Privacy policy
This page explains how Tuto Ltd (in foundation) handles personal data for Tuto.
Last updated: 2026-04-22
What we process
Account and authentication data
Email address, name, authentication identifiers, session records, and desktop sign-in metadata needed to operate the account.
Backup service metadata
Device names, backup health state, repository metadata, quotas, alerts, restore requests, and recovery-material metadata. Backup contents are encrypted on the device before upload.
Support and reliability data
Error reports, audit events, billing events, support actions, and monitoring data used to keep the service working and support customers.
Billing data
If billing is enabled, payment processing is handled by Stripe. Tuto Ltd (in foundation) stores subscription state and billing metadata, not full card details.
Why we process it
- To create and maintain customer accounts and device connections.
- To operate encrypted backup, restore, and recovery workflows.
- To secure the service, detect abuse, and troubleshoot failures.
- To manage billing, invoices, refunds, and subscription support when billing is enabled.
- To meet legal, tax, fraud-prevention, and security obligations.
Processors and infrastructure
- Better Auth and Tuto-controlled Postgres for authentication flows.
- Hetzner for primary infrastructure and staging environments.
- AWS S3 or archival equivalents if archive storage is enabled.
- Stripe for billing if payment flows are activated.
- Cloudflare for DNS and edge delivery where configured.
Retention
Account, device, and operational metadata is retained only as long as required to operate the service, satisfy legal obligations, resolve disputes, or complete offboarding.
Backup contents follow the retention settings described in the product, currently targeting a 30-day history for early access unless the service is changed explicitly.
Your rights
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of data where we no longer need it or must erase it by law.
- Request restriction of processing in specific cases.
- Object to processing that relies on legitimate interests.
- Receive portable copies of data you provided to us where applicable.
- Lodge a complaint with a competent supervisory authority.
To exercise these rights, contact hi@usetuto.com.