Privacy Policy

1. Who we are

Toolify LLC operates the Toolify platform, comprising SOLAR (Windows Server/SQL Server licensing assessment) and T365 (Microsoft 365 license optimisation), both live today, with ARCUS (Azure cost optimisation) and BOM Builder (Microsoft SKU/pricing lookup) planned for later this year. Modules are activated individually per account — the data collected under Section 2 below only applies to modules actually enabled on your account. This policy applies to the platform as a whole and will be updated as new modules launch. Our servers are located in the Netherlands (EU). Questions: legal@toolify.io

2. What we collect

We collect only what is necessary to provide the service, scoped to the modules you use:

• Account data (all modules) — the email address and company name you provide at registration. You may use any email address; we do not verify it.
• SOLAR — server names, CPU/core counts, operating system versions, SQL instance details, and similar infrastructure inventory you upload. This data does not identify individuals.
• T365 — with your authorisation, we connect to your Microsoft 365 environment via the Microsoft Graph API (read-only access) to collect license assignments, usage reports (mailbox, OneDrive, Teams, Power BI), and user identity attributes (display name, user principal name, account status, sign-in activity) needed to produce licensing recommendations. This does include personal data about individual users in your organisation. Full detail on the exact Graph permissions requested, and what is never accessed, is set out on our Security & Data Handling page.
• ARCUS & BOM Builder (planned) — expected to process Azure resource, usage, and cost metadata (ARCUS) and Microsoft SKU/pricing data already collected via other modules (BOM Builder). This policy will be updated with specifics before either module goes live.
• Usage data — basic session information needed to operate the service, plus cookieless, aggregate visit analytics (page views, referrers, general location, device type) via Plausible, an open-source tool we run entirely on our own infrastructure. No individual visitor is identified, no data is shared with or processed by any third party, and no cookies are set for this purpose.

3. What we do not collect

Regardless of which modules you use, we never collect email content, message content, document or file contents, or financial and business application data — nor anything beyond what is explicitly listed in Section 2 above. We do not use cookies for tracking or advertising. Our website analytics are cookieless, self-hosted on our own infrastructure, and never shared with or processed by a third party. We do not share your data with third parties for any commercial purpose.

4. How we use your data

Your data is used solely to authenticate you, provide and improve the service, send service-related communications, and respond to support requests. We do not use your data for marketing without your explicit consent.

5. Where your data is stored

All data is stored on servers located in the Netherlands (EU). No data is transferred to or processed outside the EU/EEA.

6. How long we keep your data

We keep your data for as long as your subscription is active. On expiry or cancellation, data is retained for 90 days then permanently deleted. Detailed retention timelines for specific data types — including Microsoft 365 sync data, uploaded files, and analysis outputs — are set out on our Security & Data Handling page.

7. Your rights (GDPR)

If you are based in the EU/EEA, you have the right to access, correct, or delete your personal data at any time. Contact us at legal@toolify.io. We will respond within 30 days.

8. Security

Our security measures, infrastructure standards, data handling procedures, and retention timelines are documented in full on our Security & Data Handling page.

9. Cookies

We use only a single session cookie, strictly necessary for authentication. No tracking, analytics, or advertising cookies.

10. Changes

We may update this policy from time to time. We will notify you by email at least 14 days before material changes take effect.