Full proposed legal documents

Scope, roles, and workspace responsibility

This Privacy Policy applies to the public Tuturuuu service portfolio: workspace collaboration; tasks and projects; calendars; contacts, CRM, attendance, reports and posts; chat, mail, meetings and drive; documents, CMS, forms and short links; finance, billing and payments; inventory, storefront, POS and promotions; time tracking; teaching and learning; AI products; APIs, CLI, integrations and developer tooling. Internal administration systems support service operations and are not separately offered products.

Tuturuuu JSC acts as controller for account, billing, security, product analytics and direct commercial relationship data. For customer content processed under a workspace administrator's instructions, Tuturuuu ordinarily acts as processor or service provider. Workspace administrators determine who may join, what data is uploaded, access roles, integrations, retention settings and lawful notices to their users.

Data categories, purposes, and legal bases

We may process account and profile details; workspace membership, roles and invitations; customer content and files; communications; contacts and attendance; financial, inventory, transaction and billing records; calendar and integration data; device, IP, cookie and security signals; support messages; API and key metadata; AI prompts, outputs, embeddings, images, agent steps, evaluation data and usage records.

Purposes include providing and securing the Services, authenticating users, completing transactions, operating integrations, customer support, reliability, fraud prevention, legal compliance and product improvement. Legal bases depend on context and jurisdiction and may include contract performance, legitimate interests, consent, legal obligation, and protection of vital or legal interests.

Retention, deletion, and export

Customer content is retained while the workspace or account is active and as configured by the customer. Deleted service data may persist in encrypted backups for a limited rotation period. Security and abuse logs are retained according to risk and operational need. Billing and tax records may be retained for statutory periods. Legal holds override ordinary deletion.

AI request metadata is retained for 365 days by default. Prompt, output, tool-argument and tool-result capture is off by default; when a workspace explicitly enables it, captured AI content is retained for 30 days by default. Workspace controls or enterprise terms may shorten or extend applicable periods. Aggregated or de-identified statistics may be retained where they no longer identify a person.

Security, transfers, and subprocessors

Tuturuuu uses access controls, encryption in transit, secret hashing, audit trails, tenant isolation, least-privilege operations, monitoring, incident response and secure development practices. No system is perfectly secure.

Data may be processed in countries where Tuturuuu or subprocessors operate. Where required, Tuturuuu uses recognized transfer mechanisms and supplementary safeguards. The maintained Subprocessor Registry lists purpose, data categories, regions and privacy information.

AI, automated processing, and integrations

Tuturuuu does not use customer prompts, outputs, files or evaluation datasets for general-purpose model training by default. Applicable no-training or data-control settings are propagated to supported providers. AI features can produce inaccurate, incomplete or biased output and may involve automated processing, but customers remain responsible for consequential decisions and appropriate human review.

We do not sell personal information or share it for cross-context behavioral advertising, subject to final provider and advertising-technology audit before publication. Optional integrations process data under their own terms and are enabled by users or workspace administrators.

Regional rights, children, and requests

Individuals retain applicable privacy rights. Workspace administrators and educational institutions must provide appropriate notices and obtain any required guardian consent before using the Services with children. AI and third-party integrations may impose additional age restrictions. Contact privacy@tuturuuu.com for assistance.

Billing, metering and connected services

Billing and entitlement operations use customer or workspace identifiers, member counts, plan and product references, invoice and payment status, usage totals, timestamps and support records. These records support access decisions, reconciliation, fraud prevention and billing disputes. Where Polar handles a transaction as merchant of record, it also processes transaction data for its own payment, tax and compliance responsibilities under its privacy notice.

Workspace administrators may see membership and usage information needed to administer their workspace. Connecting an app does not make all workspace content public. Shared links, recordings, AI context and integrations require appropriate permissions and user notices. Do not put secrets, full payment-card details or unrelated sensitive content into usage metadata.

Current law and requests

Applicable privacy rights depend on the individual, processing activity and governing law. Vietnam's Law on Personal Data Protection No. 91/2025/QH15 took effect on 1 January 2026; implementing rules and other applicable laws must also be considered. Where GDPR or UK GDPR applies, rights and transfer safeguards follow those laws. This policy does not claim universal applicability or certified compliance.

Contact privacy@tuturuuu.com for a rights request, processing question or applicable complaint route. We may verify identity proportionately. For customer-controlled workspace content, we coordinate with the relevant controller. Retention, deletion, provider configuration and training claims require verification for the specific service; a higher plan does not remove an individual's statutory rights.

Authority, workspaces, invitations, and content

These Terms govern the complete public Tuturuuu service portfolio described in the Privacy Policy. You represent that you can accept them for yourself or your organization. Workspace administrators control invitations, roles, member defaults, guest access and customer content, and must have authority and a lawful basis to administer their workspace.

You retain ownership of customer content and grant Tuturuuu a limited license to host, process, transmit, back up and display it only as needed to provide, secure and improve the Services. You are responsible for content, permissions, notices, exports and the conduct of users you invite.

APIs, keys, acceptable use, and integrations

You must protect credentials, API keys and devices; follow published limits and acceptable-use rules; and not attempt unauthorized access, unlawful surveillance, spam, abuse, malware, credential harvesting, safety-control bypass, model extraction or interference with the Services. AI-only `ttr_ai_` keys authorize only documented AI endpoints and never non-AI Tuturuuu APIs.

Integrations and curated agent tools access only capabilities explicitly approved by the user or administrator. Arbitrary HTTP requests, undeclared workspace access and unapproved code execution are prohibited. Third-party services remain subject to their own terms.

AI output, agents, evaluations, and previews

AI and generated output may be inaccurate, incomplete, offensive, non-unique or unsuitable. You must evaluate outputs, preserve human oversight and obtain rights needed for inputs and intended uses. Tuturuuu does not guarantee ownership, non-infringement or fitness of generated output.

Prompt, agent and evaluation versions may be immutable for reproducibility. Agent tools must be reviewed before activation. Evaluation graders consume credits like other model calls. High-impact decisions require qualified human review and compliance with applicable law.

Suspension, export, intellectual property, and confidentiality

Tuturuuu may suspend or limit access to address security threats, abuse, non-payment, legal requirements, material breach or risk to the Services. Where practicable, notice and an opportunity to cure will be provided. Customers should export data before termination; export and deletion remain subject to technical limits, backup rotation, legal holds and the DPA.

Each party retains its pre-existing intellectual property. Confidential information must be protected with reasonable care and used only for the relationship. Feedback may be used without restriction if it does not identify confidential customer information.

Warranties, liability, indemnity, and consumer rights

To the maximum extent permitted by law, Services are provided “as is” and “as available”; implied warranties are disclaimed. Neither party is liable for indirect, special, incidental, punitive or consequential damages, and aggregate liability is limited to amounts paid for the affected Services during the prior twelve months, except where a different limit is required by law or an enterprise order.

You will indemnify Tuturuuu for third-party claims arising from unlawful customer content, misuse or breach, subject to control-of-defense and cooperation procedures. Nothing excludes liability that cannot lawfully be excluded, limits mandatory consumer rights, or prevents remedies for fraud, wilful misconduct, death, personal injury or other protected claims.

Purchase terms and Polar

The checkout or signed order form identifies the plan, currency, billing interval, full amount due, seat basis, included allowances and applicable taxes. A monthly equivalent for annual billing is an illustration; the annual total is charged for the annual period. A pitch, roadmap, beta label or proposed price is not an offer or a promise of availability.

Where checkout is provided by Polar, Polar acts as merchant of record and authorized reseller for that transaction. Tuturuuu supplies the product and service license. The Polar Buyer Terms govern Polar checkout and reseller services. Use the payment method, invoice, cancellation and refund channels identified on your receipt or billing portal. Do not send full payment-card details to Tuturuuu support.

Seats, renewals, changes and refunds

The purchased plan defines who is a billable member and whether guest access is included; an invitation alone does not authorize an undisclosed charge. Administrators are responsible for reviewing seat quantities, renewal dates and any displayed proration before confirming changes. Cancellation through the billing portal stops future renewal according to the displayed effective date; deleting an app or leaving a workspace is not a cancellation request.

A new list price does not itself change an existing subscription. Existing pricing, change notices and effective dates follow the applicable subscription, order form and mandatory law. Material adverse changes require the notice and consent applicable to the transaction. Refund requests may be made through the receipt or billing portal, or to legal@tuturuuu.com for routing. Polar processes refunds for Polar purchases; mandatory withdrawal, refund and other consumer rights remain available. No blanket no-refund rule overrides those rights or Polar's applicable buyer terms.

Usage budgets, limits and data after downgrade

Allowances belong to the account or workspace identified in the purchased plan; paid workspace capacity is not automatically shared across independent workspaces. Usage counters, reset periods, reservation rules, credit expiry and any billable failures must be disclosed for the relevant feature. AI credits are service usage units, not money, deposits or transferable financial assets. Included and purchased credits may have different expiry rules stated before purchase.

An upgrade does not bypass security, abuse, per-file or provider safety limits. Additional paid consumption requires the applicable purchase or enabled spending authorization. When a lower allowance applies, Tuturuuu may restrict new consumption while preserving existing data access and export where technically and legally available. A quota reduction alone is not permission to delete customer content. Security incidents, unlawful content and legal obligations may require separate restrictions.

Scope, roles, and instructions

The customer is controller and Tuturuuu is processor for personal data submitted to a workspace, except where each acts as an independent controller. Tuturuuu processes data only on documented instructions in the agreement, product configuration, support requests and lawful customer directions. Processing supports the service categories disclosed in the Privacy Policy for the agreement term and applicable retention period.

Confidentiality and safeguards

Personnel authorized to process personal data are bound by confidentiality. Tuturuuu maintains safeguards appropriate to risk, including access control, encryption, tenant isolation, monitoring, secure development, incident response, resilience and recovery measures. The customer remains responsible for lawful collection, notices, permissions, endpoint security and configuration.

Subprocessors and international transfers

The customer generally authorizes the subprocessors in the maintained registry. Tuturuuu will provide notice of material additions where contractually required and a reasonable objection process. International transfers use applicable legal mechanisms, including recognized contractual clauses and supplementary measures where required.

Audits, return, and deletion

Upon reasonable request, Tuturuuu will provide information needed to demonstrate compliance. Audits must protect other customers, security and confidentiality and ordinarily begin with independent reports or written evidence. On termination, customer data is returned or deleted according to product export capabilities, backup rotation, legal retention and documented instructions.

Processing particulars and independent roles

Processing may involve workspace members, guests, customers, contacts, learners and other people whose data the customer submits. It covers hosting, storage, retrieval, access control, transmission, support, deletion and configured AI or integration processing for the service term and applicable return/deletion period. Data categories are described in the Privacy Policy and customer instructions. The customer must not submit data prohibited by its agreement and must identify any special processing requirements before use.

A provider acting as an independent controller for its own billing, legal or payment obligations is not a subprocessor for those activities merely because it appears in the provider registry. Executed agreements must identify the applicable roles, locations, transfer mechanism and security annex. A registry entry alone is not an executed international-transfer agreement.

Incident assistance and exit

Where processor obligations apply, Tuturuuu notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data; notification is not postponed solely to await a completed investigation. Available information may be provided in stages, with reasonable assistance for the customer's reporting and rights-response obligations.

On termination, the customer may request return or deletion of customer-controlled personal data under the agreement. Backup cycles and legally required retention must be explained, and retained data remains protected and limited to the permitted purpose. Account-level billing records retained under an independent legal obligation are handled under the Privacy Policy. Plan downgrade or credit exhaustion does not override these obligations.

Definitions and activation

This SLA is contractual-only. “Available” means the covered production service can accept and process ordinary requests, excluding scheduled maintenance and exclusions below. Measurement method, covered services, uptime target and credit schedule apply only when an enterprise order form expressly activates them.

Exclusions, incidents, and maintenance

The executed order defines maintenance windows, exclusions, incident communications and dependency treatment. Exclusions must be applied consistently with that order and mandatory law. Tuturuuu prioritizes restoration and accurate incident assessment.

Credits and claim procedure

The executed order specifies eligibility, credit limits, claim deadlines and the supported remedy. Submit claims through the designated support channel with incident dates, impact and request identifiers. Tuturuuu assesses claims in good faith. Billing adjustments must be supported by the merchant of record; mandatory legal remedies remain available.

Coverage, dependencies and credits

A plan name, pricing card or pitch does not activate an SLA. An executed order must name the covered production services, measurement window, availability target, support hours, severity definitions, exclusions and claim procedure. Preview products and unapproved roadmap capabilities are outside coverage unless explicitly included.

The order must explain treatment of dependencies and provider outages; the fact that infrastructure is supplied by a third party does not by itself decide whether an outage is excluded. Service credits are distinct from AI usage credits, refunds and mandatory legal remedies. Where a merchant of record issues invoices, any approved service credit must use a supported billing adjustment or another agreed method rather than promising an unsupported invoice operation.

Maintained provider registry

Tuturuuu uses vetted providers to host, secure, communicate, bill, observe and optionally power integrations or AI. A provider receives only data appropriate to the enabled purpose. The current registry includes Supabase, Vercel, Cloudflare, OpenAI, Google Cloud, Microsoft, Polar, Resend, and Sentry.

For each provider, Tuturuuu maintains its purpose, data categories, operating regions, privacy link and change date in the canonical registry used by product and legal coverage tests. Provider use varies by customer configuration and selected integrations.

Conditional providers and changes

AI model providers are engaged only when a workspace uses an enabled model. Integration providers are engaged only when users connect or invoke the integration. Tuturuuu evaluates contractual, privacy and security controls and propagates supported no-training and retention options. Customers may contact privacy@tuturuuu.com for current transfer information or contractual objection procedures.

Provider roles and feature-specific processing

The registry identifies providers that may process data; it is not a statement that every customer uses every provider or that every provider acts as a processor for every activity. Polar may act independently for merchant-of-record transactions. AI, communications and integration providers depend on enabled functionality and routing.

Cloudflare services may support application execution, durable collaboration state, file storage and realtime/media delivery in addition to network security. Confirm the service-specific data flow, enabled region and contractual safeguards before making residency, retention or no-training commitments. Material changes follow applicable contractual notice and objection rights; requests can be sent to privacy@tuturuuu.com.

Lawful and authorized use

Use Tuturuuu only for lawful purposes and data you are authorized to process. Do not distribute malware, stolen credentials, unlawful sexual content, exploitative material, or content that infringes another person’s rights. Do not use workspace access, invitations, APIs, integrations or shared links to bypass another person’s permissions.

Finite budgets and fair resource use

AI, file storage, transfers, meetings, recordings, email and hosted execution consume finite resources. Follow the displayed plan allowances and technical limits. Do not create accounts, workspaces, API keys or repeated jobs to evade quotas, multiply promotional credits, conceal usage, or bypass spending limits. Buying additional credits does not authorize abusive traffic or defeat provider safety controls.

Communications and automation

Do not send spam, impersonate senders, harvest contacts or conduct unauthorized surveillance. Obtain required consent for recording, transcription, outreach and automated processing. Review agent permissions and outcomes; restrict tools to the resources and actions the user or administrator has authorized. Do not use automation to collect secrets or confidential data without permission.

Security research and reporting

Report suspected vulnerabilities privately to security@tuturuuu.com with the affected service and reproducible steps. Do not access other tenants, exfiltrate personal data, run disruptive load tests or persist access without prior written authorization. Stop if testing exposes another person’s data. Reporting a vulnerability does not grant permission for unrestricted testing.

Enforcement and review

Tuturuuu may throttle requests, stop a job, restrict a feature or suspend an account to address abuse, security, non-payment or legal obligations. Where practicable, action is proportionate and includes notice and a path to request review at legal@tuturuuu.com. Include account or workspace identifiers and relevant timestamps; do not include passwords or payment-card data. Mandatory legal rights remain available.

Respect people and their boundaries

Communicate constructively. Do not harass, threaten, dox, discriminate against or exploit others. Respect workspace roles, moderators and the boundaries of private conversations. Criticism of ideas and product feedback is welcome; targeting people with abuse is not.

Share responsibly

Share only content you have permission to use. Do not post private contact information, confidential workspace material or recordings without the required consent. Clearly identify promotional material and avoid deceptive claims, impersonation and spam. Label AI-generated material when its origin could materially affect how others understand it.

Protect learners and participants

Teachers, hosts and administrators must apply appropriate consent, supervision and access controls. Do not use community spaces to exploit minors or solicit inappropriate contact. Report unsafe content and avoid reposting it. Meeting participants should know when recording, transcription or AI assistance is active.

Use shared capacity considerately

Respect meeting participant limits, storage allowances, AI budgets and communications limits. Additional credits purchase defined usage; they do not buy exemption from moderation or security controls. Avoid repeated large uploads, automated message floods or disruptive meeting behavior.

Reports, moderation and appeals

Use available in-product reporting tools or contact community@tuturuuu.com with relevant context. Moderators may remove content, restrict participation or refer serious cases to security or legal review. Decisions may be challenged through the same contact channel. Do not retaliate against someone for making a good-faith report.