Privacy Policy

Effective 20 October 2026 · Tolla, operated by Dmitrii Russu, 8006 Zürich, Switzerland

This policy explains what personal data Tolla collects about you, why, how long it keeps it and what rights you have. It covers the website and the app at tolla.vercel.app and any contact you have with us. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).

In short: we collect only what we need to run your account and the service. The website has no analytics, advertising trackers or tracking cookies. We do not sell personal data. Our servers are in Frankfurt, Germany.

Who is responsible

The controller for the processing described here is:

Dmitrii Russu, trading as Tolla (sole proprietorship)
Stapferstrasse 3
8006 Zürich, Switzerland
Email: dmitrii@russu.net

You can reach us about anything in this policy at dmitrii@russu.net. We have not appointed a data protection officer, as we are not required to.

We are not established in the EU or the UK. We are appointing representatives there under Article 27 of the EU and UK GDPR and will publish their details here.

Data you send through Tolla about your own users

Customers use Tolla to analyse their own product: they send us data about their users (for example user ids, AI usage and cost, product events, payments and identity signals). For that data, the customer is the controller and Tolla processes it only on the customer's behalf, under our Data Processing Agreement. If you are a user of one of our customers' products and want to exercise your rights, please contact that company. If you contact us, we will forward your request to them.

So you know what happens to it, in summary:

• Identity signals such as email addresses and IP addresses are stored only as salted hashes, with a secret salt unique to each workspace. The original values are not stored. Hashed values are pseudonymised, not anonymous: they are still personal data and we protect them as such.
• The customer's Stripe data is read with a read-only key the customer provides. We store card fingerprints that Stripe provides, never card numbers.
• Tolla estimates which accounts probably belong to the same person, from shared signals such as the same card, device or email. Each shared signal adds to a probability, and signals shared by many accounts (offices, mobile networks) are ignored. These probabilities are shown to the customer; Tolla itself takes no decisions about any person, and the customer is responsible for what it does with them.
• Tolla never uses one customer's data for another customer.

What we collect and why

When you visit the website

Our hosting provider records technical data for every request: IP address, date and time, the page requested, the browser's user agent and the referring page. We use it only to deliver the website, keep it secure and find errors. The website sets no cookies and loads no third-party trackers or fonts.

Legal basis under the GDPR: our legitimate interest in operating a secure website (Art. 6(1)(f)).

When you create and use an account

• Account data: your name, work email address and password. Passwords are stored only as a salted hash. You need to give these to create an account; without them we cannot provide the service.
• Sign-in sessions: a session id, the IP address and the browser's user agent of each sign-in, kept for the life of the session (up to 30 days), to keep your account secure.
• Protection against password guessing: we count attempts to sign in, sign up or reset a password per IP address and per email address, for up to 15 minutes. The counters store only a keyed hash of the address, never the address itself, and are deleted within a day.
• Account emails: when you sign up, we send a link to confirm your email address, valid for 24 hours; if someone tries to sign up with an address that already has an account, we tell its owner by email instead. If you ask for a password reset, we send a one-time link, valid for one hour. These emails go through our email provider, Resend.
• Breached-password check: when you choose a password, we send the first five characters of its SHA-1 hash to Have I Been Pwned's Pwned Passwords service, which answers with every known breached password that starts the same way. Neither your password nor your email leaves our servers, and the five characters can't identify you.
• Workspace data: the workspace name and settings, API keys (secret keys are stored only as hashes), team memberships and, if you connect Stripe, your restricted Stripe key, encrypted with AES-256-GCM.
• Use of the app: server logs of requests to the app and API, used for security and to fix errors.
• Your free audit and your answers: how far your workspace got through the free audit and when you last signed in, the audit's results (figures about your free tier, not about your users) and your answers to the questions under your report, if you give them.

We use this data to provide the service you signed up for, to secure it, to answer your questions and to tell you about important changes to the service. Our team also looks at how far each workspace got, its audit results and its answers, to help you, to talk with you about whether Tolla is worth paying for after your free months, and to improve Tolla. We keep this in our own database, without analytics tools or cookies.

Legal basis under the GDPR: performance of our contract with you or your company (Art. 6(1)(b)), and our legitimate interest in security, service communication, supporting our customers and improving Tolla (Art. 6(1)(f)). You can object to the use of your audit progress and answers at any time by writing to dmitrii@russu.net.

When you contact us

If you email us, we process your message, your contact details and what you tell us, to answer you. Legal basis: our legitimate interest in replying (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)).

When we contact you about Tolla

We may contact people at companies that could benefit from Tolla, for example founders and engineers at AI startups. For this we use your name, work email address, company and role, taken from public professional sources such as your company's website or professional profiles. We send individual, relevant messages, not mass mailings. The first message says who we are, where we found your details, links to this policy and tells you how to opt out. If you tell us you are not interested, we stop and keep only a note of your address so we do not contact you again.

Legal basis under the GDPR: our legitimate interest in presenting our service to businesses (Art. 6(1)(f)). You can object at any time, without giving reasons, by replying or writing to dmitrii@russu.net.

Cookies

The website sets no cookies. The app uses only these cookies, which are needed for it to work or to remember a choice you made. None are used for tracking or advertising, so we do not ask for consent.

Customers who install our browser snippet store a random device id, _tolla_id, on their own website (as a first-party cookie kept for up to 2 years, and in the browser's local storage), and a session id, _tolla_sid, that lasts until the tab is closed. Right after a sign-up or sign-in, the snippet also computes a short device hash from basic browser properties: user agent, language, platform, screen size and pixel ratio, time zone, number of processor cores, memory and touch support. This hash is a simple device fingerprint. The only purpose of all of this is security: recognising a device that creates or signs in to several free accounts. The snippet does nothing when a page loads; it runs only right after a sign-up or sign-in, and it is never used for analytics or advertising. Customers can make it wait for their visitors' consent. If a customer turns them on, the snippet can also compute a more detailed device fingerprint and run automation checks; in the EU these need the visitor's consent. All of this belongs to the customer's website: the customer informs its visitors, lists the cookie in its cookie notice and, where the law requires it, asks for consent.

Who receives your data

• Our service providers, who process data for us under contract: hosting, database and the provider that sends account emails (see Subprocessors), plus our email provider for messages you send us.
• Advisers and authorities where the law requires it or where it is necessary to establish or defend legal claims.

We do not sell or rent personal data, and we do not share it for advertising.

Data outside Switzerland and the EU

Our servers are in Frankfurt, Germany. The EU offers an adequate level of data protection under Swiss law, and Switzerland does under EU law.

Our hosting, database and email-sending providers are companies based in the United States, and their staff or support systems may access data from there. Resend, which sends account emails, stores the emails it sends in the United States. So data may be disclosed to these countries: Germany (EU) and the United States. These transfers are protected by the European Commission's Standard Contractual Clauses (with the amendments the Swiss Federal Data Protection and Information Commissioner requires) and, where the provider is certified, the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards at dmitrii@russu.net.

How long we keep data

Data customers send about their own users is kept for as long as the customer's settings and our Data Processing Agreement say, and deleted when the customer asks or closes the workspace.

How we protect data

All connections use TLS. Data is stored in an encrypted database in the EU, Stripe keys are encrypted with AES-256-GCM, secret API keys and passwords are stored only as hashes, and identity signals are stored as salted hashes. Access is limited to what is needed to run the service. We keep a record of security incidents and tell affected customers and, where required, the authorities.

Your rights

You have the right to:

• know whether we process data about you and get a copy of it (access);
• have incorrect data corrected;
• have data deleted, or its processing restricted;
• object to processing based on our legitimate interests, and in particular to being contacted for marketing, at any time;
• receive the data you gave us in a common machine-readable format (portability);
• withdraw any consent you gave, with effect for the future.

Write to dmitrii@russu.net. We may ask you to confirm your identity. We answer within 30 days. Exercising your rights is free.

If you think we handle your data unlawfully, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you are in the EU or the UK, to the data protection authority where you live or work.

Automated decisions

We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects on you.

Children

Tolla is a service for businesses and is not meant for anyone under 18. We do not knowingly collect data about children.

Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version. We will tell account holders about important changes by email before they take effect.