Privacy Policy

Last revised: September 28, 2026

This Privacy Policy explains how Toto AI (“Toto”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you use the Toto website, the Toto Telegram bot, AI agents created or operated through Toto, integrations connected to those agents, and any related services, tools, features, or functionality (collectively, the “Services”).

For purposes of this Privacy Policy, “you” and “your” mean the person using the Services.

By using the Services, you acknowledge that your information may be processed as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we do, we will update the “Last revised” date above. If we make material changes to how we collect, use, or share your information, we may provide additional notice through the Services, Telegram, our website, or another appropriate channel.

Where required by applicable law, we will obtain your consent before using your information for a materially different purpose.

Your continued use of the Services after an updated Privacy Policy becomes effective constitutes acknowledgment of the updated Privacy Policy, except where applicable law requires another form of consent.

Information we collect and use

The information Toto processes depends on how you use the Services, which agents you create, what instructions you give them, and which third-party services you choose to connect.

We use information primarily to provide the Services, understand and execute your requests, operate your AI agents, maintain their context and memory where enabled, connect to services you authorize, communicate with you, secure the Services, prevent misuse, diagnose technical problems, and comply with applicable legal obligations.

Information you provide

When you use Toto or an AI agent created through Toto, you may provide information including:

• messages and instructions;
• voice messages;
• images and other media;
• documents and files;
• names, preferences, routines, dates, locations, and other information included in your conversations;
• reminders, schedules, tasks, and agent instructions;
• information necessary to configure an agent;
• information you submit when contacting support or providing feedback; and
• information you voluntarily provide through connected services.

The content you provide may sometimes contain personal or sensitive information. Toto processes that information in order to perform the tasks you request.

You are responsible for deciding what information you provide to Toto and your agents.

AI agents

Toto allows you to create AI agents that can interact with you through Telegram and perform tasks according to your instructions.

Depending on the capabilities you enable, an agent may be able to:

• communicate with you through Telegram;
• remember information you provide;
• create and manage reminders or scheduled tasks;
• retrieve information from connected services;
• interact with calendars, email, spreadsheets, feeds, APIs, or other services;
• process files and documents;
• search for or retrieve information;
• generate content;
• perform automated actions you request; and
• use information from connected accounts to complete a task.

An agent only has access to capabilities and information made available to it through Toto, your instructions, and integrations you authorize.

Because AI systems can generate incorrect, incomplete, or unexpected results, you should review important actions and outputs before relying on them, particularly where financial, legal, medical, employment, or other significant decisions are involved.

Toto and its AI agents are not professional advisors.

Connected services

You may choose to connect third-party services to Toto or to an agent.

These may include services such as:

• calendars;
• email accounts;
• spreadsheets;
• financial or transaction notification services;
• RSS feeds;
• productivity tools;
• cloud services; and
• other applications or APIs.

When you connect a service, Toto may receive and process information made available through that connection.

We use information from connected services only as necessary to provide the functionality you request, operate your agent, maintain the integration, and protect the security of the Services.

The exact information available to Toto depends on the service you connect and the permissions you grant.

You can revoke access to connected services using Toto, where that functionality is available, or through the relevant third-party service.

Authentication information and credentials

Some integrations may require authentication information, access tokens, API keys, session information, or other credentials.

Credentials managed by Toto are protected using appropriate technical safeguards, including encryption where applicable.

We design integrations so that agents receive only the access necessary to perform authorized actions rather than unrestricted access to authentication credentials whenever technically possible.

You should not intentionally send passwords, private keys, recovery phrases, or other highly sensitive authentication information to an agent as ordinary chat messages unless a specific Toto feature explicitly requires it.

Google user data

If you choose to connect a Google account or Google service, Toto may request access to Google user data necessary to provide the functionality you enable.

Depending on the integrations you choose, this may include information from services such as Google Calendar, Gmail, Google Drive, Google Sheets, or basic Google account information.

Toto accesses Google user data only after you authorize the relevant permissions through Google's authorization process.

We use Google user data only to provide or improve the user-facing functionality that you request.

For example, if you ask an agent to work with your calendar, the agent may retrieve calendar information necessary to answer your request or perform an authorized calendar action.

If you connect email functionality, the agent may process relevant email content where necessary to perform the task you request.

Toto's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy and, where applicable, the Limited Use requirements and Google Workspace User Data and Developer Policy.

Google user data will not be sold or used for targeted advertising.

Google user data will not be used to determine creditworthiness or for lending purposes.

Data received through Google Workspace APIs will not be used to create, train, or improve generalized or foundational artificial intelligence or machine-learning models where such use is prohibited by Google's applicable user data policies.

We may transmit information obtained from Google to service providers, including AI processing providers, only where necessary to provide the functionality you requested and where permitted under Google's applicable policies.

Human access to Google user data is restricted and may occur only where permitted by applicable law and Google policies, such as:

• with your explicit permission for specific information;
• where necessary to investigate security incidents, bugs, fraud, or abuse;
• where necessary to comply with applicable law; or
• where information has been appropriately aggregated or anonymized for permitted internal purposes.

You may revoke Toto's access to your Google account through your Google account permissions or through Toto where the relevant functionality is available.

AI service providers

Toto uses artificial intelligence technologies to understand instructions, generate responses, analyze information, and perform tasks.

To provide these capabilities, information necessary to process your request may be transmitted to third-party AI infrastructure or model providers.

Depending on your request, this information may include:

• your current message;
• relevant portions of previous conversations;
• agent instructions;
• information stored in an agent's memory;
• files or document content;
• information obtained from connected services; and
• other context necessary to complete the task.

We seek to limit information sent to AI providers to information reasonably necessary to provide the requested functionality.

Third-party AI providers process information according to the agreements, settings, and privacy protections applicable to Toto's use of their services.

Information received from Telegram

When you interact with Toto or an agent through Telegram, Telegram may provide information necessary for the bot to operate.

This may include information such as:

• your Telegram user identifier;
• display name;
• username, if available;
• language settings;
• messages and attachments you send to the bot;
• information about the chat in which an interaction occurs; and
• other information made available through the Telegram Bot Platform.

Telegram does not automatically provide Toto with every piece of information associated with your Telegram account.

Your use of Telegram itself is governed by Telegram's own terms and privacy practices.

Information collected automatically

When you use the Services, we may automatically collect technical and usage information necessary to operate, secure, and improve them.

This may include:

• IP address;
• approximate network location derived from IP address;
• browser or device type;
• operating system;
• language;
• time zone;
• dates and times of requests;
• feature usage;
• agent activity;
• API requests;
• performance information;
• error reports;
• security events; and
• diagnostic logs.

Logs may contain limited portions of information associated with a request where necessary to diagnose technical problems, protect the Services, or prevent abuse.

We use this information to operate and secure the Services, investigate errors, prevent fraud or abuse, understand system performance, and improve reliability.

Payment information

If Toto offers paid functionality and you purchase a subscription or another paid feature, payment processing may be handled by Telegram or another third-party payment provider.

Toto may receive information such as:

• the product or subscription purchased;
• transaction identifier;
• payment status;
• amount and currency;
• renewal status; and
• transaction date.

Where payments are processed by a third-party payment provider, Toto does not receive your full payment card number unless expressly stated otherwise during the payment process.

Payment providers process payment information according to their own terms and privacy policies.

How we use information

We may use information processed through the Services to:

• provide and operate Toto;
• create, configure, and operate your agents;
• understand and respond to your instructions;
• perform tasks you request;
• provide agent memory and personalization features;
• operate integrations you authorize;
• create reminders and scheduled tasks;
• authenticate users and integrations;
• communicate with you;
• provide customer support;
• detect and prevent fraud, abuse, or security threats;
• diagnose technical issues;
• maintain and improve the reliability of the Services;
• enforce our Terms and other applicable rules;
• comply with applicable legal obligations; and
• establish, exercise, or defend legal claims.

Where required by applicable law, we process personal information only where there is an appropriate legal basis.

Depending on the circumstances, those bases may include performance of a contract with you, our legitimate interests in operating and securing the Services, compliance with legal obligations, or your consent.

Disclosure of information

We may disclose information to third parties only where reasonably necessary to operate the Services or where otherwise described in this Privacy Policy.

These third parties may include:

• cloud infrastructure and hosting providers;
• AI model and AI infrastructure providers;
• authentication and integration providers;
• communications providers;
• analytics, security, logging, and error-monitoring providers;
• payment processors;
• third-party services that you connect to Toto;
• websites, APIs, or services with which your agent interacts at your request;
• professional advisors where reasonably necessary; and
• government authorities or other parties where disclosure is required by applicable law.

When your agent interacts with a third-party service at your request, information necessary to complete that interaction may be transmitted to that service.

We may also disclose information where reasonably necessary to investigate fraud or abuse, protect the safety or integrity of Toto, enforce our rights, or comply with a lawful request.

If Toto is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction where permitted by applicable law.

Any transfer of Google user data remains subject to the additional restrictions described in the Google user data section of this Privacy Policy.

Human access to your information

Toto is designed so that routine operation of the Services does not require personnel to manually read private conversations.

Authorized persons may access user information where reasonably necessary to:

• respond to a support request you make;
• investigate and resolve a technical problem;
• investigate fraud, misuse, or a security incident;
• protect Toto, our users, or third parties;
• maintain the security and reliability of the Services; or
• comply with applicable law.

Access is limited to persons with a legitimate need for such access.

Additional restrictions may apply to information obtained through third-party platforms such as Google.

Data retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining agent functionality, complying with legal obligations, resolving disputes, preventing fraud and abuse, and enforcing agreements.

Different categories of information may be retained for different periods.

For example, information associated with an active agent may be retained while the agent remains active and for a reasonable period afterwards where necessary for deletion processing, backups, security, or legal compliance.

Technical logs may be retained for a limited period necessary for security, debugging, and operational purposes.

Payment records may be retained for longer periods where required by tax, accounting, or other applicable laws.

Information may also remain temporarily in encrypted backups after deletion until those backups are overwritten in the ordinary course of system operation.

Where technically and legally possible, deleted information will either be removed or anonymized so that it can no longer reasonably be associated with you.

Deleting your information

You may delete information through Toto where deletion controls are available.

Depending on the functionality of the Services, this may include deleting:

• agents;
• conversations;
• memories;
• files;
• reminders;
• scheduled tasks;
• stored integrations; and
• connected accounts.

You may also request access to or deletion of personal information associated with your use of Toto by contacting us through the Support channel available on the Toto website.

We may need to verify that a request relates to your account before completing it.

Certain information may be retained where required by applicable law or where reasonably necessary for security, fraud prevention, dispute resolution, or the establishment, exercise, or defense of legal claims.

International processing

Toto is an online service and may use service providers located in different countries.

As a result, information may be processed in countries other than the country in which you live.

Data protection laws in those countries may differ from the laws in your jurisdiction.

Where applicable law requires specific safeguards for international transfers of personal information, we take reasonable steps to use appropriate safeguards.

Your privacy rights

Depending on where you live and applicable law, you may have rights regarding your personal information.

These may include the right to:

• request access to your information;
• request correction of inaccurate information;
• request deletion of information;
• receive a copy of certain information;
• restrict certain processing;
• object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with an applicable data protection authority.

The availability and scope of these rights depends on applicable law.

You can exercise applicable rights by contacting us through the Support channel available on the Toto website.

We may need to verify your identity before processing certain requests.

Aggregated and de-identified information

We may generate aggregated or de-identified information that cannot reasonably be linked back to an individual user.

We may use this information for purposes such as measuring system performance, understanding how features are used, improving reliability, capacity planning, and developing the Services.

We will not intentionally attempt to re-identify information that has been properly de-identified except where necessary to test or validate de-identification techniques or where permitted by applicable law.

Third-party services and websites

Toto and its agents may interact with third-party websites, APIs, applications, and other services.

Toto does not control the privacy or security practices of those third parties.

When you instruct an agent to interact with a third-party service, information transmitted to that third party becomes subject to that third party's terms, policies, and practices.

You should review the privacy policies of services you connect to Toto.

Children's privacy

The Services are not intended for children under 18 years of age.

We do not knowingly collect personal information from children under 18.

If we become aware that personal information has been collected from a person under 18 in circumstances where such collection is not permitted, we will take reasonable steps to delete it.

Data security

We use reasonable technical and organizational safeguards designed to protect information processed through Toto.

Depending on the type of information and service involved, these safeguards may include:

• encryption in transit;
• encryption of stored credentials or authentication tokens;
• access controls;
• separation of agent permissions;
• authentication controls;
• security monitoring; and
• restrictions on personnel access.

No system can be guaranteed to be completely secure.

You should protect your Telegram account and any accounts you connect to Toto, use appropriate authentication protections, and promptly revoke integrations if you believe an account or credential has been compromised.

AI-specific security considerations

AI agents can interact with information and third-party services on your behalf.

This creates risks that may not exist in conventional software, including incorrect outputs, unintended actions, malicious content, misleading third-party instructions, or attempts to manipulate an AI agent.

Toto uses safeguards intended to reduce these risks, but no AI system can eliminate them completely.

You should review important actions performed by agents and avoid granting an agent access that is broader than necessary for the task you want it to perform.

Automated decision-making

Toto is intended to assist users with tasks rather than independently make decisions that produce legal or similarly significant effects concerning them.

You should not use Toto as the sole basis for decisions concerning another person's legal rights, employment, credit, housing, healthcare, insurance, or other similarly significant matters.

Contact us

If you have questions about this Privacy Policy, Toto's privacy practices, or would like to exercise an applicable privacy right, you can contact us through the Support channel available at toto.bot.

Toto AI

Toto AI is the service described in this Privacy Policy.

Throughout this Privacy Policy, references to “Toto”, “Toto AI”, “we”, “us”, and “our” refer to the operator of the Toto AI service.