Back to home

Privacy Policy — Tosvi

Version 1.6 · Effective date: 19/08/2026 · Last updated: 19/08/2026

This privacy policy explains what personal data Tosvi processes, why, and how. Tosvi is a software service for car-detailing studios ("studios") to manage clients, vehicles, quotes, scheduling, and pre-work vehicle inspections.

Where applicable under the EU General Data Protection Regulation (GDPR, if you are an EU/EEA resident), Moldovan Law 195/2024 on the protection of personal data (formerly Law 133/2011; applicable from August 2026), or comparable laws in your jurisdiction, Tosvi complies with the data-protection obligations outlined below.

Scope and applicable law

Tosvi is built to GDPR standards. It is operated from the Republic of Moldova and may be used by studios in Moldova, the EU/EEA, and other markets. Where the GDPR, Moldovan Law 195/2024 (formerly Law 133/2011), or comparable law applies to a processing activity, we comply with the obligations set out in this policy for that activity, and the GDPR-specific terms of our Data Processing Agreement apply between the studio and us. Where the GDPR requires it for processing of EU/EEA residents' data, we put in place the additional measures it mandates, including the designation of an EU representative under Article 27 GDPR where applicable.

This policy is provided in English, Russian, and Romanian; in the event of conflict, the Romanian version prevails.

Who we are

Tosvi is operated by: Petru Virtos, Antreprenor Independent Cod fiscal: 1026023032469 bd. Moscova 9/5 ap. 300, Chișinău MD-2068, Moldova Contact: [email protected]

Our role: processor, not controller, for studio client data

This is the most important thing to understand about how Tosvi handles data.

  • For the personal data a studio enters about its own customers (client

names, phone numbers, emails, vehicle details, inspection photos, signatures), the studio is the data controller — it decides why and how that data is used. Tosvi is the data processor, acting only on the studio's instructions. The terms of that processing are set out in our Data Processing Agreement (DPA), which forms part of each studio's contract with us.

  • For the studio account itself — the staff login data we need to run the

service (account email, name, role) and the security and operational data described below — Tosvi is the controller.

If you are a _customer of a studio_ and want to access or delete the data the studio holds about you, please contact the studio directly; they control that data, and we will assist them in responding to your request.

This policy is informational for a studio's customers; it does not make Tosvi the controller of, or directly contractually responsible to, those customers, whose controller is the studio.

What data we process

Studio account and staff (Tosvi is controller):

  • Account email address, name, and role of each staff user, used to

authenticate sign-in and operate the service.

  • The user-interface language preference, stored to send account emails (e.g.

password reset) in your language.

Studio client data (Tosvi is processor; the studio is controller):

  • Clients: name, phone, email, and free-text notes.
  • Vehicles: registration plate, VIN, year, colour, and class.
  • Work history: quotes, services, work orders, and generated PDF documents.
  • Pre-work vehicle inspections: photographs of the vehicle (which may show

plates and, occasionally, a person), a customer signature image, damage markers and notes, and the approver's name and approval timestamp. Inspection media is stored in a private, EU-based storage bucket and is served only through short-lived signed links — never on a public URL.

  • Client messaging: if a studio uses the optional Telegram messaging feature, the

content of the conversation between the studio and its client — both the client's inbound messages and the studio's outbound replies — together with the Telegram chat and user identifiers needed to route the messages. This is stored so the studio can hold and continue the conversation and keep a record of it. Messaging is transactional (service communication about the client's vehicle, quote, or appointment); the studio does not send marketing through this feature.

  • Consent records: where a studio records a client's separate consent for an

optional purpose, the app stores that consent and any later withdrawal as a dated record — the purpose, the version of the client notice shown at the time, and the client's signature image where one was captured — kept as evidence that the consent was given. Two optional purposes are offered: publication of photographs of the vehicle, and storage of the client's own record (name, phone, email, vehicle). Neither is a condition of being served: the studio provides the service under its contract with the client whether or not either consent is on file, and a refusal changes nothing about the work.

Embeddable price-calculator widget (optional, if a studio uses it):

  • Lead submissions: if a website visitor submits the studio's contact form, the

name and phone number they provide, an email address if they choose to give one, plus a snapshot of the services/estimate they selected. This becomes the studio's data (Tosvi is processor).

  • Visitor IP address: processed only as an abuse/rate-limit signal. It is

never stored in raw form — it is truncated and irreversibly hashed with a daily-rotating secret before becoming a short-lived counter. No raw or hashed visitor IP is written to our audit log.

  • Aggregate analytics: daily counters (views, estimates, completions) with no

per-visitor records — this is statistical data, not personal data. The widget sets no cookies and runs no per-visitor tracking.

Website enquiries (Tosvi is controller):

  • If you use the "Get in touch" form on our website, we process the name, email

address and message you type, so that we can answer you. We do not store these in the application: your message is delivered to our support inbox and mirrored into our private support channel, which is a Telegram group. Your name, email address and message text are therefore transmitted to Telegram and processed on Telegram's infrastructure outside the EU/EEA, under Telegram's own terms and privacy policy (https://telegram.org/privacy); Telegram is an independent recipient under Article 13(1)(e) GDPR, not a sub-processor, and we enter no Standard Contractual Clauses with it. Our basis is Article 6(1)(b) — steps taken at your request before entering into a contract — for a sales enquiry, and our legitimate interest (Article 6(1)(f)) in answering anyone who writes to us for any other message. If you would rather not use Telegram, write to [email protected] directly. There is no marketing list, and we do not add you to one.

  • A rate-limit counter keyed to a truncated, irreversibly hashed IP (rotated

daily) protects the form from abuse. No raw IP is stored, and the message text and your email address are never written to our logs.

Support conversations over Telegram (Tosvi is controller):

  • If a studio contacts us through the in-app support relay, the message text, any

attachments, and the identifiers needed to route the reply are passed through a Telegram bot into our private support group, and our reply is passed back the same way. This is how we answer support requests; our bases are our contract with the studio (Article 6(1)(b) GDPR) — support is part of the Service — and our legitimate interest (Article 6(1)(f)) in answering anyone who writes to us, operating the Service, and being able to evidence the support we gave. You can object to the legitimate-interest processing at any time. We also store your Telegram chat identifier and a snapshot of your first name, @username and phone number as Telegram supplies them, so we can route the reply. Telegram is an independent recipient under Article 13(1)(e) GDPR, not a sub-processor, and we enter no Standard Contractual Clauses with it; the conversation passes outside the EU/EEA under Article 49(1)(b) GDPR, the transfer being necessary to perform the support you asked for through the channel you chose. The relay records are deleted after 12 months.

Security and operational data (Tosvi is controller):

  • An append-only audit log of actions taken inside an account (who did what,

when) for security and accountability. It does not record customer PII.

  • Standard server logs (request paths, status codes, timing) for debugging and

abuse prevention. We do not log personal data.

What we do not process

  • We do not sell personal data.
  • We do not use client data for advertising or build marketing profiles.
  • We do not use client personal data to train AI models.
  • We do not carry out automated decision-making that produces legal or similarly

significant effects, and we do not profile individuals.

  • The widget does not fingerprint or track individual website visitors.

Why we process this data, and our legal basis

Where GDPR or Moldovan Law 195/2024 (formerly Law 133/2011) applies, we rely on:

  • Contract performance — to provide the service the studio has subscribed

to (authentication, storing and displaying the studio's records, generating quote and inspection documents).

  • Legitimate interest — for security, abuse prevention, rate limiting, and

operational logging. These logs are non-sensitive and access is restricted to the operator; we have determined this interest does not override your rights.

  • Legal obligation — to respond to lawful requests and meet our

data-protection duties.

For the client messaging feature, the lawful basis is performance of the service (contract) and legitimate interest, and messaging is transactional — service communication with the client. Any future marketing messaging would rest on a separate consent basis, kept apart from this transactional processing; the current version sends no marketing messages and operates no marketing-consent mechanism.

For studio client data, the studio determines the purpose and legal basis (typically contract or legitimate interest for its own customer records); Tosvi processes that data only on the studio's documented instructions.

Where data is stored

All application data is stored in the European Union (Supabase, Frankfurt region — Germany). Tosvi is operated from Moldova, but the operator's location does not move the data: your studio's and clients' data is held in the EU, not in Moldova.

Which data-protection law applies, and whether any cross-border transfer safeguard is needed, depends on where the studio and its clients are located. For a Moldovan studio serving Moldovan clients, Moldovan law applies and EU storage is a transfer to an adequate destination, needing no extra safeguard. For an EU studio serving EU clients, the GDPR applies: although the data is stored in the EU, Tosvi operates from Moldova — which does not have an EU adequacy decision — so the operator's remote access to that data is a restricted transfer under Chapter V GDPR. That transfer is covered by the EU Standard Contractual Clauses (see our Data Processing Agreement, Annex 3), supported by measures such as keeping all data stored in the EU with encrypted, access-controlled remote access only. A small number of sub-processors also operate outside the EU/EEA (see below); those transfers rely on Standard Contractual Clauses or an equivalent safeguard.

Sub-processors

Tosvi uses the following third-party services to operate. Each is a sub-processor; data shared is limited to what's necessary for that service.

  • Supabase (database, authentication, and file storage; EU/Frankfurt

region) — stores account and studio data. https://supabase.com/privacy

  • Cloudflare, Inc. (USA) — DNS, content delivery, site hosting, email

routing, Turnstile bot-protection on sign-in and the public widget, and cookieless aggregate web analytics on the public website only (see "Cookies and tracking"). https://www.cloudflare.com/privacypolicy/

  • Cloudflare, Inc. (R2) (US entity; storage jurisdiction pinned to the EU,

Standard Contractual Clauses / Data Privacy Framework) — holds a disaster-recovery backup copy of inspection media (photos and signatures) in a private, encrypted bucket, so the backup stays in the EU; it is used only to restore data, never served. https://www.cloudflare.com/privacypolicy/

  • MailerSend, Inc. (transactional email delivery; EU-based data centres,

ISO 27001; US entity, transfers under EU Standard Contractual Clauses) — sends account emails such as sign-up confirmation, password reset, and security notifications. https://www.mailersend.com/legal/privacy-policy

  • Functional Software, Inc. (Sentry) (application error monitoring; EU data

region — Germany; US entity, Standard Contractual Clauses / EU-U.S. Data Privacy Framework) — receives technical error reports to help us find and fix faults, with personal data scrubbed before it is sent. https://sentry.io/privacy/

Changes to the sub-processor list. If we add a new sub-processor, we will notify studios by email at least 30 days before the change takes effect. A studio may object by emailing [email protected] within that window; if a reasonable objection cannot be resolved, the studio may terminate the service without penalty.

Other recipients

Telegram (the client messaging feature). Where a studio uses Telegram messaging, Telegram is the client's own chosen messaging channel, not a Tosvi sub-processor. Telegram is an independent third party and, for the messages that travel through it, an independent recipient in the sense of Article 13(1)(e) GDPR. Only the content of a message the studio sends, and the Telegram chat identifier used to address the recipient, are sent to Telegram. Your CRM data — client name, phone number, vehicle details, service history, and quotes — is not sent to Telegram; it stays in Tosvi's EU storage. When a client first connects, the client's phone number is _received_ from Telegram (the client shares it to confirm their identity) and stored in Tosvi; it is never sent back to Telegram. The client communicates with the studio through Telegram under Telegram's own terms and privacy policy (https://telegram.org/privacy); message content that passes through Telegram is processed on Telegram's own infrastructure, outside the EU/EEA. Where that content is transferred outside the EEA, the transfer is made under Article 49(1)(b) and (c) GDPR — necessary for the performance of, or in the interest of the data subject under, the contract, the client having chosen Telegram as the channel — and under Telegram's own safeguards. The copy Tosvi stores on the studio's behalf is held in the EU (see "Where data is stored").

Paddle (subscription payments). Where a studio pays for Tosvi by card, Paddle.com Market Limited is our merchant of record: it sells the subscription to the studio in its own name and handles payment, invoicing and sales-tax compliance. Paddle is not a Tosvi sub-processor and is not listed in Annex 1 of the Data Processing Agreement. Under Paddle's own Data Sharing Addendum the two companies act as independent controllers of the billing relationship, each responsible for its own compliance, and transfers between them are made under Module 1 (controller to controller) of the EU Standard Contractual Clauses. Paddle contracts under the law of Ireland.

What Paddle receives is the studio's own billing details — the name, email, billing address, any VAT/tax identifier and the payment-card data the studio enters into Paddle's checkout, which goes directly to Paddle and never passes through Tosvi's systems — together with a single account identifier (a random UUID) that lets a renewal months later be matched to the right studio. No client data of any kind is sent to Paddle: no client names, phone numbers, vehicle details, quotes, photographs or messages. A studio that pays by bank transfer or in cash never reaches Paddle at all.

Paddle also acts as a controller of the buyer data it collects at its checkout, under its own privacy policy (https://www.paddle.com/legal/privacy), and you may exercise your rights against Paddle directly in respect of that processing.

Retention and deletion

  • While the account is active: we retain the studio's data to provide the

service.

  • Data-subject export/erasure: the app provides per-account and per-client

data export and erasure. Erasing a client removes that client's records, including inspections, and the associated inspection media files are deleted from storage (not merely de-referenced). The disaster-recovery backup copy is removed as part of the same erasure, and in any case no later than 14 days afterwards.

  • On account closure / request: we delete the studio's data on request. A studio's primary

owner can also start this from Settings > Privacy & data: deletion is scheduled with a 7-day cancellation window, after which the studio and all its data are permanently erased.

  • Billing and accounting records: retained for the period required by applicable

accounting and tax law and to substantiate fees accrued under the Terms, under our legal obligation (GDPR Article 6(1)(c)); these are not deleted on account closure.

  • Who sets these periods: the studio is the controller of its clients' data

and chooses the retention periods below, including whether data is deleted automatically at all. A studio may also exempt an individual client's records from automatic deletion (for example, while that client is still using the studio's services). Tosvi provides the controls and does not delete a studio's data on its own initiative. Studios are responsible for choosing periods that are lawful where they operate. These choices do not affect your rights: a request to erase your data is carried out regardless of the studio's retention setting.

  • Client messaging content: retained for a studio-configurable window,

12 months by default, and up to 24 months or with automatic deletion disabled, after which messages are automatically purged. Messages are also deleted when the client or the account is erased.

  • Price-calculator leads: retained for a studio-configurable window,

12 to 60 months, or with no automatic deletion — which is the initial state, so a studio must choose a period before anything is deleted automatically — after which unconverted leads are automatically purged. Leads that turn into a job move into the client record and are kept with it. Leads are also deleted when the account is erased.

  • Vehicle-inspection photos & signatures: kept while the account is active

by default. A studio may set a configurable auto-purge window (12/24/36/60 months, or no automatic deletion, which is the initial state), after which the inspection and its photographs and sign-off signature are automatically deleted; the client record and any separate consent to publish photographs are kept. Inspection media is also deleted when the client or the account is erased.

  • Audit log: retained for security and accountability for 36 months, then

automatically deleted; contains no customer PII.

  • Messaging platform updates: the raw Telegram update records used to receive

and de-duplicate incoming messages are deleted after 30 days. The message content itself is kept under the studio's own messaging retention setting above.

  • Server logs: retained for a limited period for debugging and abuse

prevention, then deleted.

  • Website enquiries: a message you send through the contact form is not stored

in the application at all. It reaches our support inbox and our private support channel, and is kept there only as long as we need it to deal with your enquiry and keep a record of what was asked and answered. The anti-abuse counter behind the form is deleted after 7 days.

Your rights

If you are in the EU/EEA, Moldova, or another jurisdiction with comparable laws, you have the rights of access, rectification, erasure, portability, objection, and restriction.

  • Studio account holders: exercise these in-app (export your account data,

edit records) or by emailing [email protected].

  • Customers of a studio: contact the studio (the controller of your data);

we will assist the studio in responding.

  • Lodge a complaint: in Moldova, the National Center for Personal Data

Protection (CNPDCP), https://datepersonale.md. In the EU, your national supervisory authority.

Cookies and tracking

The Tosvi app uses only essential cookies/local storage needed to keep you signed in and remember interface preferences. We use no advertising or tracking cookies anywhere, and no analytics at all in the app or the embeddable widget — both are cookieless in that respect.

On our public website only (tosvi.app), we use Cloudflare Web Analytics to count page views and referrers. It sets no cookies, stores no identifier on your device, and builds no profile: measurements are aggregate and cannot be used to recognise you across visits or sites. It does not run on the signed-in app or on the embeddable widget, so it never touches a studio's client data. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing whether the site works; because it is cookieless, no consent banner is required.

Security

  • All traffic is encrypted in transit (TLS); data at rest is encrypted by our

hosting provider.

  • Strict tenant isolation: database row-level security ensures one studio can

never access another studio's data.

  • Inspection media is stored in a private bucket and served only via

short-lived signed links.

  • Bot protection (Cloudflare Turnstile) and leaked-password screening on

authentication.

  • All inbound data is validated before being written; sub-processor secrets are

stored as environment secrets, never in source code; production access is restricted to the operator.

Breach notification. If we become aware of a personal-data breach, we will notify affected studios without undue delay. The GDPR's 72-hour deadline applies to a controller's notification of its supervisory authority; our separate processor commitment to notify studios without undue delay is set out in the DPA. We will describe the nature of the breach, the data affected, the likely consequences, and the measures taken, and cooperate with the competent supervisory authority where required.

Children

Tosvi is a B2B tool for businesses and is not directed at children. We do not knowingly collect data from children. If notified that a minor has accessed the service, we will delete any associated records on receipt of a credible report.

Changes to this policy

If we materially change how we process data, we will update this policy and notify studios by email at least 30 days before the change takes effect. Minor clarifications will be reflected here with an updated "Last updated" date.

Contact

For privacy questions or to exercise your rights, email [email protected].