Privacy Policy

1. Who we are

Toby is provided by XINFERENCE HOLDINGS PTE. LTD.

For any question or request about this policy or your data, contact privacy@hitoby.ai. You do not need an account with us to contact us, and we respond within 2 business days.

2. What this policy covers

This policy explains what data Toby accesses when it is installed in a Slack workspace, what we do with that data, how long we keep it, and how you exercise your rights over it. It also covers the account information we hold about the person or organisation that installs Toby, and the website at hitoby.ai.

Where Toby is installed by an organisation, that organisation is the controller of its workspace data and we act as its processor. This policy describes our practices; the organisation’s own policies govern how it chooses to use Toby.

3. What data Toby accesses

Toby requests only the Slack permissions it needs to function. The list below sets out permissions Toby requests, the data it gives access to, and why we need it.

Slack workspace data

• app_mentions:read — Messages that mention Toby, so it knows when it is being asked to do something.
• channels:history / groups:history — Message content in the channels you explicitly add Toby to. Toby has no access to channels it has not been added to, and no access to any channel it is removed from.
• im:history / im:read / im:write — Direct messages between you and Toby, so you can brief it privately and it can reply. Toby cannot read direct messages between other people.
• mpim:history — Message content in group direct messages Toby has been added to, used the same way as channel context. Toby has no access to group messages it is not part of.
• channels:read / groups:read — Channel names and membership information, so Toby can tell you which channels it is in and present results in context.
• channels:join — Joining the channels chosen during onboarding, so Toby can work in them.
• channels:manage — Leaving a public channel when a member removes Toby from it. Toby uses this only to remove itself; it does not create, rename or archive channels.
• chat:write — Posting Toby’s replies and results back into Slack.
• files:read / files:write — Reading files shared in the channels Toby is in, when a task requires their content, and returning files it produces.
• reactions:write — Adding an emoji reaction to acknowledge a request, so Toby can signal that it has picked something up without adding noise to the channel.
• users:read / users:read.email — Basic profile information, including email address, so Toby knows who it is talking to and can match a Slack user to their Toby account and permissions.

Microsoft Teams workspace data

Toby’s Teams app is installed with a deliberately minimal baseline. The permissions below are grouped by whether they apply to every installation, or only to capabilities an administrator turns on.

Requested by every installation. Bot messaging — Toby receives a message only when it is directly mentioned, and replies in that conversation. The baseline app package requests no permission to read messages that do not mention Toby.

Requested only where channel history is enabled. ChannelMessage.Read.Group (resource-specific consent, application) — Message content in the specific team channel where Toby is installed, used as context for the conversation it is already part of. This is applied through a separate history-enabled app package, not the baseline one, so an organisation that does not want it does not grant it. Toby reads only the current thread, and excludes deleted messages, messages from other threads, and messages from other teams. Where history is not granted, Toby has no history.

Requested only where file handling is enabled. Sites.Selected (application) — Read access to files in specific SharePoint sites that an administrator selects and assigns individually. Consent alone grants nothing: an administrator must assign access to each site separately. Toby reads a file only when a task needs its content, and only for files that are reference attachments in the configured channel folder. Write access is requested only where Toby is also enabled to return files it produces. Toby does not create anonymous sharing links.

Account and billing data

For the organisation that installs Toby we hold the workspace name and Slack or Teams workspace ID, the name and email address of the installing administrator, configuration and role settings, and subscription and billing records.

Connected tools

Toby can connect to third-party tools you authorise, such as issue trackers, CRMs and document stores. When you connect a tool, Toby holds the access credentials for that connection and accesses data in that tool only as needed to carry out the tasks you ask of it. You can disconnect any tool at any time, which revokes Toby’s access to it.

Usage and diagnostic data

We record operational logs such as timestamps, workspace and user identifiers, which features were used, and error diagnostics. We use these to run the service, investigate faults, and prevent abuse.

4. How we use data

• To provide Toby. Interpreting your request, assembling the context needed to answer it, carrying out actions in connected tools, and returning results.
• To keep the service working. Monitoring, debugging, and preventing abuse.
• To support you. Responding when you contact us, which may require an authorised member of our team to review data relevant to the issue you report.
• To meet legal obligations. Where we are required to retain or disclose information by law.

5. Legal bases

Where a legal basis is required, we process personal data as necessary to perform our contract with you or your organisation; for our legitimate interests in operating, securing, supporting and improving Toby and in business-to-business communications; to comply with legal obligations; and with your consent where consent is required. Where we act as a processor for an organisation that has installed Toby, we process Customer Content on that organisation’s documented instructions.

6. What we do not do

• We do not use your data to train or fine-tune models of our own.
• We do not sell your data.
• We do not access channels Toby has not been added to.
• We do not use your data to build features for other customers beyond aggregated, non-identifying operational statistics.
• We do not use your data for unrelated advertising, data brokerage or surveillance, or to determine a person’s eligibility for employment, housing, credit, insurance or another high-impact service.

7. AI processing

Toby uses large language models to interpret requests and generate responses. To be explicit about what that involves:

• Training on your data. We do not use your content to train or fine-tune any model of our own. We do not currently hold a written agreement with the model provider restricting its use of submitted content for training, and we do not represent that such a restriction is in place.
• Provider retention. We do not currently hold a stated retention commitment from the model provider. Content sent for inference is subject to that provider’s own terms.
• Tenancy. Toby is logically multi-tenant. Each Slack workspace is treated as a separate tenant and is mapped to its own Toby account, agent, API credentials, and client-application identity. Tenant-owned records and access paths are scoped by workspace or client-application identifiers, and sensitive credentials are encrypted at rest. Customers share the infrastructure and database within a deployment region; isolation is enforced at the application and data-model level rather than through a dedicated database or compute environment for each customer.
• Human review. Toby is instructed to request explicit user confirmation before sending messages or emails, or creating, changing, or deleting data in connected systems. The product supports confirmation interactions for this workflow. This control is currently prompt-driven rather than a hard execution-level enforcement gate, so users should review Toby’s activity and AI-generated output before relying on it. AI output may be inaccurate.

8. Sub-processors

We use a small number of providers to run Toby. Each is bound by contract to protect your data and to process it only on our instructions.

A current list of subprocessors applicable to a contracted service may be provided through our contractual, trust or support channels.

9. Retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the service, preserve customer-configured agent state and records, comply with law, maintain security, resolve disputes and enforce agreements. Retention periods vary by data type, deployment, customer instruction and contractual requirement.

When Toby is uninstalled from a workspace, its Slack or Teams access tokens are revoked and deleted, and workspace data is deleted within 30 days, except where we are required to retain records by law.

10. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. All traffic is encrypted in transit using TLS 1.2 or higher.

Measures are selected according to the deployment and risk and may include access controls, authentication, encryption in transit, logging, monitoring, backups, personnel controls and vendor-management practices. No system is completely secure, and customers remain responsible for their deployment, user permissions, connected services, credentials, models, tools and agent configurations.

To report a security issue, contact security@hitoby.ai.

11. Your rights

You can ask us to:

• Access the personal data we hold about you
• Export it in a portable format
• Correct it if it is wrong
• Delete it
• Restrict or object to our processing of it
• Withdraw consent where our processing relies on consent

Email privacy@hitoby.ai. We aim to acknowledge within 2 business days and complete the request within 30 days. There is no charge, and you do not need to create an account to make a request.

If Toby was installed by your employer, we may need to refer your request to them, since they control their workspace data. We will tell you if that is the case and who to contact.

Depending on where you live you may also have the right to complain to a data protection authority.

12. International transfers

We are based in Singapore and our providers may process data in other countries. Where data is transferred out of a jurisdiction that restricts transfers, we rely on appropriate safeguards such as standard contractual clauses.

13. Children

Toby is a workplace product and is not intended for anyone under 18. We do not knowingly collect data from children.

14. Changes to this policy

If we make a material change we will update the version and effective date above and notify workspace administrators before the change takes effect. Continued use after that date means the updated policy applies.

15. Contact

XINFERENCE HOLDINGS PTE. LTD. · Privacy: privacy@hitoby.ai