Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how Javill Byron, doing business as Tomonagi (“we”, “us”) collects, uses, and shares personal information when you use our service (the “Service”). It applies to account holders and visitors. It does not govern how our customers handle their own End Customers’ data — for that, the customer is the controller and its own privacy notice applies.

2. Information We Collect

• Account information — name, email, password (stored hashed by our auth provider), and your acceptance of our Terms.
• Billing information — your plan, subscription status, and billing identifiers. Card details are handled by our payment processor; we do not store full card numbers.
• Usage and device data — log data, IP address, browser/device information, and product interactions, used to operate, secure, and improve the Service.
• Customer Data — content you and your Authorized Users put into the Service, including information about your End Customers. You control this data; we process it on your behalf to provide the Service.
• Communications — messages you send to us (e.g., support), and metadata about messages you send to your End Customers through the Service’s email/SMS features.

3. How We Use Information

We use personal information to: provide, maintain, and secure the Service; authenticate accounts; process subscriptions and billing; provide support; detect and prevent abuse, fraud, and security incidents; comply with legal obligations; and improve the Service (including with aggregated, de-identified data). Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where we ask for it, and compliance with legal obligations.

4. How We Share Information — Sub-processors

We share personal information with service providers that help us run the Service, under contracts that limit their use of it:

• PayPal — subscription payment processing.
• Supabase — database hosting, authentication, and file storage.
• Render — application hosting and infrastructure.
• Resend and Postmark — sending and receiving transactional and customer email.
• Twilio (or another SMS carrier a customer connects to their own account) — sending and receiving text messages, where that feature is used.
• Anthropic — powering AI-assisted features; inputs you submit may be processed to generate output.

We do not sell personal information. We do not share mobile phone numbers with third parties or affiliates for their own marketing purposes; numbers are shared only with the carrier needed to deliver a message you or our customer asked us to send.

We may also disclose information to comply with law or protect rights/safety, and in connection with a merger, acquisition, or asset sale (with notice where required). The current list, with what each provider does, is kept at tomonagi.com/legal/subprocessors.

5. Customer Data & Your End Customers

For Customer Data you submit (including your End Customers’ information), you are the controller and we act as a processor on your instructions, as described in our Terms and any Data Processing Addendum. You are responsible for having a lawful basis and appropriate notices/consents for the data you process through the Service.

6. Text Messaging (SMS)

Where a business using the Service (or we, for account notices) sends you text messages, it is because you opted in — for example by entering your mobile number on a web form and checking a box agreeing to receive texts, by texting a keyword to that business's number, or by giving consent in writing. Message frequency varies; you may receive up to 10 messages per month.

Message and data rates may apply. Reply STOP to any message to opt out at any time; reply HELP for help. Opting out of one business's messages does not opt you out of messages from a different business you have separately consented to.

We do not share your mobile phone number with third parties or affiliates for their own marketing purposes. Your number is used only to deliver the messages you consented to, through the carrier we or the sending business use for delivery, and to honor your opt-out.

Questions about a text message you received should go first to the business that sent it (its name appears in the message). You can also reach us at jbyron@tomonagi.com.

7. Cookies & Similar Technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand usage. The cookies we set are essential to operating the Service (session, security, and preference cookies); we do not currently run third-party advertising or tracking cookies. If that changes, this policy will be updated first. Details are at tomonagi.com/legal/cookie-policy.

8. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service. If your plan lapses, data is retained in a locked/read-limited state rather than deleted. After account termination, data is retained for up to 90 days so you can request an export or reactivate, and is then deleted, except where we must keep it to meet legal obligations.

9. Security

We use commercially reasonable administrative, technical, and organizational measures to protect personal information. No system is perfectly secure; we cannot guarantee absolute security. We will notify affected parties of security incidents as required by applicable law.

10. International Transfers

We and our Sub-processors may process information in countries other than yours. Where required, we use appropriate safeguards for international transfers. Where the law of your jurisdiction requires a specific transfer mechanism, we rely on the safeguards that law recognizes.

11. Your Rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to opt out of certain communications. You can update account details in the app and exercise other rights by contacting us below. We will respond to verified requests within the time the applicable law allows, and you may appeal a decision by replying to our response. U.S. state-law rights, including the right to opt out of sale or sharing, are explained at tomonagi.com/legal/do-not-sell-my-info.

12. Children’s Privacy

The Service is not directed to children, and you must be 18+ to hold an account. We do not knowingly collect personal information from children. If you use the Service to collect information from minors, you are responsible for complying with the laws that apply to that collection.

13. Changes to This Policy

We may update this Policy; material changes will be notified (e.g., email or in-app) and take effect on the stated date.

14. Contact

Questions or requests: jbyron@tomonagi.com · Javill Byron, doing business as Tomonagi · 16300 SW 137 Ave, Unit 130, Miami, FL 33177, USA.