Privacy Policy

This Privacy Policy explains how personal information is handled when you use Totalis websites, applications, hosted software as a service (SaaS), available platform as a service (PaaS) features, APIs, and related services (the “Service”). “Totalis,” “we,” and “us” refer to the operator providing the Service under the Totalis name. For privacy questions or requests, contact contact@totalis.tech.

For information we process for our own account administration, security, support, and service operations, Totalis determines the purposes and means of processing and acts as a controller where that term applies. When we process customer-controlled content on an organization’s behalf, we act as a processor or service provider to the extent applicable, under its lawful instructions and applicable processing agreement. The organization is responsible for its own notices and legal basis; our legal obligations still apply.

Our hosting, AI, mapping, email delivery, and other service providers may process information on our behalf. Independently operated applications built with Totalis, third-party services you connect, and self-hosted deployments have their own operators and privacy practices. This policy applies to information handled by us; it does not make us the operator of those independent services or mean that we automatically receive everything stored in a self-hosted instance.

The Service may collect the following categories of information:

• Waiting-list information. If you join the waiting list, we store your email address and signup record to manage your interest and contact you about access to Totalis. Joining does not create an account. Contact us to request removal.
• Account and authentication data. Your name, email address, user identifier, sign-in records, passkey information, authorized sessions, and account preferences. If you enable a messaging integration, this may also include your phone number and messaging identifiers.
• Content you add. Tasks, homework, events, courses, projects, contacts, organizations, places, notes, files, messages, chat conversations, automation rules, and related activity. If you use voice features, audio and transcripts may be processed to provide the requested interaction. Platform data may include application inputs, outputs, and webhook content you submit or authorize.
• Connected-source data. Information you authorize Totalis to retrieve from services such as calendars, learning systems, email providers, and other connectors. This may include message content, attachments, schedules, coursework, grades, and source identifiers. Connector credentials and tokens are stored in encrypted credential storage.
• Location and device data. If you enable location features, precise location observations, saved places, routes, device identifiers, notification tokens, and location-sharing preferences. Background location collection occurs only when the applicable permission and feature are enabled.
• Technical and usage data. IP address, browser and device type, request timestamps, security events, diagnostics, feature interactions, and performance information. Totalis uses essential cookies and local storage for sessions, appearance, security, and saved preferences.
• Communications. Information you provide when you request help, report a problem, or otherwise contact us.

We may use personal information to:

• provide, synchronize, personalize, and maintain the Service;
• authenticate users, protect accounts, prevent abuse, and enforce access boundaries;
• import and reconcile connected data while preserving its source and history;
• deliver reminders, notifications, travel estimates, and features you request;
• operate optional AI features, subject to the controls described below;
• troubleshoot failures, monitor performance, and improve the Service; and
• comply with law, protect users and the Service, and resolve disputes.

Totalis does not use personal information for third-party advertising or cross-app tracking, and the Service is not designed to sell personal information.

Where applicable law requires a legal basis, we process information as necessary to perform our agreement with you, comply with legal obligations, or pursue legitimate interests such as protecting, maintaining, and improving the Service where those interests are not overridden by your rights. We rely on consent where required for a particular activity, including access to certain device features. Merely using the Service is not consent to every possible use of your information.

You may withdraw consent through the relevant controls or by contacting us. Withdrawal does not affect processing already lawfully performed. If necessary information is not provided, or a permission is withdrawn, the corresponding feature may be unavailable. When we process information on a customer’s behalf, the customer determines the applicable legal basis for its instructions.

AI features are optional. When used, Totalis sends a limited, task-relevant selection of your content to the configured AI provider—for example, a message being screened for a deadline, a file or image you explicitly attach to a chat, or the records needed to answer your request. Voice interactions may send audio directly to the configured voice provider. Enabled background AI features may process relevant records without a separate prompt for each run; feature and connector settings control that processing.

AI output is treated as untrusted. High-impact changes and calendar reservations are presented for review rather than applied silently. Operational AI logs are designed to contain metadata and token totals, not prompts, responses, tool payloads, images, or user identity. The AI provider may process submitted content under its own terms or its agreement with us.

Information may be disclosed in these circumstances:

• At your direction. When you connect a provider, share content, open a provider link, or otherwise request an external action.
• To service providers. To vendors that support hosting, storage, email delivery, notifications, observability, maps and routing, AI, or other configured functions. They receive only the information needed for their role.
• To your organization or application operator. If your access is managed by an organization or you use an application built on Totalis, its operator may receive information you submit to it and manage access within the permissions and features available to that operator. Its notices govern its own use of that information.
• For service administration. Authorized Totalis personnel may access account data when needed to operate, secure, support, and meet obligations for the Service.
• For legal and safety reasons. When reasonably necessary to comply with law or legal process; investigate fraud, abuse, or security incidents; or protect rights, safety, and the Service.
• During an organizational change. In connection with a merger, financing, acquisition, reorganization, or transfer of the Service or our business, subject to applicable confidentiality and notice requirements.

Information is retained while your account remains active and as needed to provide the Service, preserve provenance and audit history, meet legal obligations, resolve disputes, and maintain security. Specific records may have shorter retention windows; for example, pending AI extraction proposals expire after a limited period.

Most ordinary deletion in Totalis is initially soft deletion so users can recover mistakes and the Service can preserve an inspectable history. Features identified as permanent deletion remove the applicable active data and cannot be undone. Where backups are maintained, copies may remain until they rotate out under the applicable retention schedule. Deleting a connected source removes its credentials and source-bound records according to the Service’s removal workflow; independently created or retained records may remain.

Retention depends on the record’s purpose and sensitivity, account status, security needs, applicable agreements, and legal requirements. Provenance and audit history do not override a valid legal deletion right. We may retain information subject to a lawful exception, such as a legal hold, and limit further use to the purpose of that retention. Disconnecting a provider does not itself erase information already imported or copies that the provider holds independently.

Totalis is designed with user-scoped authorization, encrypted credential and file storage, authenticated sessions, validation, redacted operational logs, and versioned mutation history. We use administrative, technical, and organizational safeguards designed to protect the Service and the information it contains.

No method of transmission, storage, encryption, or access control can guarantee absolute security. Information may be affected by hacking, ransomware, malware, compromised credentials, vulnerabilities, human error, or failures of infrastructure and service providers. These events can cause unauthorized access, disclosure, alteration, destruction, loss, or unavailability of information despite safeguards.

Encrypted credential and file storage does not mean all information is end-to-end encrypted or inaccessible to the operator. Authorized processing may require access to readable information, including disclosure to configured providers for features you enable. Protect your sign-in methods, devices, integrations, and independent copies of important content, and report suspected unauthorized access to contact@totalis.tech. Do not include passwords, access tokens, or unnecessary private content in a report.

If we become aware of a personal data breach, we will investigate and take appropriate response measures and notify affected individuals, customers, and authorities when and as required by applicable law and our applicable contractual obligations. Keep your contact details current so we can reach you. This policy does not extend any legally required notification deadline.

The Terms of Service address contractual liability subject to applicable law. This policy is not a release of liability or consent to a security incident and does not waive privacy rights, required safeguards, breach notices, or remedies that cannot legally be limited.

Depending on applicable law, you may have the right to access, correct, export, restrict, object to, or delete personal information. You may also disconnect sources, revoke provider access, disable optional AI or location features where those controls are offered, manage notification permissions, and sign out authorized sessions.

Submit privacy requests to contact@totalis.tech. We may need to verify your identity or an authorized agent’s authority before fulfilling a request. We will respond within the period required by applicable law. If your account is provided by a school, employer, or other organization, that organization may control the relevant data and should receive your request; we will assist as required by law and our processing agreement.

Where applicable, you may withdraw consent, appeal a denied request by contacting us, and complain to your local data-protection or consumer-protection authority. We will not unlawfully discriminate against you for exercising privacy rights. Requests may be subject to lawful exceptions, including protection of another person’s rights and information we must retain by law.

We and our service providers may process information in countries other than where you live. Privacy laws may differ in those locations. Where required, we use a lawful transfer mechanism and provide any additional disclosures.

The Service is not directed to children under 13 for independent use. A child may use an organization-managed account only when the school, parent, guardian, or other responsible organization has established the account and obtained any consent required by law. Contact us if you believe a child’s information was collected without proper authorization.

This policy may be updated as the Service or legal requirements change. The date above identifies this revision. We will provide notice of material changes through the Service or your account email and obtain consent before new processing where required by law. Updating this policy alone does not authorize a use of information that requires separate consent.

For questions, requests, or complaints, contact contact@totalis.tech. If an organization manages your account, you may also contact its account administrator.