Privacy Policy

Controller

The controller for this processing is the operator of Toxispy. Name, postal address and contact details have not been filled in here yet.

Pending legal review: Legal name, postal address, e-mail and — where Art. 37 GDPR applies — a data protection officer must be supplied. Deliberately not invented.

What data is processed

An analysis transmits exactly what the analysis needs:

• The text you select for analysis — in the simulator the article text you paste or open, in the browser extension the text of the active page or your selection.
• Optionally the headline of the text, because it changes how the rhetoric is judged.
• In the browser extension, additionally the address (URL) of the analysed page.
• The analysis settings: tolerance level and language. The model is fixed and cannot be chosen.
• Technical connection data produced by every server request: IP address, timestamp, user agent.
• If you use an account: the account data and the analyses linked to it.

What happens without your action — and what does not

The browser extension injects its script on all sites ("<all_urls>") so the analyse button is available everywhere. Page text is only read and transmitted once you start an analysis. Without consent and without a click, no page content leaves your browser.

The web interface collects anonymous performance data (OpenTelemetry: load times, errors, request durations) to detect outages. That data contains no article text.

Who processes the data

The processing chain is short, and in this order:

• 1. Toxispy backend (api.toxispy.com) — receives the text, stores the result and returns it to you.
• 2. AI gateway api.ai-ctrl.net — forwards the request to the model tied to the surface you used.
• 3. The model itself. There is no choice and no fallback chain: in the simulator: rhetoric-detector (Qwen3.5-27B), operated by Toxispy; in the browser extension: Gemini 2.5 Flash, operated by Google. Which model answered is recorded with every response.

Pending legal review: Data processing agreements under Art. 28 GDPR with the gateway operator and the model providers, plus server location / third-country transfer (Art. 44 ff. GDPR, standard contractual clauses), must be checked and named here. Specifically open: the country the models above are operated in — for the Google model a third-country transfer is likely, but it is not confirmed here.

Purpose

The text is processed solely to produce and display the analysis you asked for. Results are cached so the same analysis is not computed twice.

There is no advertising, no profiling for advertising purposes, and no sale of data.

Legal basis

Transmitting the text to a language model is based on your explicit consent, which you give before the first analysis and can withdraw at any time.

Pending legal review: The mapping of legal bases (Art. 6(1)(a) GDPR for the analysis, (b) for accounts, (f) for operational and security logs) and the handling of special categories under Art. 9 GDPR when users paste such texts need legal assessment.

Retention

Analysis results and the text they belong to are stored in our database until deleted. Server logs containing IP addresses are produced by normal operation.

Concrete retention periods have not been fixed yet.

Pending legal review: Binding deletion periods for analysed texts, results, logs and account data must be defined and stated here as numbers.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw a given consent at any time with effect for the future — directly in the web interface via "Withdraw consent".

You also have the right to lodge a complaint with a data protection supervisory authority.

Pending legal review: The contact route for data subject requests and the competent supervisory authority must be added (depends on the controller’s seat).

Browser extension

The extension stores your settings (tolerance level, model, highlighting) in local browser storage. Those settings never leave your device.

Permissions and why they are needed: "activeTab" and "scripting" to read the text of the active page and mark findings; "storage" for the settings; "contextMenus" for the right-click analyse entry; "downloads" to export a report; "webNavigation" to clear highlights when you navigate away.

Contact

No contact address for privacy questions and for exercising your rights has been filled in here yet.

Pending legal review: Add the contact address for privacy requests. Deliberately not invented.