Privacy policy

Who handles your data

Totono is operated by Alex Studnička. For privacy questions or requests, contact support@totono.work. An organization using Totono controls the records it enters into its workspace and decides which people may access them. Totono processes those records to provide the service to that organization.

Data we process and why

We process account details such as name and email address, sign-in credentials in hashed form, workspace membership and permissions, and the records users enter or import. We also process essential session and security information, support requests, and limited operational logs and audit events. We use this information to provide the requested service, authenticate users, enforce workspace access, support users, and protect the service.

Where applicable, this processing is necessary to perform our service agreement or to pursue legitimate interests in service security, support, and reliability. An organization using Totono determines the purposes for the workspace data it controls.

ChatGPT connection

When you connect Totono to ChatGPT, you choose one workspace and grant read access, with optional permission for routine edits. ChatGPT sends tool requests to Totono, and Totono returns only records that your account may access. The returned information goes to ChatGPT so it can answer your request and display record previews. Your ChatGPT use is also subject to OpenAI's own privacy terms.

Totono stores the connection, granted scopes, authorization records, and a minimal audit trail of edits. Edit previews expire after five minutes. Totono checks membership and permissions on every call. Disconnecting in your Totono profile revokes further access through that connection. The plugin does not return Vault secret values, passwords, API keys, or session tokens.

Sharing and storage

We share information with service providers needed to host, secure, and operate Totono, and with integrations that a workspace chooses to enable. For the ChatGPT plugin, the requested tool results are shared with OpenAI as described above. We may disclose information when required by law. Some providers may process data outside your country; contact us for details about a particular integration or transfer.

We retain account and workspace data while needed to provide the service and according to the workspace's settings and applicable legal obligations. Connection access ends when revoked. Operational and audit records may be retained after disconnection for security and accountability. Contact us for details about retention or to request deletion of data for which we are responsible.

Your choices and rights

You can change permitted profile details in Totono and disconnect ChatGPT from your profile. For access, correction, deletion, restriction, portability, or objection requests concerning your personal data, contact us. If your request concerns records controlled by your organization, we may direct you to its workspace administrator. You may also complain to your data protection authority.

We use essential cookies or similar storage to keep you signed in and protect your session. You can clear them in your browser, which may sign you out.

Updates

We will publish changes to this policy here with a new effective date. For help with Totono or the ChatGPT plugin, visit Totono support.