Privacy Policy

This Privacy Policy applies to the public Tuturuuu service portfolio: workspace collaboration; tasks and projects; calendars; contacts, CRM, attendance, reports and posts; chat, mail, meetings and drive; documents, CMS, forms and short links; finance, billing and payments; inventory, storefront, POS and promotions; time tracking; teaching and learning; AI products; APIs, CLI, integrations and developer tooling. Internal administration systems support service operations and are not separately offered products.

Tuturuuu JSC acts as controller for account, billing, security, product analytics and direct commercial relationship data. For customer content processed under a workspace administrator's instructions, Tuturuuu ordinarily acts as processor or service provider. Workspace administrators determine who may join, what data is uploaded, access roles, integrations, retention settings and lawful notices to their users.

We may process account and profile details; workspace membership, roles and invitations; customer content and files; communications; contacts and attendance; financial, inventory, transaction and billing records; calendar and integration data; device, IP, cookie and security signals; support messages; API and key metadata; AI prompts, outputs, embeddings, images, agent steps, evaluation data and usage records.

Purposes include providing and securing the Services, authenticating users, completing transactions, operating integrations, customer support, reliability, fraud prevention, legal compliance and product improvement. Legal bases depend on context and jurisdiction and may include contract performance, legitimate interests, consent, legal obligation, and protection of vital or legal interests.

Customer content is retained while the workspace or account is active and as configured by the customer. Deleted service data may persist in encrypted backups for a limited rotation period. Security and abuse logs are retained according to risk and operational need. Billing and tax records may be retained for statutory periods. Legal holds override ordinary deletion.

AI request metadata is retained for 365 days by default. Prompt, output, tool-argument and tool-result capture is off by default; when a workspace explicitly enables it, captured AI content is retained for 30 days by default. Workspace controls or enterprise terms may shorten or extend applicable periods. Aggregated or de-identified statistics may be retained where they no longer identify a person.

Tuturuuu uses access controls, encryption in transit, secret hashing, audit trails, tenant isolation, least-privilege operations, monitoring, incident response and secure development practices. No system is perfectly secure.

Data may be processed in countries where Tuturuuu or subprocessors operate. Where required, Tuturuuu uses recognized transfer mechanisms and supplementary safeguards. The maintained Subprocessor Registry lists purpose, data categories, regions and privacy information.

Tuturuuu does not use customer prompts, outputs, files or evaluation datasets for general-purpose model training by default. Applicable no-training or data-control settings are propagated to supported providers. AI features can produce inaccurate, incomplete or biased output and may involve automated processing, but customers remain responsible for consequential decisions and appropriate human review.

We do not sell personal information or share it for cross-context behavioral advertising, subject to final provider and advertising-technology audit before publication. Optional integrations process data under their own terms and are enabled by users or workspace administrators.

Depending on location and applicable thresholds or exemptions, individuals may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or appeal. Rights under Vietnam's Decree 13/2023, the GDPR and UK GDPR, and applicable United States state laws—including California access, correction, deletion, portability, opt-out and non-discrimination rights—apply only to the extent the relevant law governs the processing.

Users should normally contact their workspace administrator first for customer-controlled content. Tuturuuu will assist controllers under the DPA. The Services are not directed to children below the minimum lawful age; administrators and guardians must obtain required consent, and AI features may have higher age restrictions.