Privacy Policy

1. Who we are

Toolify LLC operates the Toolify.io platform, comprising SOLAR (Windows Server/SQL Server licensing assessment) and T365 (Microsoft 365 license optimisation). Modules are activated individually per account; the data collected under Section 2 below only applies to modules actually enabled on your account. This policy applies to the platform as a whole and will be updated as new modules launch. Our servers are located in the Netherlands (EU). Questions: legal@toolify.io

2. What we collect

We collect only what is necessary to provide the service, scoped to the modules you use:

• Account data (all modules): the email address and company name you provide at registration.
• SOLAR: server names, CPU/core counts, operating system versions, SQL instance details, and similar infrastructure inventory you upload. This data does not identify individuals.
• T365: with your authorisation, we connect to your Microsoft 365 environment via the Microsoft Graph API (read-only access) to collect license assignments, usage reports (mailbox, OneDrive, Teams, Power BI), and user identity attributes (display name, user principal name, account status, sign-in activity) needed to produce licensing recommendations. This does include personal data about individual users in your organisation. Full detail on the exact Graph permissions requested, and what is never accessed, is set out on our Security & Data Handling page.
• Usage data: basic session information needed to operate the service. On our public website we also count visits with Plausible, a cookieless analytics tool we run on our own infrastructure, which identifies no individual visitor. Only if you accept it in our cookie notice, we also use Google Analytics, see Section 9.

3. What we do not collect

Regardless of which modules you use, we never collect email content, message content, document or file contents, or financial and business application data, nor anything beyond what is listed in Section 2. We do not use cookies for advertising. Google Analytics only runs after you accept it, and you can withdraw that consent at any time. We do not share your data with third parties for any commercial purpose.

4. How we use your data

Your data is used solely to authenticate you, provide and improve the service, send service-related communications, and respond to support requests. We do not use your data for marketing without your explicit consent.

5. Where your data is stored

Client data is stored on servers in the Netherlands (EU), and our encrypted backups are kept in the EU as well. Remote access by our team from outside the EU/EEA, and our use of service providers based outside the EU/EEA, is covered by Standard Contractual Clauses. Our sub-processors are listed on our Security & Data Handling page.

6. How long we keep your data

We keep your data for as long as your subscription is active. On expiry or cancellation, data is retained for 90 days then permanently deleted. Detailed retention timelines for specific data types, including Microsoft 365 sync data, uploaded files, and analysis outputs, are set out on our Security & Data Handling page.

7. Your rights (GDPR)

If you are based in the EU/EEA, you have the right to access, correct, or delete your personal data at any time. Contact us at legal@toolify.io. We will respond within 30 days.

8. Security

Our security measures, infrastructure standards, data handling procedures, and retention timelines are documented in full on our Security & Data Handling page.

9. Cookies

The platform itself uses a single session cookie, strictly necessary for signing in. Our public website only sets Google Analytics cookies if you accept them in our cookie notice; they help us understand which pages are useful. If you decline, no analytics cookies are set. Your choice is remembered in a small first-party cookie, so we don't ask again.

10. Changes

We may update this policy from time to time. We will notify you by email at least 14 days before material changes take effect.