Privacy policy

Your files are often unpublished research, client work or personal records. We treat them that way: we process them only to give you the result, and then we delete them.

Last updated: 21 October 2026

Who is responsible

Tooladoo is run by CEAPA COOL S.R.L., Str. Diana nr. 4, et. 3, ap. 16, 300577 Timișoara, Romania (Trade Register J35/956/2023, CUI 47755081, EUID ROONRC.J2023000956359). We are the controller of the personal data described here, under the EU General Data Protection Regulation (GDPR).

Contact for anything about your data: office@ceapa.cool.

Your files

We use your files only to run the tool you chose and give you the result. We never look at them, keep them, share them, sell them or use them to train anything.
Uploads are deleted as soon as processing ends, whether it worked or not. A job that is priced before it runs keeps its upload for at most 30 minutes while it waits for payment; cancelling it deletes the upload at once.
Results are kept for 30 minutes so you can download them, then deleted automatically. The “Delete now” button deletes them at once.
Each job runs in isolation with strict time and memory limits, and a tool can't see anyone else's files. Connections to the site are encrypted (HTTPS).
Your files may contain personal data about you or others (names in a document, faces in a video, positions in a GPS log). You decide what to upload; we process it only as described here.

What else we collect

Usage statistics: page views, jobs, downloads, error types, the page that linked to us and campaign tags in the address (utm_…). A visitor is recognised by a one-way code made from the IP address, the browser's user-agent and a random value kept on our server. The same browser on the same internet connection gets the same code, also on later visits, so we can tell returning visitors from new ones; another browser or connection gets another code. The code can't be turned back into your IP address, we don't store IP addresses in the statistics, and error details never include your files' contents. These records are kept for 400 days.
Usage limits: some tools limit how much one person, and one internet connection, can use them in a day, week, month or year. To apply these limits we record, for each use, the tool, the date, the visitor code described above (or your account, if you are signed in) and a one-way code made from the IP address. These records are kept for at most 400 days.
Technical logs and abuse protection: to keep the service safe and working, the servers keep short-lived technical logs, and the limit on how many jobs one visitor can start uses the IP address in memory only. Logs are kept for a limited time and then deleted or overwritten.
Your account (optional): if you create one, we keep your email address, whether you confirmed it, and a coded form of your password (never the password itself), or, if you use “Continue with Google”, the name, email address and account number Google sends us. We also keep the jobs you start while signed in (which tool and when; the files themselves are still deleted as described above), and your plans and purchases. Sign-in sessions last up to 30 days; password-reset and confirmation links work for one hour and one week. We keep the account until you ask us to delete it, except for purchase records that the law requires us to keep.
E-mails we send: account e-mails (confirming your address, resetting your password) go out through an e-mail delivery service that sends them from servers in the European Union, on our instructions.
Payments: purchases are processed by Stripe and sold to you by Link, Stripe's merchant of record service. Link handles your payment details, billing address and e-mail, charges you, sends you receipts and invoices and answers questions about the payment, under its own privacy policy (shown at checkout). We never see your card details. We keep a record of each purchase (what was bought, the amount, the date, the provider's references and, if you were signed in, your account), because accounting and tax law requires it.
E-mails: if you write to us, we keep the conversation as long as needed to answer and follow up.

We don't use advertising, profiling or automated decisions about you, and we don't sell personal data.

Why, and on what legal basis

Processing your files and giving you the result: to provide the service you asked for (GDPR Art. 6(1)(b)).
Statistics, usage limits, security, abuse prevention and fixing errors: our legitimate interest in running a safe, working service that is fair to everyone, and in learning which tools are useful (Art. 6(1)(f)). You can object at any time.
Your account and the e-mails about it: to provide the account you asked for (Art. 6(1)(b)).
Purchase records: our legal obligations under accounting and tax law (Art. 6(1)(c)).
Answering your messages: your request, and our legitimate interest in replying (Art. 6(1)(b) and (f)).

Where the data is and who helps us

Files are processed and data is stored on our own servers in the European Union, hosted by ROMARG SRL, in Romania. The hosting provider only stores and runs our systems on our instructions. Account e-mails are sent by an e-mail delivery service from servers in the European Union, on our instructions. Payments are processed by Stripe and Link, under their own privacy policies. If you sign in with Google, Google's privacy policy applies to your Google account. We don't transfer personal data outside the European Economic Area ourselves. The companies named above that work under their own privacy policies may process data outside it, with their own safeguards.

Cookies and storage

The site sets no cookies for visitors who don't sign in, and uses no tracking, advertising or third-party analytics cookies. If you sign in, a session cookie keeps you signed in (for up to 30 days, or until you sign out), and while you sign in with Google a cookie lasting at most 10 minutes protects that sign-in. Administrators get a session cookie when they sign in. These cookies are strictly necessary for signing in.

Your rights

You can ask us for access to your personal data, to correct or delete it, to restrict or object to its processing, and to receive it in a portable format. Write to office@ceapa.cool; we answer within one month. If you have an account, you can ask us to delete it. Since files are deleted after 30 minutes and statistics and usage records only hold one-way codes, there is often nothing left that we could identify as yours unless you have an account.

You can also complain to a data protection authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, București, dataprotection.ro; you may also go to the authority where you live or work.

Children

The service is not aimed at children under 16, and we don't knowingly collect their data.

Changes

If this policy changes, we update this page and the date above.