Privacy

Who runs this site

Toolcounsel is a trade name of Lou Magis, a one-person business at Zuideinde 449, 1035 PH Amsterdam, the Netherlands (Chamber of Commerce/KvK 42161321). Lou Magis decides what happens with your data, which makes him the “controller” under the GDPR. Questions or requests: hello@toolcounsel.com.

What we store, why, and for how long

• Your conversation with the consultant. To give you the advice you asked for, let you pick it up again, and read conversations back to improve the advice. Basis: providing the service you asked for, and our legitimate interest in improving it. Kept 12 months after your last message, or for as long as your account exists if you have one.
• Your email address. The consultant asks for it after its first advice, or after a few messages if there is no advice yet. Without it the conversation cannot continue. We use it so you can continue the conversation and we can send it to you. Basis: providing the service you asked for. Kept with the conversation. If you later sign in with the same address, your earlier consults show up in your account.
• Which tool links you click, and from which page. To see which recommendations help. Basis: legitimate interest. When the conversation is deleted, only an anonymous count remains.
• Setup help: the name, email and situation you fill in, which tool it is about, and which conversation you came from. Kept 12 months after our last contact.
• Booking a call: your name, email, phone number if you give it, what you want to discuss, phone or video, the time, and the conversation you booked from. Kept 3 months after the call.
• Call waiting list: your email, until we have told you new times are open. Deleted within a month after that.
• Signing in: your email address and sign-in records. With “Continue with Google”, Google shares your name, email and profile picture with us. Kept until you ask us to delete your account.
• Your IP address, to stop abuse. We count requests per IP address, and sign-in links per email address, over an hour or a day. Basis: our legitimate interest in keeping the service available and safe. These counters are deleted within 3 days. Our host Cloudflare keeps short technical logs that can include your IP address for up to 7 days.

For setup help, calls, the waiting list and signing in, the basis is taking the steps you asked us to take. Our database is with Supabase, in the EU (Stockholm). When a request, booking or sign-up comes in, Lou Magis gets a short email notice without your name, email, phone number or message; he reads those in the database.

How the advice is made

The consultant is an AI. Your messages are processed by Anthropic's Claude, the AI model that writes the replies. Anthropic does not use this data to train its models and keeps it only for a limited time, for safety checks.

Who else handles it

Only these companies, and only to run this site. Supabase, Anthropic, Resend and Cloudflare work for us under a data processing agreement.

• Supabase: database and sign-in, stored in the EU (Stockholm).
• Anthropic: its AI model Claude reads your messages to write the replies.
• Resend: sends our email, so it sees your address and the message.
• Cloudflare: hosts the site, blocks attacks, forwards email sent to hello@toolcounsel.com and counts visits for us. This means it sees every visit, your IP address and those emails. The visit count (Cloudflare Web Analytics) uses no cookies and stores nothing on your device. We only see totals, such as which pages were read and from which countries. Basis: our legitimate interest in knowing whether people use the site.
• Google, under Google's own privacy policy: if you sign in with Google, if you email us or we reply to you (that mail sits in Lou Magis's Google mailbox), and for video calls, which run on Google Meet.

Outside the EU

Anthropic, Resend and Cloudflare are US companies, so your data can be processed in the US. They rely on the EU-US Data Privacy Framework, which the European Commission has approved, and the EU's standard contractual clauses. Google is a US company too and is certified under the same framework; for the parts listed above, its own privacy policy applies.

Cookies

Only cookies the site needs to work, so we do not ask for consent.

• One per conversation: a signed cookie that proves the conversation belongs to your browser. Without it, anyone with your conversation link could read it. It holds nothing about you, cannot be read by JavaScript, and expires after a week.
• If you sign in: the sign-in cookies that keep you logged in. They go when you sign out, and expire after 400 days at most.

We use no analytics, tracking or advertising cookies. Visits are counted without cookies (see Cloudflare above).

Email we send

Only email that follows from something you did: your consult recap when you ask for it, a sign-in link when you request one, a confirmation and one reminder for a call you booked, one message when new call times open if you joined the waiting list, and our reply to a setup request. No newsletter, no marketing, no follow-up sequence.

Commission

Some tool links earn us a commission when you sign up. To count that, the tool or its affiliate network receives the random ID of your conversation. It contains nothing about you or what you wrote, and only we can link it back to the conversation.

What we never do

• Sell your data or your conversations to anyone.
• Send you marketing email.
• Show ads or share your data with ad networks.

What you should not share

The advice works on how your business runs: your processes, volumes and budget. It never needs personal data of your customers or staff, medical or financial records, passwords, or API keys. Please keep those out of the chat. If you paste something by accident, email us and we will delete the conversation.

Your rights

You can ask to see your data, correct it, delete it, get a copy, limit how we use it, or object to uses based on our legitimate interest. Email hello@toolcounsel.com and we will answer within a month. If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).