Privacy Policy

1. Who this policy covers

“TOHSAN,” “we,” and “us” mean TOHSAN Digital Solutions. This policy applies to people who visit our website, contact or book with us, use Cello, or use a workspace or service that TOHSAN operates for a tenant or client. It also covers information about a client’s customers or other people entered into those services.

A client may control information collected for its own business. In that case, the client’s privacy notice and our agreement with that client may also apply. A separately operated client product may have its own policy. This page does not replace a notice for a specific activity when more detail or consent is required.

2. Information we handle

Depending on the service and your choices, this may include:

• Contact and account details, such as your name, email address, business, tenant membership, and authentication information.
• Content you or your organization provide, such as inquiries, bookings, messages, files, customer records, Cello captures, tasks, projects, notes, plans, and activity history.
• Service and security information, such as sign-in events, device and browser details, IP address, cookies needed for authentication, and diagnostic logs.
• Information from integrations you explicitly connect or authorize. For Cello, a connected Google Calendar can supply selected calendar events for scheduling context.
• Discovery-call information, including a recording or transcript when a call is recorded with the applicable notice and consent.

Some tenant services may contain sensitive information entered by the client or its authorized users. The categories depend on that service and its purpose.

3. How and why we use information

We use information to provide and secure the requested service; authenticate users; manage tenant access; save and display user content; fulfill bookings and communications; provide support; maintain, troubleshoot, and improve our systems; and meet legal obligations. Where a feature is enabled, authorized data may be used to prepare AI-assisted drafts, summaries, or suggestions. We do not treat those outputs as a substitute for human review in decisions that require it.

Our basis for handling information depends on the activity and applicable law. It may be your consent, a contract or requested service, compliance with a legal obligation, or a legitimate interest that is permitted by law. A client that controls its own business records determines the purpose and lawful basis for that use; TOHSAN processes those records under its instructions and the relevant service agreement.

4. Sharing and service providers

Information may be available to authorized members of your tenant, the client that administers a workspace, and TOHSAN personnel who need it to provide or support the service. We use service providers for infrastructure, authentication, storage, email, communications, video meetings, and enabled integrations. These can include Supabase, Google services you connect, and providers used for discovery calls or AI features. The exact providers and data shared depend on the feature in use.

We may also disclose information when required by law, to protect people or the service, or as part of a business transfer with appropriate safeguards. We do not sell personal data.

5. Cookies and connected services

Our services use cookies or similar local storage needed to keep you signed in, maintain a secure session, and remember functional choices. A connected service, such as Google Calendar, is used only when the relevant integration is enabled and authorized. You can disconnect an integration using its available controls or contact us for help. Its provider’s privacy terms also apply to your use of that provider.

When you connect Google Calendar to Cello, Cello requests read-only access to calendar events so it can show selected events alongside your day and help prepare scheduling context. Cello stores connection details and selected calendar references needed to maintain that connection. It does not use Google Calendar data for advertising or sell it. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. Retention and security

We keep information for as long as needed to provide the service, follow the client’s instructions, handle requests and disputes, maintain security, and meet legal or contractual duties. Retention can differ by record and service. When information is no longer needed, we delete or de-identify it, subject to backup cycles and lawful retention requirements.

We use access controls and other reasonable technical and organizational safeguards. No online system can guarantee absolute security. Please contact us if you believe your account or information has been compromised.

7. Your choices and account deletion

You may ask to access, correct, export where applicable, object to or restrict certain processing, withdraw consent where processing relies on it, or request deletion of your personal information. To request deletion of a Cello or other TOHSAN-operated account and its associated data, email pocholo@tohsan.com with the account email and service name. You can make this request without installing or signing in to the app. We may verify your identity before acting.

If your account belongs to a client-managed tenant, we may coordinate with that client. We will explain any information we must retain for legal, security, or other legitimate reasons and delete the rest as applicable. If you have a privacy concern about a client’s own records, you may also contact that client directly.

8. Children and international processing

Our general services are intended for business users and are not directed to children. We do not knowingly invite children to create Cello accounts. Service providers may process information outside the Philippines; where this occurs, we use appropriate contractual and security safeguards required by applicable law.

9. Changes and contact

We may update this policy when our services or practices change. We will update the date above and provide additional notice when required. For privacy questions or requests, contact TOHSAN Digital Solutions at pocholo@tohsan.com. You may also raise a concern with the relevant privacy regulator, including the Philippine National Privacy Commission where applicable.