Privacy notice

Last updated: 22 September 2026

Who we are

This website, www.toolkitsoft.com, is operated by SuperFandango SRL, a Belgian company (Enterprise No. 0471.719.611), trading as ToolkitSoft®. You can reach us at info@toolkitsoft.com. This notice explains what personal data we collect when you use this site and its sign-in features, why, and what your rights are.

What we collect and why

When you create a personal account or sign in, we collect:

• Email address — your verified account contact; sign-in codes are sent to it and we may use it to contact you about your account. Needed to provide the account.
• Display name — shown to you in the site header so you can see which account you are signed in with.
• Country or region — used by us for market analysis and for planning localized services.
• Job title — used by us for audience analysis: understanding to whom our offerings appeal. You choose what to enter.

Our sign-in methods are Google, LinkedIn, Apple, Facebook, email passcode, Microsoft work and Microsoft personal, as each becomes available. We receive the provider's identifier for you and the name and email address it shares. The provider handles its own login under its own privacy terms. If the provider does not supply a verified email, we ask you to verify one by passcode. Apple may share your name only the first time you consent. If you choose Hide My Email, we receive and store Apple's private-relay address rather than your real email address. We do not use an email match alone to link accounts: adding a method requires proof of the existing account and the new method.

If you sign in with a company Microsoft account, your identity stays in your employer's directory: we receive sign-in details for your session but do not store an account for you in our customer directory.

When you sign in with a personal account or a company account, your browser reads your Microsoft profile — display name, email address, job title and country — with your explicit consent, which Microsoft asks for once on first use, and sends those fields to us. We record them for the market and audience analysis described above, together with your verified sign-in identity, the sign-in method used and the time of capture, and we refresh them when you sign in again; where your sign-in itself carries a verified email address we record that one. For company accounts the profile comes from your employer's directory and fields are only present where your employer maintains them; you can decline consent, and the rest of the site keeps working.

If you sign in with a personal Microsoft account (for example hotmail or outlook), Microsoft does not release profile details to us. We record the email address and display name your sign-in itself carries, and we ask you to enter your country and job title yourself the first time you sign in. You can change them at any time on the My account page.

The My account page shows your account profile and linked sign-in methods. The Diagnostics page in the account menu shows technical sign-in information about your own session to help resolve problems; it stores nothing new.

The website uses browser storage to keep the credential and server session identifier needed to remain signed in across reloads and tabs. The desktop application keeps its credentials in memory and forgets them when it closes. Every protected request needs a live server session. Signing out revokes that session and clears the client's sign-in state; other open website tabs are notified. Sign out everywhere requires a fresh sign-in and revokes all your ToolkitSoft sessions. Where we own a Microsoft directory user for your account, we also revoke its Microsoft refresh tokens. Microsoft may present its own sign-out page. Other providers can retain their own separate sign-in sessions. We do not use advertising or tracking cookies.

Each time you sign in — on this website or in our desktop application — we record a sign-in event in our own security log: the time, the way you signed in, which of the two surfaces it was, your network (IP) address, and the browser or application and language preference your device presented. We keep this log to protect your account and the service: it is how sign-ins that cannot be you, stolen-credential attempts and other misuse are spotted. Refused requests do not create a successful sign-in record. Technical failures are logged using an operation and correlation identifier rather than tokens, names or email addresses.

Our authentication data is organized in three tables: AccountRecord holds account details, security events, sessions and account actions; LoginIdentity holds provider identity bindings and temporary sign-in operations; VerifiedEmailOwner records which account owns a verified email address. We keep revocation and deletion markers so old credentials cannot restore a signed-out session or a deleted account. The site has no analytics trackers.

Where your data lives

ToolkitSoft account records are stored in Azure Cosmos DB in West Europe. Microsoft Entra operates our customer directory for passcode sign-in and any ToolkitSoft-owned directory users, with data residency in the European Union (we are based in Belgium). Social-provider accounts are not themselves copied into that directory. Microsoft also provides the site's hosting and keeps security and sign-in logs for both our customer directory and our company directory, under Microsoft's data-protection terms. When you use a social sign-in, that provider may process your login data outside the European Union under its own safeguards.

How long we keep it

Account data is kept for as long as your account exists and is deleted when your account is deleted. Our own sign-in log, including the network address, is kept for thirteen months and then deleted. Security and sign-in logs kept by the Microsoft platform follow the retention windows of that platform. The sign-in session expires with the accepted credential or earlier when revoked. Backups can retain deleted data for up to 30 days; they are restricted to recovery.

Legal bases

We process your email address, display name and session data because they are necessary to provide the account you asked for (performance of a contract). We process country/region and job title on the basis of our legitimate interest in understanding our market and audience; you are free to object. Security logging rests on our legitimate interest in keeping the service secure.

Your rights

You can request deletion from My account. Self-service deletion requires a fresh sign-in through a linked method and typing DELETE to confirm. Once the deletion is committed, the account can no longer be used. Its account data is then removed and its sign-in and email claims are released. ToolkitSoft-owned Microsoft directory users for that account are removed through our cleanup procedure, and their Microsoft refresh tokens are revoked; external cleanup may remain pending if Microsoft is unavailable. We do not delete your Google, LinkedIn, Apple, Facebook, Microsoft personal or employer's Microsoft work account. A later registration creates a new ToolkitSoft account. You can still email us to request deletion if self-service is unavailable.

Under the General Data Protection Regulation you can ask us for access to, correction of, or deletion of your personal data; ask us to restrict processing or object to it; and ask for a copy in a portable format. To exercise any of these — including deleting your account and its data — email info@toolkitsoft.com. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or to the supervisory authority of your own country.