Privacy Policy.
This Privacy Policy explains how Toadstool Labs LLC, doing business as Toshiku (“Toshiku,” “we,” “us”) collects, uses, and shares information when you visit our websites, request a report, submit Targets for review, or use our services. We sell to businesses, not consumers, and we keep this short on purpose.
1.What we collect
- Account information: name, business email, company, role, and billing details.
- Target and scope information: domains, subdomains, IPs, URLs, company names, ownership signals, verification artifacts, and other details you submit so we can identify or monitor likely associated internet-facing assets.
- Service data: findings, screenshots, exports, notes, observed configurations, public records, internet telemetry, and any data reasonably necessary to verify an exposure, deliver a Report, or operate the Services.
- Verification and higher-tier data: DNS TXT records, file tokens, credentials, or other access data you provide if you request or enable a verified or otherwise authorized higher-sensitivity service.
- Usage information: log data, IP addresses, device and browser information, pages visited, and interactions with our Services.
- Communications: messages, support requests, and survey responses.
We do not need customer end-user personal information to provide the entry-tier Services. If sensitive information is exposed on a Target or otherwise incidentally encountered, we may process only the minimum reasonably necessary to confirm the issue, reduce abuse, comply with law, and report the issue appropriately.
2.Sources of information
We collect information:
- Directly from you when you contact us, request a report, create an account, make a purchase, submit a Target, or send verification materials.
- Automatically when you use our site or Services.
- From public and commercial sources such as DNS, certificates, internet telemetry, reputation feeds, archival sources, public code and content, and other lawful third-party datasets.
- From service providers and partners that support payments, hosting, analytics, communications, fraud prevention, and AI or automation infrastructure.
3.How we use it
- To provide, operate, secure, and improve the Services.
- To deliver Reports, dashboards, and notifications.
- To verify authority, ownership, and access level for requested Services.
- To bill, support, and communicate with you.
- To detect, prevent, and address security, fraud, and abuse.
- To comply with law and enforce our agreements.
- To create de-identified and aggregated data, which we may use for lawful internal analytics, benchmarking, and model improvement.
For website visitors, account holders, and public-source intelligence we generally act as an independent controller or business. Where we process certain customer-submitted data on behalf of a customer in a verified or higher-tier engagement, we may act as a processor or service provider under a separate agreement if required.
4.Legal bases (EEA / UK)
Where the GDPR or UK GDPR applies, we process personal data on the bases of contract performance, our legitimate interests in operating and securing our business, your consent (where required), and compliance with legal obligations.
5.Sharing
We share information with:
- Service providers who help us run the business, including hosting, payments, analytics, communications, and AI infrastructure, under written contracts that restrict their use.
- Affiliates and successors where needed to operate the business or in connection with a merger, acquisition, financing, or sale of assets.
- Auditors, lawyers, and advisors, as needed.
- Authorities, when required by law or to protect rights, safety, or property.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
6.International transfers
We are based in the United States and may transfer information to the U.S. and other countries that may not provide the same level of data protection as your jurisdiction. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.
7.Retention
We retain information for as long as needed to provide the Services, comply with law, resolve disputes, and enforce our agreements. Reports, findings, screenshots, and related service records may be retained as part of your account or security history unless we delete them in our ordinary course or you request deletion in writing, subject to legal obligations, abuse prevention needs, backup cycles, and our legitimate business records.
8.Security
We implement reasonable administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Use of the Services is at your own risk.
9.Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, or to object to certain processing. You may also have the right to lodge a complaint with your data protection authority. To exercise these rights, contact privacy@toshiku.com. We will verify your request before responding.
California: We do not sell or share personal information as those terms are defined under the CCPA/CPRA. California residents may exercise their rights by contacting us at the address above or any other request method we make available in the relevant service or workflow. We will not discriminate against you for exercising your rights.
Where we act as a processor on behalf of a customer, we will direct individual rights requests to that customer, who is the controller of the relevant data.
10.Cookies and online tracking
We use a small number of essential cookies to operate our site and authenticate sessions, and limited analytics to understand usage. You can control cookies through your browser settings. Disabling cookies may break parts of the Services.
Some analytics or infrastructure providers may receive information about your use of our site over time and across services, subject to their own policies and our contracts with them. At this time, our site does not respond differently to browser “Do Not Track” signals because there is no uniform standard for doing so.
11.Children
The Services are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us personal information, contact us and we will delete it.
12.Changes
We may update this Policy from time to time. The “Effective” date reflects the most recent revision. Material changes will be communicated through the Services or by email. Continued use of the Services after the effective date constitutes acceptance.
13.Contact
Toadstool Labs LLC
privacy@toshiku.com