Privacy, made clear.

Information we collect

• Account information: your email address, authentication details and account identifiers.
• Clinic information: the clinic name, location, contact details, brand preferences, audiences, treatments and guidance you choose to save.
• Content and assets: brain dumps, answers, campaign copy, uploaded or imported photographs, logos, generated imagery and edits.
• Website imports: information and images from the public website you ask Toggled to review. You approve imported content before it becomes part of your setup.
• Waitlist information: the email address you submit for launch updates.
• Feedback and support: messages sent through Feedback or by email, the account they relate to, and details needed to investigate a problem. Feedback is saved in our database.
• Feature suggestions: ideas sent through What’s next, an optional reply email, and a keyed hash of the sender’s network address to limit abuse. Suggestions are saved privately and may be emailed to the founder through Brevo. The reply email is not added to a mailing list.
• Technical information: security, request and error information produced when the service is used. We do not use advertising trackers. Optional analytics are described below.

Optional analytics

With your consent, PostHog EU helps us understand how visitors discover Toggled and move from a visit through a CTA click, waitlist signup, confirmed account, first saved design and, when payments are introduced, confirmed subscription. We use safe page and referral categories and approved UTM campaign labels. Visitors have a random ID; confirmed accounts use only their Supabase account ID. This is pseudonymous information, not anonymous once linked to an account.

We do not send clinic or patient content, names, email addresses, photos, prompts, captions, Brand DNA, treatment details, input values, full URLs, browser IP addresses or user-agent headers to PostHog. We do not enable session recording, heatmaps or automatic interaction capture. Our server forwards only approved fields.

The legal basis for optional analytics is consent. Accept or decline in the banner, and change your choice through Cookie settings on the cookie page or public footer. Withdrawal stops future analytics and removes browser analytics identifiers. It does not undo earlier processing. Contact hello@trytoggled.com for access or deletion requests. Browser analytics cookies expire within 180 days; account consent also expires within 180 days. Analytics retention in PostHog is controlled by the project retention settings. In our database, minimal account milestone and delivery records remain for the account’s lifetime to prevent duplicate or retrospective conversions. Consent choices and expiry are recorded, and a decline clears unsent events. These records contain account IDs, event names and times, with approved source labels for consented events; they never copy clinic or patient content. Account deletion removes these records.

How we use it

We use account, clinic and campaign information to provide Toggled: authenticate you, save your workspace, generate and edit campaigns, create requested images, export work and provide support.

We use waitlist emails to send the launch updates a person has requested, and account emails for sign-in, security and service messages. Weekly Monday planning emails are switched off during the beta. We use limited technical information to protect the service, investigate faults and prevent abuse.

Our legal bases

Depending on the activity and applicable law, we rely on performing our agreement with you, your consent, compliance with legal obligations, and our legitimate interests in operating and securing Toggled. You can withdraw marketing consent at any time by emailing us.

Content generation and service providers

We use these providers to run Toggled. They receive the information needed for their part of the service:

• PostHog: optional product analytics in its EU cloud, using the limited identifiers and events described above. Its contractual safeguards and any subprocessors or international access remain relevant even with EU hosting.
• OpenAI: generates and rewrites copy and images, analyses brand references, and reads uploaded photographs to suggest tags and descriptions. Project uploads are sent for this AI reading; selected photos and instructions may also be sent again to create or edit a design.
• Supabase: provides sign-in, our database and private file storage for account details, clinic profiles, photos, designs, campaigns and feedback.
• Vercel: hosts the app and runs web and API requests, processing request data and technical logs.
• Cloudflare: runs the background job coordinator that keeps planning and design work moving, using account and project identifiers and job status.
• Brevo: provides email delivery for launch updates and service messages where enabled.

We do not sell personal information or use clinic content in Toggled’s own advertising.

Where information goes

Toggled is operated from Gibraltar and serves UK clinics. The current Supabase database is hosted in Ireland. OpenAI processing includes the United States; hosting, email, support and technical services may also process information in the US and other countries. Uploading a client photo therefore involves processing outside the UK, including by AI in the US.

International transfers require an applicable legal safeguard, such as an adequacy arrangement or approved contractual clauses. Email hello@trytoggled.com for the provider locations and transfer terms that apply to your information.

Photographs and client information

The clinic decides which client photos to upload and why. Toggled stores, analyses and uses them to create the clinic’s requested content on its behalf, rather than for Toggled’s own marketing. AI photo reading suggests tags; it is not a clinical assessment or a diagnosis.

You must have the necessary image rights and your client’s written consent to marketing use and AI processing by Toggled and its providers, including in the US. Before-and-after results and practitioner content require genuine, explicitly selected photographs. Avoid uploading medical records or other information that is not needed to create the requested content.

How long we keep information

Account information, clinic profiles, campaigns, designs and uploaded photos stay in your workspace while your account is open, unless you ask us to remove them. Photos do not automatically expire after a design is made. Waitlist information is kept until launch communications finish or you unsubscribe. Feedback is kept while we investigate and resolve the issue; security records are kept while needed to investigate faults, misuse or legal claims. Provider logs and backups follow the relevant provider’s retention cycle and may outlast removal from the active workspace.

During the beta, deletion of photos, projects and accounts is handled manually: email hello@trytoggled.com with what you want removed. A client should normally contact their clinic, which can instruct us to remove its client’s information. We aim to respond to rights requests within one month. At the end of the beta we will explain how to download your work and request deletion before closing access. You can also ask us to remove a waitlist entry. We may retain limited information where the law requires it or where it is needed to establish, exercise or defend legal claims.

Your choices and rights

Subject to applicable law, you may ask to access, correct, delete, restrict or receive a copy of your personal information, or object to certain uses. You can also withdraw consent where processing relies on consent.

Email hello@trytoggled.com to make a request. You may also complain to the data-protection authority where you live or work. In Gibraltar, this is the Gibraltar Regulatory Authority; in the UK, it is the Information Commissioner’s Office.

Security and changes

We use access controls, private asset storage and account-level permissions designed to keep clinic work separate. No online service can promise absolute security, so please use a strong, unique password and contact us if you believe an account has been compromised.

We may update this notice as Toggled develops. Material changes will be explained through the service or by email where appropriate.