Privacy Policy

AQP, Inc. (doing business as Portola) (“Portola,” “we,”“our,” and/or “us”) values the privacy of individuals who use our application, website (including https://tolans.com), and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose personal information from users of our Services (“you” or “your”). As used in this Privacy Policy, “personal information” means any information relating to an identified or identifiable individual. By using our Services, you agree to the collection, use, disclosure, and procedures described in this Privacy Policy. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service.

To read about how we collect, use, and disclose information from children under 13 through our Services, please read the Children’s Privacy Notice section below.

Personal Information We Collect

We may collect a variety of personal information from or about you or your devices from various sources, as described below. Where applicable, we indicate whether and why you must provide us with your personal information, as well as the consequences of failing to do so. If you do not provide your personal information when requested, you may not be able to use our Services if that personal information is necessary to provide you with our Services or if we are legally required to collect it.

‍A. Personal Information You Provide to Us

Account and ‍‍Character Creation. When you create an account and a Tolan character we ask you for your date of birth, your first name, and the name you select for your character.

‍Character Interactions. When you interact with your character, we may receive your phone number, audio information (including sound or voice recordings), text, and image data from that interaction. The Services allow you to submit this audio information, text, image data, and other materials to the Services (“Prompts”), which generate responses based on your Prompts (“Outputs”). If you include personal information in your Prompts, we will collect that information, and this information may be reproduced in the Outputs.

Communications. If you contact us directly, we may receive personal information about you. For example, when you contact us for customer support purposes, we may receive your name, email address, the contents of a message or attachments that you may send to us, and other information you choose to provide. When you communicate with us, third party vendors may receive and store these communications on our behalf.

Payment Information. If you make a purchase through our Services, our third-party payment processor will collect your payment-related information, such as name, mailing address, and telephone number, on our behalf.

Careers. If you decide that you wish to apply for a job with us, you may submit your contact information, employment-related information, and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience. If you apply through a third-party service, we will collect the information you make available to us through that service.

‍B. Personal Information We Collect When You Use Our Services

Location Information. When you use our Services, we infer your general location information, for example, inferring the city or state, by using your internet protocol (IP) address.

Device Information. We receive information about the device and software you use to access our Services, including IP address, web browser type, operating system version, phone carrier and manufacturer, application installations, device identifiers, mobile advertising identifiers, and push notification tokens.

Usage Information. To help us understand how you use our Services and to help us improve it, we automatically receive information about your interactions with our Services like the pages or other content you view and the dates and times of your visits. 

Information from Cookies and Similar Technologies. We and our third-party partners collect information about your activities on our Services using cookies, pixel tags, SDKs, or similar technologies. Our third-party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services. We and our third-party partners may use the following cookies:

• Essential cookies. Some cookies are strictly necessary to make our website and Services available to you. For example, to provide login functionality or for security purposes. We cannot provide you with the website and Services without this type of cookies. 
• Analytics cookies. We use cookies for analytics purposes in order to operate, maintain and improve our website and Services.
• Advertising cookies. We and our third-party partners, use cookies to help us and our advertisers show you relevant advertising, as well as to present ads to you on sites that are not owned or operated by us to promote our services, articles or events. The cookies are used to make advertising messages more relevant to you and your interests. They also perform functions like preventing the same ad from continuously re-appearing.

C. Personal Information We Receive from Other Sources

Information from Discord. If you choose to join our Discord server, we may receive information about you, including your username, display name, ID, profile picture, and your activity in the Tolan Discord server. We use this information to manage our community, provide support, and improve our Services. If you wish to limit the information available to us, you should visit the privacy settings of your Discord account to learn about your options. You understand and agree that the use of your information by Discord will be governed by Discord’s privacy policy.

Google Workspace Data

This section applies to information Portola receives from Google Workspace APIs, including Gmail and Google Calendar (“Google Workspace Data”). If this section conflicts with another part of this Privacy Policy, this section controls for Google Workspace Data.

When you choose to connect Gmail, Portola may access email messages and related information, including message content, headers, sender and recipient information, subject lines, and dates. When you choose to connect Google Calendar, Portola may access calendar and event information, including event titles, times, availability, locations, descriptions, and attendee information.

We use Google Workspace Data only to provide the connected features you ask us to provide. These features include searching or reading email, preparing email drafts, showing your schedule or availability, and creating calendar events you request.

To provide these features, we may process and store Google Workspace Data and information derived from it, such as summaries, memories, embeddings, and search indexes. We use service providers acting on our behalf to operate the Google connection, process requests, provide AI features, create embeddings, and store search indexes. We do not sell Google Workspace Data, use it to serve advertising, or use it to determine creditworthiness or for lending purposes.

We do not use Google Workspace Data to create, train, or improve generalized artificial intelligence or machine-learning models. We do not allow people to read Google Workspace Data except with your affirmative agreement, when necessary for security or abuse prevention, to comply with applicable law, or as otherwise permitted by the Google API Services User Data Policy.

You can disconnect Gmail or Google Calendar at any time in the Services. Disconnecting stops future access to the connected account. We generally delete Google Workspace Data we stored outside of your chats and canvases when you disconnect. Information that appears in your chats or canvases may remain there until you delete it using the applicable controls.

Portola’s use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

‍How We Use the Personal Information We Collect 

Except as described in the “Google Workspace Data” section, we use the personal information we collect as follows:

• To provide, maintain, improve, and enhance our Services;
• To personalize your experiences of our Services, such as by providing tailored content and recommendations;
• To understand and analyze how you use our Services and develop new products, services, features, and functionality;
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• To send you text messages and push notifications;
• To facilitate transactions and payments;
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
• To generate deidentified or aggregated data containing only de-identified, non-personal information that we may use for any lawful purpose;
• To find and prevent fraud, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the personal information is collected.

Legal Bases for Processing European Personal Information

If you are located in the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”) (jointly, “Europe”), we only process your personal information when we have a valid “legal basis,” including as set forth below. 

• Consent. We may process your personal information where you have consented to certain processing of your personal information.
• Contractual Necessity. We may process your personal information where required to enter into or perform a contract to which you are a party. For example, we may need to process your personal information to provide you with the Services, or to respond to your inquiries or requests.
• Compliance with a Legal Obligation. We may process your personal information where we have a legal obligation to do so. For example, we may process your personal information to comply with tax, labor and accounting obligations.
• Legitimate Interests. We may process your personal information where we or a third party have a legitimate interest in processing your personal information. Specifically, we have a legitimate interest in using your personal information for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of the Services. We only rely on our or a third party’s legitimate interests to process your personal information when these interests are not overridden by your rights and interests.

‍How We Disclose the Personal Information We Collect

Partners and Affiliates. We may disclose any information we receive to our partners, corporate affiliates, parents, or subsidiaries for any purpose described in this Privacy Policy.

Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services, such as IT, security or data hosting service providers. 

AI Service Providers. We may disclose information we receive to vendors that provide artificial intelligence services that provide backend support for our Services. 

Analytics Partners. We use analytics services such as Posthog to collect and process certain analytics data. These services may also collect information about your use of other websites, apps, and online resources. You can learn more about Posthog's practices by visiting https://posthog.com/privacy. 

Advertising Partners. We work with third-party advertising partners to collect and process your information in order to show you ads that we think may interest you. Some of our advertising partners are members of the Digital Advertising Alliance (https://optout.aboutads.info) and serve ads through cookie-based technologies. Please visit their opt-out pages to learn about how you may opt out of receiving certain web-based personalized ads from member companies. These opt-outs will apply only to our third-party advertising partners that are members of these organizations. These opt-outs will not apply when our partners serve ads through non-cookie based technologies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.

Other Users You Interact With. If you invite a friend to join your Tolan in a cottage or you accept your friend’s invite to join their Cottage, your friend will receive your name and any information you share in the course of a conversation. 

As Required by Law and Similar Disclosures. We may access, preserve, and disclose your personal information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your personal information may occur if you post any objectionable content on or through our Services.

Merger, Sale, or Other Asset Transfers. We may use, transfer, disclose, or otherwise process your personal information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company, or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected. 

Consent. We may also disclose your information with your permission.

Your Choices

Your European Privacy Rights. If you are located in Europe, you have additional rights described below.

• You may request access to the personal information we maintain about you, update, and correct inaccuracies in your personal information, restrict or object to the processing of your personal information, have your personal information anonymized or deleted, as appropriate, or exercise your right to data portability to easily transfer your personal information to another company. In addition, you have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
• You may withdraw any consent you previously provided to us regarding the processing of your personal information at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

You may exercise these rights by contacting us using the contact details at the end of this Privacy Policy. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain personal information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.

Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Retention

When you request that we do so, we take measures to delete your personal information or keep it in a form that does not permit identifying you when this personal information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When we process personal information for our own purposes, we store information for as long as necessary for the purposes identified in this Privacy Policy. 

We determine retention periods by taking into account various criteria, such as the type of services provided to you, the nature and length of our relationship with you, possible re-enrollment with the Services, the impact on the Services we provide to you if we delete some personal information from or about you, and mandatory retention periods provided by law and the statute of limitations. In certain cases, we also keep your information for legal reasons, including after your account has been deleted, for example to respond to a legal request or to comply with applicable law when we have a legal obligation to retain information, and to deal with and resolve requests and complaints related to data rights. 

Following the relevant retention period, personal data is deleted from storage. Copies of personal information may also remain for a limited time in the backup storage that we use to recover lost information in the event of an information loss event.

Security

We make reasonable efforts to protect your personal information by using physical and electronic safeguards designed to improve the security of the personal information we maintain. However, as no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your personal information. 

Children’s Privacy

This Children's Privacy Notice (“Children’s Privacy Notice”) is provided pursuant to the Children’s Online Privacy Protection Act (COPPA) to explain how Portola collects and uses personal information from users under 13 (“Children” or “Child”).

We do not process personal information from Children without the consent of the parent or legal guardian. We may collect the following information from your Child when they use our Services:

• ‍‍Account and Character Creation. When your Child creates an account with us, we ask your Child for their date of birth and parent’s phone number. Once you provide verifiable parental consent, your child can create a Tolan character, and we will receive your Child’s first name and the name your Child selects for their character.
• ‍Character Interactions. When your Child interacts with their character, we will receive your Child’s phone number; text and audio chats with their Tolan; and images or videos they choose to upload. 
• Communications. If your Child contacts us directly, we may receive personal information about your Child. For example, if your Child contacts us for customer support purposes, we may receive your Child’s name, email address, the contents of a message or attachments that your Child may send to us, and other information your Child chooses to provide. When your Child communicates with us, our vendors may receive and store these communications on our behalf.
• Location Information. When your Child uses our Services, we infer general geolocation information, for example, inferring the city or state, by using the device’s internet protocol (IP) address.
• Device Information. We receive information about the device and software your Child uses to access our Services, including IP address, device identifiers, persistent identifiers, web browser type, operating system version, phone carrier and manufacturer, and push notification tokens.
• Usage Information. To help us understand how your Child uses our Services and to help us improve it, we automatically receive information about your Child’s interactions with our Services like the pages or other content your Child views and the dates and times of your Child’s visits. 

We use the information we collect from your Child for the following purposes:

• To provide, maintain, improve, and enhance our Services;
• To personalize your Child’s experiences of our Services, such as by providing tailored content and recommendations;
• To understand and analyze how your Child uses our Services and develop new products, services, features, and functionality;
• To communicate with your Child, provide your Child with updates and other information relating to our Services, provide information that your Child requests, respond to comments and questions, and otherwise provide customer support;
• To send your Child push notifications;
• To generate deidentified or aggregated data containing only de-identified, non-personal information that we may use for any lawful purpose;
• To find and prevent fraud, and respond to trust and safety issues that may arise; and
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.

If your Child is located in Europe, we process your Child's personal information on the basis of consent, which must be given or authorized by the holder of parental responsibility over users under 13. We obtain your consent during the Child’s account creation flow. 

We disclose the information we collect from your Child in the following circumstances:

• Family Cottage Members. If your Child chooses to engage in the family cottage feature, your child’s first name will be visible to other family members in the cottage.
• Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services, such as IT, security or data hosting service providers. 
• AI Service Providers. We may disclose information we receive to vendors that provide artificial intelligence services that provide backend support for our Services. 
• Analytics Partners. We use analytics services such as Posthog to collect and process certain analytics data. These services may also collect information about your use of other websites, apps, and online resources. You can learn more about Posthog's practices by visiting https://posthog.com/privacy.
• As Required by Law and Similar Disclosures. We may access, preserve, and disclose your personal information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your personal information may occur if you post any objectionable content on or through our Services.
• Merger, Sale, or Other Asset Transfers. We may use, transfer, disclose, or otherwise process your personal information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company, or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected. 

We do not enable a Child to make personal information available to the public. 

Retention of Your Child’s Personal Information 
We retain your Child’s information for only as long as is reasonably necessary to fulfill the specific purposes for which the information was collected, after which we promptly delete such information, unless we are required by law to retain it for a longer period. For information about the purposes for which we collect personal information from Children and our business need for retaining such information, please see above. 

Requests to Access and Delete Your Child’s Information
‍If you would like to review or delete the personal information we have collected from your Child, withdraw your consent so that we stop collection or use of your Child’s information, or correct incorrect information about your Child, you can do so by going to Settings > Family in the application. 

‍Operator Contact Information 
If you have any questions about our processing of personal information described in this Children’s Privacy Notice, you can contact us at: 

AQP, Inc. (d/b/a Portola)
9450 SW Gemini Dr PMB 72216
Beaverton, Oregon 97008
privacy@portola.ai
(206) 210-3887

International Visitors

‍‍Our Services are hosted in the United States (“U.S.”). If you choose to use our Services from Europe or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the U.S. for storage and processing. We may transfer personal information from Europe to the U.S. and other third countries based on European Commission-approved Standard Contractual Clauses or UK Government-approved Standard Contractual Clauses, or otherwise in accordance with applicable data protection laws. Also, we may transfer your personal information from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating our Services. For more information about the tools that we use to transfer personal information, or to obtain a copy of the contractual safeguards we use for such transfers (if applicable), you can contact us as described below.

Delete Your Information

If you’d like to delete your information from the Services, please send us a message through the app with your request. If you do not have access to the app, please send us a message at support@tolans.com with your name, your Tolan's name, and the date of your last known app session.

Changes to This Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal information previously collected from you through our Services, we will notify you through our Services, by email, or other communication.

‍Contact Information

Portola is responsible and the data controller for processing your personal information. If you have any questions, comments, or concerns about our processing activities, please email us at privacy@portola.ai.

‍If you have any questions, comments, or concerns about our processing activities, please email us at privacy@portola.ai or write to us at:

‍
AQP, Inc. (d/b/a Portola)
9450 SW Gemini Dr PMB 72216
Beaverton, Oregon 97008
privacy@portola.ai
(206) 210-3887
‍

‍