Intergraph Networks LLP
Privacy Policy
How information moves through Toolisman—and the choices you have.
Last updated: October 31, 2026
Who we are
Toolisman is operated by Intergraph Networks LLP. This policy covers toolisman.com, its public documentation, and the Toolisman console, APIs, and MCP endpoint at app.toolisman.com. Contact hello@toolisman.com for privacy questions or requests.
What we receive
We receive your Intergraph account identifier and email when you sign in. When you connect a tool, we store the provider, verified account or tenant identifiers, account labels, authorization scopes, and the credentials or provider references needed to operate the connection. We also store executor connection information, permissions, consent records, and session-security information. Support messages include the contact information and content you send us.
Tool content and requested actions
An approved executor may ask Toolisman to search or read a connected service. Toolisman processes the query and requested content in memory to complete that request and returns the result to the executor. The first pilot is read-only. Toolisman does not persist tool message bodies, file contents, or search arguments in its invocation audit records. This does not mean the data never leaves the connected service: it passes through Toolisman and reaches the executor you authorize.
Who receives information
Your chosen executor and its provider receive the content returned for approved requests and handle it under their own terms and policies. When a consuming application is configured to use One, requests and returned content also pass through One, which holds the upstream tool credentials. With the native implementation, Toolisman calls the connected service directly. Choose executors and accounts with care; Toolisman cannot retract content already delivered to them.
Google user data
Google Drive and Gmail data is accessed only for the read actions you authorize and the user-facing features described here. Toolisman does not sell Google user data, use it for advertising, or use it to train generalized AI models. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. An executor’s connection does not provide permission for unrelated use of Google data. Google integrations remain subject to their pilot and verification requirements.
Infrastructure and operational records
We use infrastructure providers for hosting, database storage, identity, email, and operational security. Toolisman’s deployment is designed for Fly.io hosting, PostgreSQL storage, and Intergraph sign-in using Clerk-based identity infrastructure. These providers may process technical information such as IP addresses, browser details, and diagnostic records to deliver and protect their services. We may disclose information when required by applicable law or valid legal process, or to address abuse and security threats. Information may be processed outside your country.
Cookies and browser storage
The public website does not include advertising trackers, third-party marketing analytics, or nonessential cookies. The console and sign-in services use necessary cookies for sessions, login security, and account-connection callbacks. Blocking those cookies may prevent sign-in or connection setup. The public website does not read your console session or call authenticated tool APIs.
Retention and security
Toolisman encrypts retained upstream and browser authentication credentials, stores hashes of its executor tokens, and checks permissions on requests. Browser sessions last up to 24 hours; executor grants last up to 30 days, with shorter-lived access tokens and rotating refresh tokens. Invocation metadata is retained for 30 days and removed by scheduled cleanup; usage records are also bounded. Account, authorization, and grant records may be retained while needed to operate the service or handle security, support, and legal obligations. Backups and infrastructure records can follow separate retention schedules. No system is guaranteed completely secure.
Your choices
You can revoke an executor’s access, remove an individual tool connection, or disconnect an upstream authorization in the console. Logging out ends your browser session; it does not revoke independent executor grants. Disconnecting an upstream Google authorization can affect both Drive and Gmail. One may also require revocation in your One dashboard. These controls stop future authorized access but do not delete information already received by an executor or another provider.
Requests and policy updates
Depending on applicable law, you may have rights to request access, correction, deletion, or other handling of personal information. Contact hello@toolisman.com; we may need to verify your identity and account for applicable retention obligations. Do not send account passwords, OAuth tokens, or sensitive tool contents in a support email. We will update this policy as the service changes and show the revision date here.