Privacy Policy
Effective date: May 2026 · Last updated: August 2026
TotalCtrl ("we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights in relation to it. By using our platform, you agree to the practices described in this policy.
1. Information We Collect
We collect information you provide directly to us and information generated as you use our services:
- Account information: name, company name, email address, and password when you register.
- Usage data: pages visited, features used, actions taken within the platform, and timestamps.
- Device & log data: IP address, browser type, operating system, and referring URLs.
- Content you create: any data, files, or records you store within TotalCtrl apps (CRM contacts, Help Center articles, invoices, etc.).
- Payment information: handled by our payment processor; we store only non-sensitive billing details (last four digits, card type, billing address).
- Communications: emails or messages you send to our support team.
2. How We Use Your Information
- To provide, maintain, and improve the TotalCtrl platform.
- To process transactions and send related information including confirmations and invoices.
- To send transactional emails (account verification, password resets, invitation links).
- To send service announcements, updates, or security alerts.
- To respond to your comments and questions and provide customer support.
- To monitor and analyze trends, usage, and activities on the platform.
- To detect, investigate, and prevent fraudulent transactions and other illegal activities.
- To comply with legal obligations.
3. Sharing of Information
We do not sell your personal data. We share information only in the following circumstances:
- Service providers: trusted third parties that perform services on our behalf (hosting, email delivery, payment processing, analytics), who are contractually bound to protect your data.
- Your organization: if you access TotalCtrl through a workspace created by your employer or organization, workspace administrators may have access to your account information and activity.
- Legal requirements: when required by applicable law, regulation, legal process, or governmental request.
- Business transfers: in connection with a merger, acquisition, or sale of assets, with advance notice given where possible.
4. Artificial Intelligence (AI) and Machine Learning Processing
We use third-party Artificial Intelligence (AI) and Large Language Model (LLM) service providers to deliver advanced automated features, including content summarization, automated answers, audio transcription, and decision support.
4.1 Categories of Third-Party Processors and Data Scope
To provide these features, we transmit specific user-provided text prompts, uploaded documents, and audio media to external cloud-hosted sub-processors. These vendors fall into the following functional categories:
- Generative Text & Decision Models: external LLM infrastructure used to process, analyze, and summarize textual inputs.
- Audio Transcription & Processing Vendors: specialized speech-to-text and text-to-speech providers used to decode audio files.
- Content Creation: using instructions and related content to generate new text, images, and videos based on user input.
A complete, up-to-date list of the specific corporate entities providing these AI and infrastructure services can be found on our Subprocessors page.
4.2 No Model Training Commitments
Your data remains yours. Our contractual agreements with our native third-party AI sub-processors ensure that your transmitted inputs, prompts, and files are not used to train, retrain, or improve their public or commercial AI models. Data is cached by these providers solely for temporary compliance and abuse-monitoring purposes (typically up to 30 days) before automatic deletion.
4.3 Bring Your Own Key & Custom Models (BYOK)
Our platform offers functionality allowing you to integrate your own third-party API keys or connect custom LLM instances to power your workspace features.
- Shift in data control: when you supply your own credentials, your data transmissions connect directly to those third-party services, bypassing our platform's default corporate vendor agreements.
- User responsibility: in a BYOK configuration, you act as the direct data controller. Processing is governed entirely by the personal or enterprise agreement you hold directly with that provider. We do not control, log, or assume liability for data handling under your own API credentials.
4.4 User Controls, Opt-Outs, and Regional Rights
We believe in user autonomy regarding automated data processing. You retain full control over how and if your data interacts with AI infrastructure.
- The "AI & LLM" account controls: you can instantly disable all native third-party AI features by toggling the opt-out switch located in the "AI & LLM" section of your account dashboard.
- Users can opt out of AI usage in our iOS, macOS, and Android apps through their profile in the app.
- Impact of opting out: disabling this switch halts all automated data transmission to our native AI sub-processors. Consequently, tools relying on those models (such as summarization and transcription) will be deactivated.
- European Union (GDPR) / UK residents: when we utilize our native AI APIs, we act as the Data Processor, and processing is executed under the lawful basis of Performance of a Contract. You retain the right to restrict processing or request a comprehensive list of our current third-party sub-processors at any time.
- California residents (CCPA/CPRA): the transmission of data to our default AI vendors is performed strictly for business purposes under binding service provider contracts. It does not constitute a "sale" or "sharing" of personal information for cross-context behavioral advertising. Turning off the switch in your "AI & LLM" settings fulfills your right to limit the use of automated processing within our platform.
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide services. If you close your account, we will delete or anonymise your personal data within 90 days unless we are required to retain it for legal or compliance purposes.
5.1 Voice Recordings
When you record a voice note, we store the audio file so that it can be transcribed, and we keep it for a limited period afterwards so that you can play a passage back while reading the transcript. The default retention period for a voice note recording is seven days from the time it is recorded, after which the audio file is deleted automatically.
Two things are worth stating plainly about how this works:
- The transcript outlives the recording. Deleting the audio — automatically at the end of the retention period, or manually — does not delete the transcript, the summary, or the timing information that indicates when each line was spoken. Those remain part of your note until you delete the note itself.
- The retention period is configurable, and can be switched off. Your subscription plan sets the default period. A workspace administrator may shorten it, or turn recording retention off entirely under Settings → App Settings. With retention turned off, the audio file is deleted as soon as the transcription has completed, and recordings already stored are deleted shortly afterwards.
You can delete the recording for an individual voice note at any time without deleting the note. Where a recording contains the voice of someone other than the account holder, the account holder is responsible for having any consent required by the laws applicable to them before making the recording.
Audio files are transmitted to the speech-to-text sub-processors described in section 4 for the purpose of transcription, are not used to train any model, and are stored encrypted at rest.
6. Security
We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
7. Cookies
We use cookies and similar tracking technologies to operate the platform (session management) and understand how users interact with TotalCtrl (analytics). You can control cookies through your browser settings; disabling certain cookies may affect platform functionality.
8. Your Rights
Depending on your location, you may have rights under applicable data protection law, including:
- Access to the personal data we hold about you.
- Correction of inaccurate or incomplete data.
- Deletion of your personal data ("right to be forgotten").
- Portability of your data in a machine-readable format.
- Objection to or restriction of certain processing activities.
To exercise any of these rights, please contact us at privacy@totalctrl.com.
9. International Transfers
Your data may be processed in countries other than where you reside. When we transfer data internationally, we rely on appropriate legal mechanisms such as standard contractual clauses to ensure your data remains protected.
10. Children's Privacy
TotalCtrl is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated effective date and, where appropriate, by sending you a notification. Your continued use of TotalCtrl after any change constitutes your acceptance of the updated policy.
12. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
TotalCtrl
privacy@totalctrl.com
This document was last reviewed and updated on July 2026.