Privacy Policy

Who is responsible

Autothink Group Limited (company no. 13994278), trading as AutoToast, registered office Moss Bridge House, Moss Bridge Road, Rochdale, OL16 5EA, United Kingdom ("AutoToast", "we", "us") is the controller of personal data about our customers, website visitors and account users. Contact: info@autotoast.com, or write to us at our registered office.

For personal data stored inside the websites, databases and videos you host with us, we act as your processor — see the Data Processing Agreement.

What we collect

Account details: name, email, company or agency name, password (stored hashed), two-step sign-in settings, profile picture.

Billing details: billing address and payment records. Card details are collected and held by Stripe; we never see your full card number.

Service data: websites, domains, server settings, backup and job records, support messages, AI assistant conversations and audit logs of actions in your account.

Technical data: IP address, browser and device information, sign-in times and security events.

Why we use it and our lawful bases

To provide the Services, manage your account and take payment — performance of our contract with you.

To keep the Services secure, prevent fraud and abuse, and improve our platform — our legitimate interests.

To send service, billing and security emails — contract and legitimate interests. We only send marketing with your consent or where the law allows, and you can opt out at any time.

To keep accounting and tax records and respond to lawful requests — legal obligation.

Who we share it with

We use trusted service providers who process data for us under contract: Stripe (payments), SendGrid / Twilio (email delivery), Hetzner Online GmbH (servers and storage in Germany and Finland), Bunny.net (content delivery network), our application hosting and database provider, and AI model providers that power Tom (only the site information needed to answer your request).

We do not sell personal data. We may disclose data where required by law or to protect our rights, customers or the public.

International transfers

Website servers and backups are in the European Economic Area, which the UK recognises as adequate. Some providers (such as Stripe and SendGrid) may process data in the United States; we rely on the UK International Data Transfer Addendum, the UK Extension to the EU–US Data Privacy Framework, or other lawful safeguards.

How long we keep it

Account data for as long as your account is open and up to 2 years afterwards; billing records for 6 years for tax purposes; security and audit logs for up to 2 years; backups of Your Content for up to 30 days after deletion.

Your rights

You have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent. Email info@autotoast.com and we will respond within one month.

If you are unhappy, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to help first.

Security

We use encryption in transit, hashed passwords, two-step sign-in, per-site isolation, least-privilege access, encrypted off-server backups and audited staff access. See our Security page.

Cookies

See our Cookie Policy.