Privacy Policy

Welcome to Toi 'n' Moi® ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice or our practices with regard to your personal information, please contact us.

This Privacy Policy applies to all information collected through our website (toinmoi-ai.com), our AI chatbots (the website chat widget and "Sara" on WhatsApp), our WhatsApp Business account, our downloadable apps, and any related services, sales, marketing, or events. By accessing or using any of these, you agree to this Privacy Policy.

Toi 'n' Moi® Ltd, a company registered in England and Wales with its registered office at 20 Wenlock Road, London N1 7GU, United Kingdom, is the data controller responsible for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For questions about how we handle your data, or to exercise any of the rights described below, contact us using the details in the "Contact Information" section.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Website, when you message us on WhatsApp or our website chat, or otherwise when you contact us.

• Personal Identity Information: Name, email address, phone number, and other similar contact data.
• Conversation Data: The messages you send to our website chat widget or to our WhatsApp Business account, and our AI chatbots' replies to you.
• Credentials: Passwords, password hints, and similar security information used for authentication and account access in our apps.
• Payment Data: We may collect data necessary to process your payment if you make purchases, such as your payment instrument number (such as a credit card number), and the security code associated with your payment instrument.
• Technical Data: IP address, browser type and version, time zone setting, operating system, and platform.
• App Usage Data: Account details, in-app activity, and device information collected by our apps — see Section 8.

We use personal information collected via our Website, chatbots, WhatsApp, and apps for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations.

Our website chat widget and our WhatsApp assistant are AI-powered. When you use them, you are talking to an automated system, not a person, unless our team follows up with you directly.

• Local AI, hosted by us: Both chatbots run on AI infrastructure we own and operate ourselves, in the United Kingdom. Your conversation is not sent to third-party AI companies (such as OpenAI, Anthropic, or Google) to generate these chatbots' replies.
• Third-party AI in our client projects: As part of our AI Infrastructure services, we sometimes build systems for clients that do use third-party cloud AI providers, where that's the right fit for their project. That is a separate, project-specific arrangement between us and that client — it does not apply to your data as a visitor to our own chatbots.
• What we do with your conversation: If you choose to share your name and email so our team can follow up, we store that conversation (including the AI's replies) to action your enquiry, and — only with your explicit, separately-asked consent — to send you marketing updates about our products. If you don't share your details, we don't link the conversation to your identity.
• Consent is never assumed: Our chatbots only record your marketing consent as "yes" if you give a clear, unambiguous answer to a direct question about it. Anything else — including silence, an unclear reply, or moving on to another topic — is treated as "no," and we do not ask again in the same conversation.

We offer a WhatsApp Business account so you can browse our apps, ask questions, and get in touch. When you message us on WhatsApp, we (through our messaging platform provider) receive your phone number, WhatsApp profile name, and the content of your messages.

Your use of WhatsApp itself is also governed by WhatsApp's and Meta's own terms and privacy policy, which explain how the WhatsApp platform handles your data as the messaging service — our policy here only covers what we do with the data once we receive it.

Text the word "reset" or "restart" at any point in a WhatsApp conversation with us to start over.

We use a small number of strictly necessary cookies to run the Website (for example, to remember your cookie preference itself). We only set analytics cookies (Google Analytics) after you explicitly accept them via the cookie banner shown on your first visit — they are never set beforehand. You can change your choice at any time by clearing your browser's site data for toinmoi-ai.com, which will show the banner again on your next visit.

You can also instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, you may not be able to use some portions of our Service, though the core Website and chatbot remain fully usable without them.

We publish a portfolio of iOS, macOS, Android, and Windows apps, listed on our App Market page. This section describes the baseline that applies across that portfolio:

• Local-only apps: Some of our apps (for example, offline/local editions) store your data entirely on your own device and do not send it to us at all.
• Account-based apps: Apps that offer sign-in, sync, or subscriptions (for example, our Rota Management and ShiftSync products) send the data needed to provide that account, sync, and billing functionality to our servers, hosted in the United Kingdom.
• Platform data: Where an app is distributed via the Apple App Store, Google Play, or Microsoft Store, that store's own "data safety"/"privacy nutrition label" disclosure for the specific app is the most detailed, app-specific source — this policy is the shared baseline behind it.
• Payments: App purchases and subscriptions are processed by the relevant app store or by Stripe; we do not receive or store your full card details.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Website is at your own risk. You should only access the services within a secure environment.

We keep personal information only for as long as necessary for the purposes set out in this policy — for example, to respond to your enquiry, deliver a service you've signed up for, or meet our legal and accounting obligations. When we no longer have a legitimate need to keep it, we delete it or anonymize it; if that isn't immediately possible, we securely store it and isolate it from further use until deletion is possible.

Toi 'n' Moi® Rota Management

When you delete a Rota Management organisation account, most of your data — staff records, shift schedules, rota patterns, site and location details, and your account login — is permanently deleted immediately. Your Stripe subscription is cancelled at the same time, so billing stops immediately too.

A narrow category of records is anonymized rather than deleted: shift-offer and shift-cancellation history for any staff member whose records demonstrate compliance with the notice periods required by the Employment Rights Act 2025. Where that applies, the staff member's name, email, phone number, and other identifying details are permanently scrubbed, but the underlying notice-period record itself is kept for six years, as the Act requires — this is evidence of your organisation's own compliance, not personal data about an identifiable person once anonymized.

Stripe, our payment processor, retains its own records of payments and invoices according to its own retention policies and applicable financial-record-keeping law — that retention is outside our control and is not affected by deleting your Rota Management account with us.

Our own servers — including the ones running our AI chatbots — are located in the United Kingdom. Some of the third-party services we rely on (for example, email delivery, or Google Analytics if you consent to it) may process data outside the UK, including in the United States. Where that happens, we rely on the safeguards required by UK GDPR, such as the UK's International Data Transfer Agreement or an adequacy decision, to ensure your data stays protected.

Depending on your location (such as the UK or EEA), you may have certain rights regarding your personal information:

• Right to Access: Request copies of your personal data.
• Right to Rectification: Request correction of inaccurate information.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request restriction of processing your personal data.
• Right to Data Portability: Request transfer of your data to another organization.
• Right to Withdraw Consent: Where we rely on your consent (for example, marketing emails or analytics cookies), withdraw it at any time — this won't affect processing carried out before you withdrew it.

To exercise these rights, please contact us using the details provided in the "Contact Information" section. If you're not satisfied with our response, UK residents have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Our Website, chatbots, WhatsApp account, and apps are not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal reasons. We'll update the "Last Updated" date at the top of this page whenever we do — please check back periodically.