Tofu Technologies, Inc. (the “Company”) is committed to maintaining robust privacy protections for its users. This Privacy Policy (“Privacy Policy”) is designed to help you understand how we collect, use, and safeguard the information you provide to us and to assist you in making informed decisions when using our Service.
For purposes of this Privacy Policy:
- “Site” refers to the Company’s websites at tofuads.com, including its subdomains.
- “Service” refers to the Company’s services accessed via the Site, where users can plan, build, launch and optimize paid advertising campaigns across channels such as LinkedIn, Google Search and Google Display.
- “We,” “us,” and “our” refer to the Company.
- “You” refers to you, as a user of our Site or Service.
By accessing our Site or Service, you accept our Privacy Policy and Terms and Conditions and you consent to our collection, storage, and use of your information as described herein.
Information we collect
We collect “Non-Personal Information” and “Personal Information.”
- Non-Personal Information includes data that does not personally identify you (e.g., usage data, browser type, referring URLs, platform, preferences, number of clicks).
- Personal Information includes your email address and any other identifying information you voluntarily submit during registration or through your use of the Service.
To activate the Service, you only need to submit your email address. However, we also collect technical information such as the referring URL, browser type, device, date/time of access, and usage behavior via cookies.
Cookies help us:
- Administer user accounts
- Protect the platform against unauthorized use
- Measure user engagement and improve performance
We use both session and persistent cookies. You may disable cookies via browser settings, though this may affect your experience.
Account registration
To subscribe to the Service, you’ll create a user profile by providing an email address, username, and password. By registering, you authorize us to collect, store, and use this information under the legal bases described below.
Legal bases for processing
We process your personal data only when we have a valid legal basis under applicable data protection laws, including the GDPR. These include:
- Performance of a contract – to provide services like onboarding, support, and billing
- Consent – when you’ve opted into marketing communications or cookies
- Legal obligation – when we must retain billing or tax data
- Legitimate interests – to operate, secure, and improve our services (in ways that do not override your privacy rights)
Examples of processing activities and their legal bases:
- Service registration (Contract): Email, password
- Product usage analytics (Legitimate interests): IP, device, browser
- Support requests (Contract): Email, support transcripts
- Marketing emails (Consent): Email, opt-in status
- Billing and compliance (Legal obligation): Billing address, payment data
- Fraud/security detection (Legitimate interests): IP address, login activity
Children’s privacy
The Site and Service are not intended for individuals under age 13. If we discover that we’ve collected information from someone under 13 without verified parental consent, we will delete it promptly. Please contact [email protected] if you believe this has occurred.
How we use information
Personal Information
We use Personal Information to:
- Communicate with users
- Provide support
- Improve our services
- Send marketing communications (if you’ve opted in)
We do not sell, trade, or rent your Personal Information for marketing purposes. We may share it with vendors performing services for us (e.g., email delivery platforms) under strict confidentiality obligations.
We may disclose your information if required by law, to protect rights and safety, or during a company acquisition or merger.
Non-Personal Information
We use Non-Personal Information to:
- Improve the Site and Services
- Customize the user experience
- Aggregate data for usage trend analysis
This information may be shared with partners or advertisers in aggregate, non-identifiable form.
Data retention
We retain personal data only as long as necessary for the purposes for which it was collected, including legal and regulatory compliance. Our standard retention periods are:
- Customer account data – retained while the account is active and deleted within 24 months of closure or inactivity
- Billing and invoicing data – retained for 7 years
- Support tickets and chat logs – retained for up to 2 years
- Marketing preferences and consent records – retained until you withdraw consent or unsubscribe
You may request deletion of your data at any time (see “Your rights” below).
Security
We implement reasonable technical and organizational measures to protect your data, including encryption, firewalls, and secure password hashing. However, no method of transmission is 100% secure. By using our Service, you acknowledge and accept these risks.
Your rights
If you are located in the United Kingdom or European Economic Area, you have the right to:
- Access – request a copy of your personal data
- Rectify – correct inaccurate or incomplete information
- Erase – request deletion of your data (under certain conditions)
- Restrict – limit processing in specific scenarios
- Port – obtain and reuse your data elsewhere
- Object – to processing based on legitimate interests or marketing
- Withdraw Consent – at any time if consent is the legal basis
- Not be subject to automated decision-making that significantly affects you
To exercise these rights, contact us at [email protected]. We respond within one month.
Marketing emails
You may unsubscribe from marketing emails by clicking “unsubscribe” in the footer or by contacting [email protected]. Note: We may still send non-promotional emails (e.g., policy updates, account-related notices).
Third-party websites
Our Site may link to third-party websites. We are not responsible for their privacy practices. This policy only applies to data collected through our Site and Service.
International data transfers
If you are in the UK or EEA, your data may be transferred to the United States or other countries. When we do so, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the relevant supervisory authorities, including the UK Information Commissioner’s Office where applicable.
Changes to this policy
We reserve the right to modify this Privacy Policy. Significant changes will take effect 30 days after posting. Non-material changes are effective immediately. Please check this page periodically.
Contact us
If you have questions about this Privacy Policy, contact us at: [email protected]