Privacy & cookie policy
Last updated: 26 September 2026
We keep this simple: we only collect what we need to run Toolee, we never sell data, and we don't use advertising cookies. This policy explains what we process, why, and what your rights are.
1. Who we are
Toolee provides websites, reservations, customer management and invoicing for local businesses.
2. Our two roles
- Controller — for the data of Toolee account holders (business owners and their team) and visitors of toolee.nl.
- Processor — for the data that businesses collect with Toolee, such as their customers' reservations, messages and invoices. The business is the controller for that data; we process it on their behalf under our Data Processing Agreement. If you booked at a business that uses Toolee, please contact that business — every Toolee website has its own privacy statement at
/privacy.
3. What we process as controller, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, password (hashed) | Creating and securing your account | Contract (Art. 6(1)(b) GDPR) |
| Business details (name, address, KvK, VAT, IBAN) | Providing the service, your website and invoices | Contract |
| Subscription and payment references | Billing via Mollie; we never see your card details | Contract; legal obligation (tax records) |
| Support e-mails | Answering your questions | Legitimate interest (Art. 6(1)(f)) |
| Technical logs (IP address, browser, timestamps) | Security, fraud and abuse prevention | Legitimate interest |
4. Cookies
toolee.nl only uses cookies and local storage that are necessary for the service to work. We don't use advertising or cross-site tracking cookies. Fonts are served from our own servers.
| Name | Purpose | Type | Retention |
|---|---|---|---|
| tl_session | Keeps you logged in to your Toolee account | Necessary | 30 days |
| tl-consent-app (local storage) | Remembers your cookie choice | Necessary | 12 months |
| tl-theme (local storage) | Remembers light/dark mode in the dashboard | Necessary (preference) | Until cleared |
Websites of businesses on Toolee
Business websites made with Toolee are privacy-friendly by default: visits are counted anonymously without cookies, fonts and photos are served from our servers, and external services (such as Google Maps, or analytics a business adds itself) only load after the visitor gives consent via the cookie banner.
5. Who we share data with
We never sell personal data. We use carefully selected processors, bound by data processing agreements:
| Processor | Purpose | Location / safeguards |
|---|---|---|
| Vercel Inc. | Hosting and content delivery of the application (region: Frankfurt, EU) | EU / USA (EU-US Data Privacy Framework) |
| Neon Inc. | Database hosting | Region as configured; USA locations under the EU-US Data Privacy Framework |
| Mollie B.V. | Subscription payments | Netherlands (EU) |
| E-mail service provider | Sending transactional e-mails (booking confirmations, invoices, password resets) | EU |
Where data is processed outside the European Economic Area, this happens under an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. How long we keep data
- Account and business data: for as long as your account is active, and deleted within 30 days after you delete your business or account.
- Invoices and payment records: 7 years (Dutch fiscal retention obligation).
- Technical logs: at most 30 days.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. You can delete your business and account yourself in the dashboard (Settings → Account). For anything else, e-mail privacy@toolee.nl — we respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Security
All traffic is encrypted (HTTPS). Passwords are stored as salted hashes. Access to data is limited to people who need it, and each business's data is strictly separated from others.
9. Changes
We'll announce material changes to this policy by e-mail or in the dashboard. The latest version is always on this page.