Privacy Policy

Towly is an identity provider. We collect the minimum data needed to run authentication and account services for you and your users.

What we collect

• Account details you provide: name, email address, company name, and password (stored as a salted hash, never in plain text).
• Authentication activity: sign-in times, authentication methods used, and device or browser information, used for security and fraud prevention.
• Support messages: anything you send us when you contact support.

How we use it

• To operate, maintain, and secure the service.
• To detect and prevent fraud, abuse, and unauthorized access.
• To communicate with you about your account, security events, and service changes.

Sharing

We share data only as needed to run the service, such as hosting infrastructure and email delivery, and when required by law. Every subprocessor is bound by confidentiality obligations.

Security

Data is encrypted in transit and at rest. Access to production systems is restricted to authorized personnel and protected by multi-factor authentication.

Retention

We keep account and authentication data while your account is active. When you close your account, we delete your personal data within 30 days, except where retention is required by law.

Your rights

You can request access to, correction of, or deletion of your personal data at any time by emailing hello@towly.ai. We respond to all requests within 30 days.

Changes

If we change this policy, we will update the effective date above and notify account owners by email for material changes.

Contact

Questions about this policy: hello@towly.ai.