Privacy policy
Last updated: 11 November 2026
This policy explains what Toolbelt AI does with personal information, what allows us to do it, who else sees it, and what you can ask us to do about it. It covers the Toolbelt AI mobile app, this website, the web portal and the service behind them.
The short version
- We hold your account details so you can sign in, and your business records so the app can show them to you.
- We do not sell anything to anybody, we do not advertise, and we do not track you across other apps or websites.
- The assistant sends what you ask it, and the records it needs to answer, to OpenAI. It is switched off until you open it, and you can stop using it at any time.
- You can get a copy of what we hold, correct it, or delete your account from inside the app.
- If we get something wrong you can complain to us, and then to the Information Commissioner’s Office.
The rest of this page is the detail behind those five points.
Who we are
PromptIQ Ltd, company number 16458888, registered at 2 Sandals Cottages, Church Lane, East Worldham, Alton, Hampshire, GU34 3AS, is the data controller for the information described below.
Email support@prompt-iq.io about anything in this policy. We are not required to appoint a Data Protection Officer and have not appointed one, so that address reaches the people responsible for this directly.
Two different roles
Toolbelt AI is used by tradespeople and field service businesses to run their own work, so there are two kinds of personal information here and we hold them under different responsibilities:
- Your account. Information about the people who sign in — you and your colleagues. We decide how this is used, so we are the controller for it and this policy is our notice to you about it.
- Your business records. The customers, addresses, quotes, jobs and invoices you enter. Those belong to your business; you decide what goes in and what happens to it, and we hold them on your behalf as a processor. We act on your instructions and do not use them for our own purposes. What we commit to as your processor is set out in our terms and conditions.
If you are one of our customer’s customers and want to know why your details are in here, the business you dealt with is the controller and is who to ask. There is a section for you further down.
What we collect, why, and what allows us to
Data protection law requires us to have a lawful basis for each thing we do with personal information. Ours are in the third column.
| What | Why | Our lawful basis |
|---|---|---|
| Your name and email address | To create your account, sign you in, and let colleagues in your organisation identify you | Performance of our contract with you |
| Your password, stored hashed | To sign you in. We never store it in a form we can read | Performance of our contract with you |
| Display preferences — text size, gestures, animations | To keep the app set up the way you like it | Performance of our contract with you |
| Sign-in session records, including IP address and device details | To keep you signed in, and to notice and stop misuse of an account | Our legitimate interests in keeping the service and its users secure |
| Business records you enter — customers, addresses, quotes, jobs, invoices, timesheets | To provide the service. These may include names, addresses, phone numbers and email addresses of your own customers | Your business decides this; we hold them as its processor |
| Photographs you attach | Only when you choose to add one to a record, from the camera or your photo library | Performance of our contract with you |
| What you type or say to the assistant, and its replies | To answer you and carry out what you ask | Performance of our contract with you, once you choose to use it |
| A push notification token | To send notifications to your device | Your consent, given when your device asks and withdrawn by turning notifications off |
| Diagnostic reports when something goes wrong | To find and fix faults, and to see how often they happen | Our legitimate interests in keeping the app working |
| Emails we send you — invitations and password resets | To let you join an organisation or get back into your account | Performance of our contract with you |
We do not send marketing email, so there is nothing here to unsubscribe from. We do not collect special category data — health, beliefs, biometrics and the like — and ask that you do not put any into the app.
Where it comes from
Almost all of it comes from you, as you use the app. Two exceptions are worth naming: if a colleague invites you into an organisation, we get your email address from them before you have ever used Toolbelt AI; and if you sign in with Apple, Google or Facebook, we get a confirmation of who you are, and an email address, from whichever of them you chose.
Do you have to give it to us?
There is no legal obligation to give us anything. But an email address and a password (or a sign-in through Apple, Google or Facebook) are how accounts work, so without them we cannot give you one. Everything else is optional in the ordinary sense: skip the assistant, refuse notifications, attach no photographs, and the rest of the app works.
The assistant
The assistant is a computer program, not a person, and it is built on a language model supplied by OpenAI. It is worth spelling out what that means for your information.
- What is sent. When you send the assistant a message, that message goes to OpenAI, along with the earlier messages in the same conversation and whichever of your records are needed to answer — a customer’s name and a quote’s contents, for instance, if you ask about that quote.
- What OpenAI does with it. We use OpenAI’s business API, which does not use what it receives to train its models. OpenAI keeps requests for a short period to check for abuse of its service, and then deletes them.
- Spoken replies. If you have them switched on, the text of the assistant’s answer is sent back to OpenAI, which turns it into audio and sends it back. Switch readback off in the assistant’s settings and nothing is sent to be spoken.
- You are asked first. The app explains all of this and asks your permission before it sends anything to OpenAI, and will not use the assistant until you give it. You can withdraw that permission at any time in the assistant’s settings, and the whole of the rest of the app works without it.
- It can be wrong. Language models make mistakes. Check what it has done before you rely on it — especially figures, and especially anything you are about to send to a customer.
Speaking and listening
You can talk to the assistant instead of typing.
- In the app, dictation uses the speech recognition built into your phone — Apple’s on iOS, Google’s on Android — so the audio is handled by your device’s operating system under Apple’s or Google’s own privacy policy, and may be sent to them to be turned into text. It does not come to us as audio: we receive only the text it produces, and only when you send it.
- On the web, while the microphone is on, your browser records what you say and sends the recording to us, and we send it to OpenAI to be turned into text. To help it spell things the way your account does, OpenAI is also given the names of your customers, your team and your recent jobs, quotes and invoices. Voice recordings are sent to OpenAI to be transcribed and are not kept: we pass the recording straight on and delete it as soon as the text comes back, and we do not keep a copy of the text either until you send it as a message. We keep only a note of how long the recording was and what it cost, to count against your assistant allowance.
- If OpenAI cannot be reached, the web portal uses your browser’s own speech recognition instead, as it did before. Most browsers send the recording to their maker to do it — Google for Chrome, Microsoft for Edge, Apple for Safari — under that company’s own privacy policy.
- Never while it speaks. The microphone is on only while you are dictating or talking to the assistant hands-free, never while it is reading a reply aloud, and we do not record or store audio at any other point.
Who else sees it
We use the following services to run Toolbelt AI. Each one sees only what it needs.
| Service | What reaches them | When |
|---|---|---|
| OpenAI | What you type or say to the assistant, and the records it needs to answer; on the web, recordings of what you say into the microphone, with your customers’ and team’s names, to turn them into text; and the text of its reply, to turn it into speech | Whenever you use the assistant; recordings only while you use the microphone on the web; the reply text only when spoken replies are switched on |
| Sentry | Diagnostic reports: what the app was doing when a fault occurred, and which account it happened to | When something goes wrong |
| Expo | Your device’s push notification token and the notifications sent to it | If you allow notifications |
| Apple, Google or Facebook | Confirmation of who you are, so we can sign you in | Only if you choose to sign in that way |
| The Apple App Store or Google Play | Your subscription purchase. We never see your card details | When you subscribe or renew |
| QuickBooks or Xero | The customers and invoices you choose to send across | Only if you connect an accounting provider |
| Laravel Cloud | Hosting. Everything above is stored on infrastructure they operate | Always |
| Cloudflare | Protects this website and the web portal. Your IP address and the requests your browser makes pass through it | When you use the website or the web portal |
Each is engaged under a written contract that allows it to use what it receives only to provide its service to us, requires it to keep that information confidential and secure, and obliges it to protect the information to the same standard this policy sets out. None of them is permitted to use it for their own purposes, to sell it, or to build advertising profiles from it.
We may also disclose information where the law requires it — to a court or a regulator, for instance — and to our professional advisers where they need it. If our business is ever sold or transferred, information would move with it, and you would be told.
Sending information outside the UK
Several of the services above are based in the United States, so using them means sending information there. UK law allows that only under specific safeguards, and we rely on:
- the UK Extension to the EU–US Data Privacy Framework, where the service is certified under it — the UK government has decided that information sent to a certified organisation is adequately protected; or
- the ICO’s International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, where it is not.
Email support@prompt-iq.io if you would like to know which applies to a particular service, or a copy of the relevant safeguards.
Decisions made about you
We do not make decisions about people by automated means alone where those decisions would have a legal effect on them, or a similarly significant one. There is no credit scoring, no automated profiling and no automated rejection here.
The assistant does act on your records automatically, but only on your instruction, only within your own organisation, and only on the kind of change you could make by hand. You can see everything it did and undo it.
What we never do
- We do not sell your information, or your customers’ information, to anybody.
- We do not use it for advertising, and we do not share it with advertisers.
- We do not track you across other apps or websites. There are no advertising or analytics SDKs in the app.
- We do not use your records, or your conversations with the assistant, to train any AI model — ours or anybody else’s.
Cookies
This website and the web portal use a small number of cookies. They are all strictly necessary: they keep you signed in, protect your account and keep automated abuse out. We do not use cookies for analytics or advertising, so we do not ask you to accept any of these.
| Cookie | What it does | How long it lasts |
|---|---|---|
toolbelt_ai_session |
Recognises your browser from one page to the next, so you stay signed in | 2 hours from your last request |
| A random 40-character name, different for each session | Holds your session’s details, encrypted | 2 hours from your last request |
XSRF-TOKEN |
Checks that a form or request really came from this site | 2 hours from your last request |
__cf_bm |
Set by Cloudflare to tell people from automated traffic | 30 minutes |
If you use the assistant in the web portal, your browser also stores your choice of voice, whether replies are read aloud, and when you agreed to the assistant’s terms. These stay in your browser’s local storage until you clear them.
You can block or delete cookies in your browser’s settings, but you will not be able to sign in to the web portal without them. If we ever want to use cookies that are not strictly necessary, such as for analytics, we will list them here and ask you first.
How long we keep it
| What | How long |
|---|---|
| Your account, and your organisation’s records | While the account is open, and for 30 days after it closes, after which they are deleted |
| Your name and email address after you delete your profile | Erased immediately. The row is kept, blanked, only so that work already recorded against you stays attached to something |
| Sign-in tokens and push notification tokens | Deleted as soon as the account is deleted, or the token is revoked |
| The name of a colleague who has left, in the notification announcing it | Removed after 30 days |
| Diagnostic reports | Deleted by Sentry after 90 days |
| Assistant conversations held with the request at OpenAI | Deleted by OpenAI after its abuse-monitoring period, currently up to 30 days |
| Voice recordings from the web portal’s microphone | Not kept by us: deleted as soon as OpenAI has transcribed them. Held by OpenAI only for its abuse-monitoring period, as above |
Where we have to keep something longer — because the law requires it, or because it is needed for a legal claim — we keep only that, and only for as long as the reason lasts.
Keeping it safe
Everything travels over an encrypted connection. Passwords are stored as one-way hashes, so nobody at our end can read them. Each organisation’s records are separated from every other organisation’s, and access to the systems holding them is limited to the people who need it to run the service.
If a breach ever put your information at risk, we would report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you directly where the risk to you was high.
Your rights
Under UK data protection law you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong, or complete anything missing;
- delete it, where we have no reason to keep it;
- restrict what we do with it while a question about it is resolved;
- hand it over, or send it on, in a portable form;
- stop processing it where we rely on our legitimate interests — you can object, and we will stop unless we can show compelling grounds to continue.
Where we rely on your consent — notifications are the only place we do — you can withdraw it at any time, in your device’s settings. That does not affect anything done before you withdrew it.
You can delete your account yourself, from Profile → Delete Profile in the app. If you own the organisation, that closes the organisation and everyone in it, so export anything you want to keep first.
For anything else, write to support@prompt-iq.io. We will respond within one month, and it costs nothing.
If you are unhappy with us
Tell us first. You have the right to complain to us directly about how we have handled your personal information. Email support@prompt-iq.io with “data protection complaint” in the subject line. We will acknowledge it within 30 days, look into it, and tell you the outcome.
You can also complain to the Information Commissioner’s Office, which regulates us, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first so we can put it right, but you do not have to.
Children
Toolbelt AI is a tool for running a business and is not intended for children. You must be 18 or over to hold an account, and we do not knowingly collect information about children. If you think a child has an account, tell us and we will remove it.
If your details are here because you dealt with a business that uses Toolbelt AI
Your name, address and the work done for you may be in Toolbelt AI because the trade or service business you dealt with keeps its records in it. That business decides what is held and why; we only store it for them. Ask them, and they can answer, correct or delete it. If you cannot reach them, write to support@prompt-iq.io and we will do what we can to help you find them.
Changes
If we change this policy we will update the date at the top, and tell you in the app if the change is a significant one.