Taoneting Limited, trading as Toaray, is the controller of account, website, billing, and support information described here. When we process application data solely to provide infrastructure at a customer's direction, that customer is the controller and Toaray acts as its processor.
1. Scope and roles
This Policy applies to Toaray's websites, accounts, dashboard, APIs, CLI, application platform, domains, DNS, tunnels, support, and related services. It does not govern third-party websites or services that publish their own privacy policy.
For account, billing, website, and support data, Toaray decides why and how information is used. For Customer Content processed only to run a customer's application or infrastructure, the customer controls the data and must handle requests from its users. We assist customers with those requests as required by applicable law and contract.
2. Information we collect
- Account data: name, email address, password hash, verification state, organization, team roles, and authentication settings.
- Project and service data: repositories, deployments, templates, configuration, resource identifiers, logs, metrics, DNS records, tunnel settings, and support diagnostics.
- Domain data: searches, orders, registrant contact details, nameservers, transfer details, renewal settings, and registry-required records.
- Billing data: plan, usage, invoices, transaction references, billing contact, and limited payment metadata. Payment processors receive card or bank details directly; Toaray does not store complete card numbers.
- Device and activity data: IP address, browser and device information, session identifiers, request time, routes, error events, security events, and administrative actions.
- Communications: support requests, abuse reports, survey responses, and other messages you send us.
We receive this information from you, your organization's administrators, your use of the Services, connected providers, payment processors, registrars, registries, and security or fraud-prevention partners.
3. How we use information
We use information to:
- create accounts, authenticate users, and provide requested services;
- process deployment, domain, DNS, network, billing, and support operations;
- measure usage, issue invoices, prevent fraud, and enforce service limits;
- secure accounts and infrastructure, investigate abuse, and respond to incidents;
- maintain, troubleshoot, and improve reliability and product experience;
- send transactional, security, billing, and legally required notices;
- comply with law and establish, exercise, or defend legal claims.
We do not sell personal information. We do not use Customer Content to train general-purpose artificial intelligence models.
4. Legal bases
Where a legal basis is required, we process information because it is necessary to perform our contract with you; to comply with legal obligations; for legitimate interests such as security, fraud prevention, product operation, and service improvement; or with your consent. You may withdraw consent at any time, without affecting earlier lawful processing.
6. International transfers
Toaray and its providers may process information in countries other than the country where you live. Where required, we use contractual safeguards, adequacy decisions, or another lawful transfer mechanism. You may request information about the safeguards relevant to your data by contacting [email protected].
7. Retention
We keep information only for the periods below, unless a longer period is required for active services, legal obligations, disputes, fraud prevention, or a documented legal hold.
| Data | Default retention |
|---|---|
| Account profile and verification | 30 days after closure |
| DNS zone configuration | 30 days after service deletion |
| Raw DNS query analytics | 30 days; aggregates up to 13 months |
| Authentication and security events | 13 months |
| Support and abuse cases | 24 months after closure |
| Domain, invoice, and tax records | Period required by registrar, registry, accounting, and tax law |
Deletion removes information from active systems first. Encrypted backups expire on their normal lifecycle and are not restored except for disaster recovery.
8. Security
We use administrative, technical, and physical safeguards appropriate to the nature of the Services, including access controls, encryption in transit, credential protection, logging, monitoring, and recovery procedures. No system is completely secure. You are responsible for securing your credentials, application code, configuration, and end-user access.
Report a suspected vulnerability or data incident privately to [email protected]. Do not include passwords, recovery codes, or private keys.
9. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, restriction, objection, or a portable copy of personal information, and may withdraw consent or complain to your data protection authority. You may update common account information directly in the dashboard.
Send requests to [email protected] from the email associated with your account. We may verify your identity and authority before responding. We will respond within the period required by applicable law. Immediate deletion may be limited by active domains, payment disputes, fraud prevention, legal holds, or mandatory retention.
11. Children
The Services are intended for adults and business users. Toaray does not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact [email protected] so we can investigate and delete it where required.
12. Changes and contact
We may update this Policy as our Services or legal obligations change. For material changes, we will provide notice by email or through the Services before the new version takes effect. The effective date and version at the top identify the current Policy.
For privacy questions or requests, contact [email protected]. For security reports, contact [email protected].
Questions about this policy?
Contact the appropriate Toaray legal team.