Privacy Policy

toro AI is an independent AI consultancy based in Tel Aviv, Israel. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, toro AI is the data controller for personal data submitted through this website.

You can reach us about anything in this policy at info@toro-ai.net.

We only collect what you choose to give us, plus the minimum our hosting needs to serve the site.

• Contact form submissions — your name, work email address, company name, company size, and the free-text description of what you are trying to build.
• Email correspondence — if you email us directly, we hold that thread and anything in it.
• Technical logs — our hosting provider records IP address, user agent, and requested URL for security and reliability purposes. We do not combine these logs with contact form data to build a profile of you.

We do not run advertising or analytics trackers on this site, we do not set non-essential cookies, and we do not buy, sell, or rent contact lists.

• To respond to your enquiry and discuss a possible engagement. Legal basis: steps taken at your request prior to entering a contract (GDPR Art. 6(1)(b)).
• To run and secure the website. Legal basis: our legitimate interest in keeping the site available and free of abuse (GDPR Art. 6(1)(f)).
• To meet legal and accounting obligations where a contract follows. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)).

We do not use your submission to train machine learning models, and we do not send marketing email to people who have only filled in the contact form.

We share personal data only with service providers who process it on our behalf, under contract, and only as far as they need to for us to reply to you:

• Our website hosting and content delivery provider.
• Resend, which delivers contact form submissions to us by email.
• Our email provider, which stores the resulting correspondence.
• Our professional advisers (for example accountants or lawyers) where strictly necessary.

We do not send the contents of your contact form to any AI model provider as part of handling your enquiry. If that ever changes, we will update this policy before doing so.

We may disclose personal data if required by law, court order, or a lawful request from a public authority.

We operate from Israel and work with clients in Europe and North America, so your data may be stored or processed outside your home country. Israel benefits from a European Commission adequacy decision. Where a provider processes data outside the EEA or the UK without adequacy, we rely on Standard Contractual Clauses or another approved transfer mechanism.

• Contact form submissions that do not lead to an engagement: up to 24 months, then deleted.
• Correspondence and records relating to an engagement: for the duration of the engagement plus the period required by tax and contract law.
• Server logs: typically 30 days.

Subject to the conditions in applicable law, you can ask us to do any of the following, free of charge and normally within 30 days:

• Access the personal data we hold about you, and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data where we no longer have grounds to keep it.
• Restrict or object to how we process it, including on grounds relating to your particular situation.
• Receive your data in a portable, machine-readable format.

To exercise any of these, email info@toro-ai.net. If you are in the EEA or the UK and you believe we have handled your data improperly, you also have the right to lodge a complaint with your local supervisory authority. Residents of Israel have equivalent rights of review and correction under the Protection of Privacy Law, 5741-1981.

The site is served over HTTPS, and access to submissions is limited to the people at toro AI who need it to reply to you. No system is perfectly secure, so please do not send confidential technical details, credentials, or personal data about third parties through the contact form — we will arrange a secure channel once we are talking.

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.

If we change how we handle personal data, we will update this page and revise the date at the top. Material changes affecting people who have already contacted us will be communicated by email where we hold one.