Privacy Policy
1. Who we are
TOBIAS is operated by LocalGuide LLC (“we”, “us”), established in Argentina, with its registered office at Bilinghurst 1370, Ciudad Autónoma de Buenos Aires, Argentina [tax identifier (CUIT) to be completed]. We are the controller of your personal data under the Argentine Personal Data Protection Law No. 25,326 and, where it applies to you (for example if you are in the European Union), the EU General Data Protection Regulation (GDPR). Our supervisory authority in Argentina is the Agencia de Acceso a la Información Pública (AAIP). Privacy contact: support@tobias.guru. We have not appointed a Data Protection Officer; the same address handles all privacy matters.
If your university or employer pays for your account, it is our customer for billing purposes only; we remain the controller of your personal data and do not share your project content with the institution.
2. What data we collect, and where it comes from
What you must provide. To open an account you must give an email address, a username and a password. Your chosen market (Russia or Global) determines which payment provider and advertising platforms are offered. Everything else below is optional, but the related feature will not work without it.
| Category | Details | Source |
|---|---|---|
| Account | Username, email, password (stored only as a salted PBKDF2 hash), account status, sign-up and last-login dates. | Sign-up |
| Profile | Name, phone, country, city, company name and website, language, currency and market, optional profile photo. | Account settings |
| Verification | A 6-digit email code at sign-up (15 minutes, 5 attempts), password-reset links (8 hours), account-restore links (30 days). | Generated by us |
| Business project data | Project title, your business-idea description, target regions, your website URL, landing URL, daily ad budget and currency, keyword lists, calculator inputs, decisions you log in the wizard, optional project images. | The project wizard |
| WordPress credentials | If you publish a generated site to your own WordPress: site URL, WordPress username and an application password; optionally your WordPress account password, which we transmit to your site once and do not store. | Publish form |
| Support tickets | Subject, message text, attachments you upload (up to 5 MB) and, only if you press the button, a screenshot of the page. | “Report an issue” |
| Referral | If you sign up via a referral link, which account referred you, and whether the referral is confirmed, waiting for your first payment, held for review or cancelled. | Referral URL |
| Sign-up security (fraud prevention) | When you sign up: the IP address your connection comes from, your browser’s user-agent string (browser type and version), a random device identifier stored in the tb_did cookie and mirrored in your browser’s local storage (Section 9), and a normalised form of your email address (for example without dots or “+” tags for Gmail) so one mailbox is recognised under its different spellings. | Your browser at sign-up |
| Trial fingerprint | When a free trial is granted: keyed one-way hashes (HMAC-SHA256) of your normalised email address and of the device identifier, the account number and the date. They cannot be turned back into the email or the identifier; they only let us recognise the same mailbox or browser asking for another trial. | Derived from the sign-up security data |
| Connected ad accounts | Google Ads: an OAuth refresh token (Google Ads scope only), customer ID, login customer ID, account name, currency, status; optionally your own developer token. Yandex Direct: an OAuth token and your Yandex login. These tokens are stored encrypted (Section 10). | You connect them |
| Payments | Plan and status, gateway used, gateway reference IDs, card brand and last four digits only. We never receive your full card number. A points ledger records every debit and credit. | Payment providers |
| Generated data | AI-generated analyses, market reports, synthetic buyer personas (invented characters, not real people), simulations, brand assets, site copy and ad copy; aggregate statistics about your projects. | Generated by us |
| Competitor research | When you create a project we automatically search for and copy public pages of third-party websites (text, screenshots, metadata, colours) and store them with your project. Those pages may contain names or contact details of the people who run those businesses (Section 3). | Public web |
Technical data. Our application records your IP address, browser type and the tb_did device identifier only once, when you sign up (the “Sign-up security” row above), and uses them only to recognise a repeated free trial or a self-made referral; it does not record them on your other requests. Your IP address never blocks a referral. It can block a free trial only when another account signed up from the same public IP address received a trial in the previous 7 days — a check we switch on only after verifying that our servers see the real address of each visitor (you can see the address we see at /signup/whoami). Our hosting provider keeps standard web-server access logs outside the application. An internal maintenance log records request identifiers only. The public website pages (the landing and the services page, in every language) carry the Yandex Metrica counter: it records page views, clicks on links, the page you came from, your device and browser type and an approximate location derived from your IP address, using the cookies listed in Section 9. Its session replay (Webvisor) also records how the page is used — mouse movements, scrolling, clicks and the page as it looked — so that we can find and fix what is unclear. The fields of the request form (name, email, phone, business, website, message) and the price chat are excluded from the recording: what you type there is masked and its text is not kept in a replay. Pages inside the application (after you sign in) carry no analytics and no session replay. We do not use advertising cookies, tracking pixels, error-reporting services, CAPTCHA or social login. We do not collect your date of birth, government ID or full card details.
3. Why we use your data, and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; verify your email; reset passwords; keep your language and currency | Contract (Art. 6(1)(b)) |
| Deliver the service: validate your idea, forecast demand, run simulations, generate brand assets, site copy, ad copy and websites | Contract |
| Competitor research from public sources on your behalf | Contract for your own data; legitimate interest (yours and ours in market research from public sources) for third-party page content. Informing each person named on a scraped public page individually would involve disproportionate effort (Art. 14(5)(b)); this notice is our public information, and anyone can ask us to remove their data at support@tobias.guru. |
| Operate advertising accounts you connect: forecasts, publishing campaigns | Contract — you initiate each connection and each publish |
| Russian-market demand forecasts when you have not connected Yandex (your keyword phrases are sent to Yandex under our own account) | Contract |
| Billing, subscriptions, points, invoices | Contract; legal obligation for accounting records (Código de Comercio art. 30, Ley General Tributaria art. 66) |
| Service emails: verification codes, reset and restore links, trial and renewal reminders, “your site is ready” notices | Contract (transactional); legitimate interest for reminders that a trial is ending |
| Marketing emails | Consent only. We do not currently send marketing emails. |
| Support | Contract |
| Referral programme | Legitimate interest; the referred user may object |
| Visit statistics and session replay of the public website pages (Yandex Metrica) | Legitimate interest in understanding how the website is used and fixing what is unclear; you may object — block the _ym_* cookies or install Yandex’s Metrica opt-out browser add-on, and the website keeps working |
| Preventing abuse of free trials and of the referral programme: recognising a second trial from the same device or mailbox (also after an account was deleted, through the trial fingerprint), refusing trials to disposable email addresses, and holding a referral that looks self-made for a person to review | Legitimate interest (Art. 6(1)(f)) — offering free trials and referral bonuses fairly, once per person |
| Security, abuse prevention, operation of the service, internal sign-up notifications (identifiers only), operational logs | Legitimate interest |
| Legal compliance | Legal obligation |
Where we rely on legitimate interest, you may object (Section 8) and we will stop unless we can demonstrate compelling legitimate grounds.
4. AI processing and automated decisions
What goes to AI models. To generate analyses and content we send your project title and idea description, your keywords, your company or brand name, text from your own website (for keyword suggestions) and competitor page text to third-party language-model providers; image prompts built from your brand and product names go to image-generation providers. Text you write yourself is sent as you wrote it — avoid including personal details you do not want processed by AI providers.
What does not. We do not include your name, email address or phone number in AI prompts.
Scores and profiling. TOBIAS produces scores and rankings — competitor relevance, simulated purchase intent, market indicators. They concern your business idea, not you as a person, and they are recommendations: you decide whether to act on them, and no score changes your price, plan or access.
One automated check has a practical effect. Before we publish an advertising campaign on your behalf, an automated screen compares your ad text and project category against the advertising policies of Google Ads and Yandex Direct. If it flags a likely policy breach, publishing is paused and you are told why. This concerns your business content, not you; you can edit the text and re-run the check, or ask a person at support@tobias.guru to review it. No other decision with legal or similarly significant effects on you is taken solely by automated means (Art. 22).
Trials and referrals. A new account starts without trial points when its mailbox or its device already had a free trial in the past 12 months (including on an account that has since been deleted), when it uses a disposable (temporary) email service, or — where the IP check described in Section 2 is on — when the same public IP address received a trial in the previous 7 days; a referral whose sign-up shares the referrer’s email or device is held instead of paid. Both are checks against abuse, not judgements about you: write to support@tobias.guru and a person reviews the case and can grant the trial or confirm the referral.
4A. YouTube API Services
What it is. The YouTube channel-topic analysis in TOBIAS (the “Media channel” project type) uses YouTube API Services. By using this feature you agree to be bound by the YouTube Terms of Service. Google’s own processing of data is described in the Google Privacy Policy. TOBIAS is not affiliated with, endorsed or sponsored by YouTube or Google.
What we access. Only public data that the YouTube Data API returns for the search phrases you choose to inspect: video identifiers, titles, publication dates and durations, public view, like and comment counts, channel identifiers and names, and public subscriber counts. We never ask you to sign in with Google or YouTube, we do not access your YouTube account, and we do not access or store any private (authorized) YouTube data. To make a request we send YouTube the search phrase and the region and language of your project — no personal data about you.
How we use it. We show you these statistics for your topic, and we calculate TOBIAS’s own topic score and estimates from them. Scores, estimates and AI-written explanations are labelled in the product as TOBIAS calculations; they are not data published or approved by YouTube. To write the explanation we may send the resulting statistics (never personal data) to the AI providers listed in Section 5. We do not sell YouTube data or make it available to anyone else.
Storage, refresh and deletion. Responses from YouTube are cached for up to 7 days so that repeated look-ups of the same phrase do not call YouTube again. YouTube data saved in your project’s analysis is kept for no longer than 30 days; after that it is deleted or refreshed with current data. If YouTube approves our analytics use case for longer storage of public statistics and the metrics derived from them, we may keep those for up to 36 months and will update this section before doing so. YouTube data in a project is also deleted when you delete the project or your account (Section 7). You can ask us at any time to delete YouTube data stored for your account by writing to support@tobias.guru; we delete it within 7 days.
Cookies and permissions. TOBIAS does not embed YouTube players, so using this feature sets no YouTube or Google cookies through our pages. Because we never request access to your YouTube account, there is no TOBIAS access to revoke; you can review the apps that have access to your Google account at Google security settings.
5. Who receives your data
We do not sell your data. We share it only with the providers below, with payment and advertising platforms you choose to use, and where the law requires. “Active” means used in production today; “standby” means the integration exists but is not currently enabled or reachable from our servers.
| Provider | Country | What they process |
|---|---|---|
| HostiMan (hosting: application, database, uploaded files, outgoing mail server) | Russia | Everything in Section 2, all emails we send you. Active. |
| Yandex LLC (Yandex Metrica) — visit statistics of the public website pages | Russia | Page views, clicks, referring page, device and browser type, IP address (used for an approximate location), Metrica cookie identifiers, and session replays of the public pages (mouse movements, scrolling, clicks; typed form and chat text excluded). Not used inside the application. Active. |
| Ollama, Inc. (Ollama Cloud, via a relay on our server) — primary text generation | USA | Project title and description, keywords, brand name, competitor page text, site and ad copy prompts. Active. |
| Hugging Face, Inc. — fallback text generation | USA / France | Same prompt classes. Active (fallback). |
| Cloudflare, Inc. (Workers AI) — image generation | USA | Image prompts built from your brand and product names. Active. |
| Pollinations.ai — fallback image generation | [to be verified] | Image prompts, sent unauthenticated. Active (fallback). No data-processing agreement is available for this provider. |
| Firecrawl (SideGuide Technologies, Inc.) — web research | USA | Your website URL, competitor URLs, search queries built from your keywords and title; page screenshots are held on their servers. Active. |
| Google LLC / Google Ireland Ltd — OAuth and Google Ads API | USA / Ireland | Keywords, geo targets, budgets, ad text, landing URLs, your Ads customer ID. Only when you connect Google Ads. |
| Google LLC — YouTube Data API (YouTube API Services) | USA | The search phrases you choose to inspect and the region and language of your project; no personal data (Section 4A). Standby until the Media channel project type is available in your account. |
| Yandex LLC — OAuth, Yandex Direct API; Yandex Cloud LLC — Wordstat statistics | Russia | Keywords, regions, campaign names, ad text, landing URLs, budgets, your Yandex login; up to 10 keyword phrases per forecast. Only when you use Russian-market features. |
| YooKassa (ООО НКО «ЮMoney») — payments | Russia | Amount, plan name and an internal account ID (no email). Currently all card payments, including for customers outside Russia, are processed by YooKassa while our global checkout is being configured. |
| Lemon Squeezy, LLC (a Stripe company) — merchant of record for customers outside Russia | USA | Your email and an internal account ID; Lemon Squeezy collects your card details, name and billing address directly on its own pages and is an independent controller for the checkout. Standby until the global checkout is enabled. |
| Google (Gemini), OpenAI, Anthropic, Higgsfield, Stripe | USA / Ireland | Standby integrations, not currently used. |
Third parties your browser contacts directly. Pages load fonts and libraries from Google Fonts (USA), amCharts (Lithuania), Plotly (cdn.plot.ly, Plotly Technologies Inc., Canada/USA), cdnjs and unpkg (Cloudflare, USA). When you pick target regions, your browser also loads map tiles from the tile servers of the OpenStreetMap Foundation (United Kingdom) or, where we have enabled it, from CARTO (Spain/USA), and sends the places you search for or click on the map to the OpenStreetMap Foundation’s Nominatim service. These providers receive your IP address and may receive the address of our site or the page you are on; the map-tile providers also receive the map area you view, and Nominatim the search text and map points you submit. They set no cookies on our domain.
Our staff. Staff with an administrator flag can see your account, plan, points, referrals and support tickets, and whether your account shares a sign-up device with another account, and can edit plans or delete accounts. Superusers using the technical admin can also see payment payloads and project settings. All staff are bound by confidentiality.
Legal disclosures and business transfers. We may disclose data where required by law, court order or a competent authority, and to a successor if LocalGuide LLC is sold or merged, under this policy.
6. International transfers
Where your data is stored. Our application, database, uploaded files, generated media and outgoing mail server are hosted by HostiMan in Moscow, Russia. The European Commission has not issued an adequacy decision for Russia. [Safeguards under Art. 46 — Standard Contractual Clauses and a transfer impact assessment — or migration of hosting to the EEA: to be completed by counsel before this policy is finalised.]
Other transfers outside the EEA. Providers in the United States (Section 5) — where a provider is certified under the EU–US Data Privacy Framework we rely on the adequacy decision of 10 July 2023; otherwise on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) with a transfer impact assessment [per-provider status to be completed]. Yandex, Yandex Cloud and YooKassa are in Russia: when you choose Russian-market features or pay through YooKassa, the data listed for them in Section 5 is transferred because it is necessary to perform the feature you request (Art. 49(1)(b)). You can request a copy of the safeguards we rely on at support@tobias.guru.
7. How long we keep your data
| Data | Retention |
|---|---|
| Email verification code | 15 minutes; deleted on success or re-issue |
| Password-reset request | 8 hours, or until used; expired requests are purged daily |
| Account-restore link after a deletion request | 30 days (the grace period) |
| Login session (server side) | Cookie lifetime 2 weeks |
| Google Ads background jobs / forecast caches / monthly search statistics | 7 days / 48 hours / 30 days |
| YouTube API data (public video and channel information and statistics, Section 4A) | Cache: up to 7 days. In a project’s analysis: up to 30 days, then deleted or refreshed; deleted within 7 days on request |
| Account, profile, projects, generated content, competitor pages, connected-account tokens, support tickets and attachments | Life of the account; permanently deleted 30 days after you request deletion (see below) |
| Sign-up security data (IP address, browser type, device identifier, normalised email) | Life of the account, deleted with it; for a repeated trial a device identifier is compared only with sign-ups of the last 12 months, for a referral with the referrer and the other friends the same member invited |
| Trial fingerprint (hashed normalised email and device identifier, account number, date) | 12 months from the date the trial was granted, also after the account is deleted; older fingerprints are deleted automatically every day |
| Payment, invoice and points-ledger records | Kept after account deletion, with the gateway’s customer payload removed, for the period required by applicable accounting and tax law (currently 10 years under Argentine law) |
| Operational server log | Identifiers only (user and request IDs), no email addresses; retained under our hosting provider’s log rotation |
| Internal new-registration notifications (username and account ID only) | 90 days in the support mailbox |
Deleting your account. You can delete your account from Account Settings by confirming your username and password. Your account is deactivated immediately, you stop receiving emails from us, and we email you a restore link. You have 30 days to use it; after that we permanently delete your account, profile, projects, all generated content, uploaded files, connected-account tokens and support tickets. We keep only the payment and ledger records described above, with your name and email removed from the gateway payload. A member of staff can also delete your account on request at support@tobias.guru.
8. Your rights
Under Law No. 25,326 and, where it applies to you, the GDPR, you have the right to: access a copy of your personal data; rectify inaccurate data (most profile fields are editable in Account Settings); erase your data (Section 7), subject to records we must keep by law; restrict processing while a dispute is resolved; portability — receive the data you gave us in a machine-readable format (you can download each project’s keyword list, business plan and generated site from the app; for a full account export write to us); object to processing based on legitimate interest and, at any time, to direct marketing; withdraw consent without affecting earlier processing (you can disconnect Google Ads in Account Settings; for Yandex or WordPress credentials, contact us); not be subject to solely automated decisions with legal or similarly significant effects (we make none — Section 4); and complain to a supervisory authority — in Argentina the Agencia de Acceso a la Información Pública (AAIP), www.argentina.gob.ar/aaip — or, if you are in the European Union, the authority of the EU country where you live or work.
How to exercise them. Email support@tobias.guru from the address on your account, or open a support ticket in the app. We may ask you to confirm your identity in a proportionate way. We respond within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why. Exercising your rights is free unless requests are manifestly unfounded or excessive.
9. Cookies and local storage
We use only strictly necessary and functional cookies. No analytics or advertising cookies are set.
| Name | Type | Purpose · lifetime |
|---|---|---|
sessionid | Cookie (HttpOnly, Secure in production) | Keeps you logged in · 2 weeks |
csrftoken | Cookie (Secure in production) | Protects forms against cross-site request forgery · 1 year |
django_language | Cookie (functional) | Remembers the interface language you chose in the header · until you close the browser |
sidebar_minimize_state | Cookie (functional) | Remembers whether the sidebar is collapsed · 30 days |
tb_did | Cookie (security; HttpOnly, Secure in production) | A random identifier of this browser, set when you open the sign-up or sign-in page — it contains nothing about you or your device. Read only when an account is signed up, to recognise a repeated free trial or a self-made referral (fraud prevention) · 2 years |
tobias.did | localStorage (security) | A copy of the same random tb_did identifier, kept by the sign-up and sign-in pages so that clearing cookies alone does not make the browser look new; if the cookie is missing, the page puts the remembered identifier back · until you clear site data |
tb_did_restore | Cookie (security) | Carries the remembered identifier back to our server once, when the tb_did cookie was missing; deleted as soon as it is read · 10 minutes |
_ym_uid, _ym_d, _ym_fa, _ym_ucs | Cookies (analytics, Yandex Metrica; public website pages only) | Tell one visitor from another and remember the date of the first visit · 1 year |
_ym_isad, _ym_metrika_enabled, _ym_hostIndex | Cookies (analytics, Yandex Metrica) | Technical: ad-blocker detection, a check that Metrica cookies work, request limiting · from 60 minutes to 1 day |
_ym_visorc | Cookie (analytics, Yandex Metrica session replay) | Lets the session replay (Webvisor) work during a visit · 30 minutes |
yandexuid, yuidss, i, ymex, usst, yabs-sid, gdpr, is_gdpr | Cookies set by Yandex on its own domains | Yandex’s visitor identifiers used by Metrica · up to 2 years; governed by Yandex’s privacy policy |
| Theme, sign-in language, wizard step, unsent wizard draft (kept 7 days), interface state | localStorage / sessionStorage | Interface preferences and an unsent draft of your idea text so a reload does not lose it. On a shared computer, clear browser storage after use. |
| Service worker cache | Browser cache | Offline copy of static assets only (no personal pages) |
You can delete or block cookies in your browser settings; blocking sessionid or csrftoken prevents login. Deleting tb_did together with this site’s local storage gives your browser a new random identifier; deleting the cookie alone lets the sign-up and sign-in pages restore it from local storage.
10. How we protect your data
- All traffic to app.tobias.guru is encrypted with TLS; session and CSRF cookies are marked Secure in production.
- Passwords are stored only as salted PBKDF2-SHA256 hashes and must meet minimum-strength rules; we cannot see your password.
- Email verification codes expire in 15 minutes and lock after 5 wrong attempts; reset and restore links are single-use and time-limited.
- Tokens for accounts you connect (Google Ads refresh and developer tokens, Yandex token) are encrypted at rest in our database with a key held outside the database. WordPress application passwords you save for publishing are stored in the database protected by access controls; you can revoke any token at any time from your Google, Yandex or WordPress security settings.
- Uploaded files (profile photos, project images, support attachments, generated videos) are served only to their owner and to staff; stock images and brand imagery generated for publication are public by design.
- Outgoing email uses SMTP over TLS; payment notifications from our global checkout are signature-verified.
- Server error reports do not contain form contents or cookies and are not emailed.
- Data is stored on shared hosting in Russia (Section 6).
- If a breach is likely to result in a risk to you, we will notify the competent supervisory authority (the AAIP in Argentina and, for users in the EU, the competent EU authority) within 72 hours and you without undue delay (Art. 33–34).
11. Children
TOBIAS is a business tool for adults. You must be at least 18 years old to use it. We do not knowingly collect data from anyone under 18 and do not ask for your date of birth. If you believe a minor has created an account, email support@tobias.guru and we will delete it.
12. Changes to this policy
We may update this policy when our service, providers or the law change. We will post the new version here with a new effective date and, for material changes, notify you by email or an in-app notice before they take effect. Previous versions are available on request.
13. Contact
LocalGuide LLC · Bilinghurst 1370, Ciudad Autónoma de Buenos Aires, Argentina · support@tobias.guru
For a website you publish to your own WordPress using TOBIAS, you are responsible for that site’s privacy notice and cookie compliance; generated sites load Google Fonts and cdnjs libraries, and their footer “Privacy” and “Terms” links are placeholders you must fill in.