Togal.AI

The Terms state Customer Content remains the property of the Customer and that the Customer is the data controller while Togal is the processor. However, the Customer must grant Togal a broad, worldwide, transferable license to use, modify, and distribute that content, which meaningfully qualifies the ownership statement.

The Terms define 'Output' as any data or information generated by the Service but do not expressly grant Output ownership to the Customer. Outputs are heavily disclaimed as informational only, and Togal broadly retains rights to work product and derived metrics, leaving Output ownership ambiguous.

The Terms expressly permit Togal to process Customer Content to develop its machine learning models, with Togal owning all resulting IP. The Privacy Policy similarly states usage data is collected to teach and refine ML/AI techniques, and there is no opt-out from this training use. This is a significant vendor-favorable term for users with proprietary construction data.

Retention is described only in open-ended terms ('as long as you use our services or as necessary to fulfill the purpose(s)'), with no defined retention schedule and no deletion SLA. Users may email to request erasure, but requests are only processed 'in line with local laws' and 'within a reasonable time.' On termination, Customer Content 'may be' deleted at Togal's discretion, leaving deletion timing uncertain.

The Terms authorize sharing of both Customer Content and Customer Data with third parties 'as necessary to provide and enhance the Services,' which is broader than strictly required for delivery. The Privacy Policy also permits sharing PII with marketing third parties (with permission) and freely sharing anonymized data with advertisers and sponsors. Combined with a very broad service-provider list and no named sub-processor list, disclosure controls are weak.

The Privacy Policy provides an opt-out/right-to-object mechanism via email and allows withdrawal of consent, plus marketing email opt-outs. However, these do not clearly extend to the machine-learning training use of Customer Content, which the Terms present as a mandatory grant, and certain non-promotional communications cannot be opted out of. Opt-out is therefore real but limited in scope.

The Privacy Policy claims steps toward GDPR compliance but names no third-party attestation. A SOC 2 Type II news page appeared in the source URL list but was inaccessible, so no certification can be verified from the supplied text. Against the universal baseline and enterprise_saas frameworks (SOC 2 Type II, ISO 27018), the documents provide only a GDPR effort claim and California Shine-the-Light disclosure; no certifications are evidenced in-text.

The documents provide no transparency into model behavior and no enterprise audit rights. They repeatedly warn that AI output may be incorrect and require human verification, but offer no explainability, audit-log access, or auditing commitments. Silence on this topic is itself a risk for a professional/regulated user relying on AI takeoffs.

Security disclosures are minimal and generic — 'reasonable steps' and unspecified 'technical and organizational security policies' — with no mention of encryption at rest/in transit, penetration testing, or incident response in the supplied text. No breach history is disclosed. A bug bounty and SOC 2 page were referenced in the URL list but were inaccessible and cannot be relied upon.

The Privacy Policy notes a distinction for Paid Customers, stating Togal will not access a Paid Customer's subscription except to provide the Services or as required by law. However, no separate enterprise agreement or DPA was accessible, and the training-on-Customer-Content and third-party-sharing provisions in the Terms apply generally. The material improvement for paid tiers is therefore limited and not fully documented.

Access to personal data is said to be restricted to employees/agents with valid reasons, and support phone/chat sessions may be monitored and recorded. There is no explicit statement that staff routinely read Customer Content prompts/outputs, but Togal reserves broad rights to determine and edit content it deems violating. Human access is thus permitted in defined circumstances rather than prohibited.

The Privacy Policy discloses that data may be accessible to law enforcement pursuant to lawful requests and may be disclosed to protect Togal's interests or comply with law. The Terms impose binding individual arbitration, a class-action waiver, and a customer indemnity. No active litigation is disclosed, but the compelled arbitration and government-access provisions increase user exposure and limit remedies.

Togal collects a broad range of PII (name, email, postal address, phone, IP, device identifiers, inferred location, usage patterns) plus payment/financial data (credit card numbers) and communications content — the latter two categories are SPI. While collection is disclosed, the combination of financial data and communications content with broad sharing and training use, and no granular controls over those specific categories, elevates risk.

The Terms of Service are dated 'Last Updated February 20, 2025,' roughly 18 months before the analysis date, and the Privacy Policy carries no discoverable effective date. The product surface confirms AI-first capabilities (automatic detection/measurement, Togal.CHAT), and the policies do address AI/ML processing and model training, so coverage is present. However, the aging ToS date, absent privacy-policy date, and no mention of specific third-party model providers cap this at YELLOW.

Multiple documents were supplied (two identical Privacy Policy copies and one Terms of Service). Comparing the Privacy Policy against the Terms surfaces a tension: the Terms say Customer Content 'may be shared with third parties as necessary to provide and enhance the Services,' while the Privacy Policy asserts Togal 'does not use personal information for any purpose outside of providing the Services.' This is a reconcilable wording tension rather than a flat contradiction, warranting a MINOR rating.