the cookie banner, and only on our public pages. It never runs inside the application, and never on the password-reset page. If you accept, it sets cookies (section 7) and sends Google information about your visit: the pages you view, the page you came from, your device and browser, and your approximate location, which Google derives from your IP address. Legal basis: your consent (Article 6(1)(a)). You can withdraw it at any time through "Cookie settings" at the foot of every public page; withdrawing removes Google Analytics' cookies from your browser.
3.7 We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR).
4. Payments
4.1 Payments for paid plans are handled by Stripe, which acts as merchant of record through its Link service. When you pay, you give your payment details to Stripe and Link, not to us. They process them under their own privacy policies (stripe.com/privacy and link.com/privacy), as a separate controller.
4.2 We never see your full card number. Stripe tells us what we need to run your subscription: your plan, whether your subscription is active, and when it renews or ends. In our Stripe account we can also see the payments made for your subscription.
4.3 Deleting your Toimur account cancels your subscription, but it does not erase payment records. Stripe keeps its own records under its own policy, and we keep the records in our Stripe account for as long as accounting law requires. Legal basis: our contract with you, and our legal obligations (Article 6(1)(c)).
5. Who else handles your data
5.1 We use these providers to run Toimur. They act on our instructions, under data processing agreements:
| Provider | What it does | Where the data is |
|---|---|---|
| Vercel | Hosts and runs toimur.com and the application; counts website visits | EU (Frankfurt, Germany); requests pass through its global network |
| Neon | Database, including its backups | EU (Frankfurt, Germany) |
| Lettermint | Sends Toimur's emails | EU |
5.2 Two others handle personal data under their own responsibility: Stripe and Link, for payments (section 4), and Google, for Google Analytics — only if you accept it (section 3.6).
5.3 We may also disclose personal data where the law requires it — to a court or an authority, for example — and to a company that takes over Toimur, if that ever happens (User Agreement, section 21.4).
5.4 We do not sell personal data to anyone.
6. Where your data is
6.1 Toimur's application and database run in the European Union, in Frankfurt, Germany.
6.2 Some of our providers belong to groups based outside the European Economic Area (EEA), and data can pass through or be accessed from outside it — for example when a request travels through our hosting provider's global network, or when Google Analytics runs because you accepted it. Any such transfer is made only under a mechanism recognised by Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework, for certified recipients) or the European Commission's standard contractual clauses.
7. Cookies and similar storage
7.1 Toimur uses these:
| What it is | What it does | How long | Needs your consent |
|---|---|---|---|
| A sign-in cookie | Keeps you signed in | 7 days, renewed while you use Toimur; removed when you sign out | No — strictly necessary |
| Two sign-up cookies | Carry the country and language you chose through sign-up | 1 hour | No — strictly necessary |
| Your cookie choice — kept in your browser's storage, not a cookie | Remembers your answer to the cookie banner | Until you change your choice or clear your browser's storage | No |
| Google Analytics cookies | Tell visits and visitors apart | Up to 2 years | Yes — set only after you accept |
7.2 Vercel Web Analytics uses no cookies.
7.3 You can give or withdraw your consent to Google Analytics at any time through "Cookie settings" at the foot of every public page.
8. How long we keep it
- Your account and your content: until you delete your account, which erases them from Toimur straight away. If a paid subscription ends, your account is read-only for 30 days and then your access ends; we erase the account within 90 days after that (User Agreement, section 9 and Annex A, A10).
- Backups: after erasure, copies in our database provider's backups expire within six hours.
- Sign-in records: until you sign out, and in any case until your account is deleted.
- Messages you send us: for as long as we need them to deal with your message and anything that follows from it.
- Payment records: see section 4.3.
- Google Analytics: its cookies last up to 2 years; Google keeps data about individual visits for the period set in our Google Analytics account, at most 14 months.
- Hosting logs: a limited period set by our hosting provider's service.
9. Your rights
9.1 Under the GDPR, you have the right to:
- access your personal data and receive a copy of it;
- have it corrected — most of it you can change yourself in Toimur's settings;
- have it erased — you can delete your account yourself, at any time, from Toimur's settings;
- receive it in a portable format — Toimur's settings let you export your account's data as a JSON file;
- restrict its processing, or object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting what was done before you withdrew it — for Google Analytics, through "Cookie settings".
9.2 To use these rights, write to support@toimur.com. We answer within one month, and may first ask you to confirm that the request comes from you.
9.3 You can also complain to a data protection authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority in the EU country where you live or work.
10. Security
10.1 We protect personal data with measures appropriate to the risk. They include encrypted connections; encryption of stored data by our database provider; access to production systems limited to those who need it and protected by strong authentication; passwords stored only as salted hashes; and backups kept by our database provider.
10.2 If a personal data breach puts your rights at high risk, we will tell you without undue delay, as the law requires.
11. Age
Toimur is made for business use by adults, and is not intended for anyone under 18.
12. Changes to this policy
12.1 We may update this policy. The version number and date at the top show which version applies.
12.2 If a change significantly affects how we use your personal data, we will tell you by email before it takes effect.