GDPR & data processing
TODO for AI Kft. is an EU company (Budapest, Hungary) and works under the EU General Data Protection Regulation (GDPR). This page summarises what that means in practice. The legal texts are the Privacy Policy, the GDPR & sub-processors page and the Terms of Service. If this page and those texts differ, the legal texts apply.
Roles
| Data | Controller | Processor |
|---|---|---|
| Your business data in TODOs: emails, contacts, invoices, files, account access | You (your company) | TODO for AI |
| Your account: sign-up, billing, product emails | TODO for AI | — |
As processor we use your business data only to run your TODOs. It is not used for anything else and not used to train AI models.
Where your data goes
A TODO's content goes to the provider of the model it runs on. If that model refuses or fails, a configured fallback model may take over. Voice and web providers receive only what those features process (audio, a search query, a URL). Tools you connect yourself (your Gmail, CRM, invoicing) run under your own agreements with those services and are not our sub-processors.
Sub-processors
Transfers outside the EU are covered by the EU–US Data Privacy Framework (DPF) or EU Standard Contractual Clauses (SCCs). Changes are announced on the GDPR page at least 14 days in advance.
Infrastructure (always used)
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Servers, storage, backups | Germany / Finland (EU) | EU |
| Cloudflare, Inc. | DNS, CDN, network security | Global (EU PoPs) | DPF / SCCs |
| Resend, Inc. | System notification emails | USA | SCCs |
| Stripe Payments Europe, Ltd. | Payments (billing data only) | EU / USA | DPF / SCCs |
| PostHog, Inc. | Product analytics (no message content) | EU (Frankfurt) | DPF / SCCs |
AI models (the one a TODO runs on, plus a fallback if configured)
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| OpenAI | GPT models | USA | DPF / SCCs |
| Anthropic | Claude models | USA | DPF / SCCs |
| Gemini models | USA / EU | DPF / SCCs | |
| X.AI | Grok models | USA | SCCs |
| OpenRouter | Routing to other models | USA + model provider's country | SCCs |
AI providers are used under their business API terms, which exclude training on API data.
Voice and web features (only when used)
| Provider | Purpose | Location |
|---|---|---|
| Soniox, Deepgram | Speech-to-text | USA |
| ElevenLabs | Speech-to-text, text-to-speech | USA |
| Cerebras | Fast model for the voice assistant | USA |
| Firecrawl | Web page fetching | USA |
| Exa | Web search | USA |
Companies can ask for a restricted provider set (for example only EU or only specific model vendors): privacy@todofor.ai.
Your rights
Access, rectification, erasure, restriction, objection and portability. Two of them are self-service:
Export your data
Settings → Data Control → Export downloads one JSON file with:
- projects, TODOs and messages
- settings, devices, usage and transactions
- brand pages, attachment metadata, vault paths
Not included: vault secret values, OAuth credentials, API key values and file contents (download files from the TODOs or Files panel). One export every 10 minutes.
API: GET /users/export (API reference).
Delete your account
Settings → Data Control → Delete All Data, type DELETE to confirm.
Active data is deleted right away and cannot be restored. If a step fails, deletion is retried. The payment ledger is kept pseudonymised (no name, email or TODO titles), and Stripe keeps invoices as accounting law requires. Backups are not purged immediately; they expire on their normal rotation. Ask privacy@todofor.ai for current backup retention.
Other requests
Correction, restriction, objection or questions: privacy@todofor.ai. You can also complain to the Hungarian supervisory authority, NAIH (naih.hu), or the authority in your country.
Data Processing Agreement (DPA)
A GDPR Article 28 DPA (English and Hungarian) is available on request from privacy@todofor.ai. It covers processing instructions, confidentiality, security measures, breach notification, deletion, audit rights, international transfers and the provider set you enable.
Retention
| Data | Kept |
|---|---|
| TODOs, messages, files, vault | Until you delete them or your account |
| Account data | While your account exists |
| Invoices, payment ledger | As required by Hungarian accounting law; pseudonymised after account deletion |
| Backups | Until they expire on rotation |
Contacts
| Company | TODO for AI Kft., Csorna utca 3., Budapest, Hungary · VAT HU32812154 |
| Privacy | privacy@todofor.ai |
| Security | security@todofor.ai |
| Support | support@todofor.ai |
See also Security.