Privacy Policy

This policy explains how Toda Labs Pte. Ltd., Singapore ("we"), handles personal data across meshlite.io, MeshLite demos, the customer console and related services. Customer agreements may provide additional terms for business use.

1. Information we process

• Visits and enquiries. We collect approximate location (derived from the IP address, which our visit statistics do not store), browser and device information, page activity, referral and campaign information, and technical events. If you contact us, we collect the name, email, company and message you provide.
• Demo email. Before your first conversation with the Demo, we ask for your work email address. We keep it with the company name suggested by its domain, the page language, your approximate country and the dates you gave it. It is stored on our own server in Germany.
• Server requests. To detect automated access and service errors, we record server request and network information, including for visits without JavaScript. We keep these records for up to seven days.
• Accounts and configuration. We store account and authentication details, avatar settings, personality instructions, reference content and usage records. Instructions and reference content may be sent to AI services to generate responses. If you connect your own voice service account, we process the credentials needed for that connection.
• AI interactions. Depending on the features you use, speech, AI and voice services process microphone audio, text and generated responses. Avatar rendering runs in your browser, while conversation processing uses network services. When audio diagnostics are enabled, we may store audio samples to investigate faults. Avoid sensitive or confidential information in public demos.
• Avatar materials. When you request a custom avatar, we process your photo and related materials to create, train and deliver it. Provide materials only where you have the necessary rights and permissions.

2. How we use information

We use this information to provide and administer services, respond to enquiries, maintain security, troubleshoot issues and understand service performance. We handle personal data under Singapore’s Personal Data Protection Act 2012 (PDPA), relying on consent or other grounds permitted by applicable law. Before using data for a new purpose, we provide notice and obtain consent where required by law.

Demo email. We use your work email to send you a recap of your demo, then at most one personal follow-up from our team, then occasional news no more than once a month. We stop after three messages without a reply, and every message has a one-click unsubscribe link. We never sell or rent this address, and never share it for anyone else’s marketing. Our email provider receives it only to send our messages. We do not use it to train AI models. For people in the European Union and the United Kingdom, this relies on our legitimate interest in presenting our services to businesses; you can object at any time, free of charge, by unsubscribing or by writing to dpo@todalabs.io.

When processing personal data on a business customer’s behalf, we follow its lawful instructions and our agreement, while retaining our own applicable legal obligations. Customers are responsible for appropriate notices to their users and any permissions required for their use of the service.

3. Cookies and microphone access

We use cookies and browser storage for language, authentication and service controls. Our visit statistics (Umami, hosted on our own server in Germany) use no cookie and no device fingerprinting; our team switches them off on its own devices with a browser setting. You can manage storage and microphone permission in your browser.

4. Service providers and sharing

We use hosting, storage, AI, speech, voice, email and font providers. They receive data needed for their services, including IP addresses when fonts load, and may process it outside Singapore. We protect overseas transfers as required by law.

We may disclose information as required by law or, where legally permitted, to protect legal rights or prevent abuse. We do not sell personal data or share it for advertising.

5. Retention and security

We keep personal data as long as needed for services, security, our business relationship or legal duties, including applicable backup periods. We then delete or anonymise it. Encrypted backups are kept for up to six months and are used only to restore the service after an incident. We delete a demo email three years after you last gave it to us; until then, an unsubscribed address is kept only so that we never write to it again. We use reasonable safeguards and limit access to people who need it for their work.

6. Your choices and contact

You can browse without starting the Demo and can deny or revoke microphone access. You can unsubscribe from our emails at any time with the link in each message. For privacy questions, access or correction requests, withdrawal of consent, or deletion requests, contact dpo@todalabs.io.

Data Protection Officer: dpo@todalabs.io

Representative in the European Union and the United Kingdom: data@todalabs.io

We handle requests under applicable law, may verify your identity, and will explain any relevant service limitations or retention requirements. For services operated by a business customer, please contact that customer first about its processing of your data.

7. Children and policy updates

Our website and public demos are not directed at children. We update the effective date when this policy changes and provide additional notice where required.