Privacy policy for toolboxproof.com

Last updated: March 2, 2026. This policy covers the public website at toolboxproof.com. Data handled inside the ToolboxProof application for paying customers is governed by the customer agreement referenced in the terms of service.

Who is responsible for your data

The data controller is MLJ, SASU, the French company that publishes ToolboxProof, whose registration details appear on the legal notice. The publication director, Jimenez Julien, is the person who reads what you send and decides how it is handled. You can reach him directly at jimenezjulien42@gmail.com for any question raised by this policy, including a request to delete what you have sent.

What the request form collects

The only personal data this website gathers is what you type into the request form on the home page. The form fields are named and used as follows.

• name: your full name, so a reply is addressed to a person rather than to a company.
• email: your work email address, which is where the answer and any sample report are sent.
• company: your company or crew name, used to prepare a relevant example and to avoid duplicating an existing account.
• role: your role on the job, chosen from a fixed list, so the walkthrough is aimed at the way you actually use the tool.
• request: what you are asking for, chosen from a fixed list of a demo, early access or a quote.
• size: how many people shoot photos on your jobs, which determines seat pricing.
• message: your free text answer describing how you keep track of job photos today.
• consent: the record that you ticked the box agreeing to be contacted about this request.

Three hidden fields travel with the submission and contain no information about you: form-name identifies which form was used, subject labels the resulting notification, and recipient routes it to the publisher inbox. A honeypot field named bot-field stays empty for human visitors and is used only to discard automated spam. The form processor also records the submission time and the network address the submission came from, which is standard anti abuse practice.

Why we are allowed to hold it

Under the European General Data Protection Regulation, processing rests on two bases. Answering your request is carried out on the basis of steps taken at your request before entering into a contract. Keeping a short record of the exchange afterwards rests on our legitimate interest in maintaining an accurate commercial history and in preventing abuse of the form. The consent checkbox records your agreement to be contacted about the request you sent. Under United States state privacy law, the same processing is described as a business purpose limited to responding to your inquiry.

How long submissions are kept

An unanswered or declined request is deleted within 12 months of the last message in the thread. If the exchange becomes a customer relationship, the request is kept for the life of the account and for three years after it closes, because it forms part of the commercial record. Spam caught by the honeypot is deleted automatically within 30 days. You may ask for earlier deletion at any point and we will action it within 30 days unless we are legally required to keep a specific record.

Who processes the data

Form submissions are processed and stored by Netlify, Inc., the hosting provider for this website, using Netlify Forms. Netlify stores each submission in the site dashboard and forwards a notification to the publisher inbox. Netlify acts as a processor on our instructions and applies its own security program to that storage. Email replies are handled through a standard business mailbox. No other company receives your submission. We do not sell personal information, we do not share it for cross context behavioral advertising, and we do not use it to build any advertising profile.

Cookies, analytics and tracking

This website sets no advertising cookies and runs no third party analytics scripts. There is no pixel, no tag manager, no session recorder and no social network tracker in these pages. The only scripts loaded are our own stylesheet and a small script file served from this domain, plus the Google Fonts stylesheet used to load the two typefaces. Because no tracking cookie is placed, no consent banner is needed to browse this site.

International transfers

MLJ, SASU is established in France, and the hosting provider is established in the United States. That means a submission sent from Europe is transferred to the United States for storage. Those transfers rely on the European Commission standard contractual clauses incorporated in the hosting agreement, together with the technical measures applied by the provider. If you would rather not have your details stored on United States infrastructure, write to us by email instead of using the form and say so, and the exchange will be kept in the mailbox only.

Your rights in the United States

Residents of California, Colorado, Connecticut, Utah and Virginia have the right to know what personal information has been collected about them, to obtain a copy of it, to have it corrected, and to have it deleted. You may also opt out of any sale or sharing of personal information, though this website performs neither. California residents may exercise these rights without receiving different pricing or service quality, and may use an authorized agent. To exercise any of these rights, email jimenezjulien42@gmail.com with the address you used on the form. We answer within 45 days and will tell you if we need a short extension.

Your rights under GDPR

If you are in the European Economic Area or the United Kingdom, you hold the rights of access, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, and portability of the data you provided. You may withdraw consent at any time without affecting processing already carried out. Requests go to the same address and are answered within one month. You also have the right to lodge a complaint with your national supervisory authority, which in France is the Commission Nationale de l'Informatique et des Libertes.

Security

Submissions travel over an encrypted connection and are stored by the hosting provider with encryption at rest. Access to the form dashboard and to the publisher mailbox is protected by strong passwords and multi factor authentication, and is limited to the publication director. We keep no copy of form data on personal devices. If a breach ever affects this data, notification will follow the timelines set by applicable law.

Children

ToolboxProof is a business tool sold to contracting companies. This website is not directed to children, and we do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has sent information through the form, write to us and it will be deleted promptly.

Changes to this policy

This policy is reviewed twice a year and after any change to the form, the hosting arrangement or the applicable law. The revision date at the top of this page always reflects the current version. Material changes are also noted in the product changelog so existing customers can see them. Continuing to use the website after a revision means the current version applies to you.

Questions about this policy can be sent to jimenezjulien42@gmail.com and are answered by a person, not an automated system.