Privacy Notice

MJTOOLS (trading as MJTools), operator of HVAC Toolkit at toolhvac.com, is the data controller for the personal data described here: we decide what data is collected and why. For privacy questions or requests, email support@toolhvac.com.

Where our service providers process data only on our instructions, they act as processors. Our payment reseller Paddle acts as Merchant of Record and as an independent controller for order and tax data.

• Account data — email address, password credentials (stored hashed by our authentication provider), display name, company name, avatar, sign-in provider (email or Google). Purpose: creating and securing your account, signing you in, email verification and password resets. Basis: performance of our contract with you.
• Project content — the calculations, worksheets, drawings, uploaded CAD floor plans, equipment schedules, and cost data you create. Purpose: providing the Service and storing your work so you can return to it. Basis: performance of our contract.
• Subscription and entitlement data — plan, trial start, subscription status, renewal dates, seat counts, and the identifiers your order carries from Paddle (subscription and customer IDs, product and price IDs, amounts, invoice status). Purpose: granting the right access, showing your plan and payment history, and supporting you. Basis: performance of our contract and our legal obligation to keep accounting records. We do not receive or store your full card number.
• Team data — team name, roster, and the email addresses of colleagues you invite. Purpose: operating shared Pro access and sending invitation emails. Basis: performance of our contract and our legitimate interest in operating team features. Only invite people who expect to hear from you.
• AI diagnosis inputs — the fault descriptions and system readings you submit, plus a daily usage counter. Purpose: generating suggestions and enforcing fair-use limits. Basis: performance of our contract. Please do not include personal data about third parties in these prompts.
• Support messages — the content of emails and requests you send us. Purpose: answering you and keeping a record of the issue. Basis: performance of our contract and our legitimate interest in supporting users.
• Technical and usage data — IP address, device and browser information, pages and features used, error and performance logs, email delivery events (bounces, complaints, unsubscribes). Purpose: security and fraud prevention, abuse and rate-limit enforcement, debugging, and improving the product. Basis: our legitimate interests in a secure, working service.
• Language and unit preferences (English/Arabic, imperial/metric) stored in your browser. Purpose: remembering your choices. Basis: performance of our contract.

We do not sell personal data, we do not run advertising profiling, and we do not use your project content to train third-party AI models.

• Merchant of Record — Paddle.com: Paddle is the reseller and Merchant of Record for all our orders. It handles checkout, payments, subscription management, tax compliance, invoicing, refunds, and order-related customer service, and receives the data needed for that (such as your email, billing country, and purchase details).
• Infrastructure and hosting providers — application hosting, database, file storage, and authentication services that store your account, project, and subscription data on our behalf.
• Email delivery — the provider that sends verification, password reset, invitation, and notification emails from our sender domain.
• AI model provider — the provider that processes your diagnosis prompts to return suggestions.
• Professional advisers — accountants and legal advisers, where needed.
• Authorities — where disclosure is required by law, or to establish, exercise, or defend legal claims.

Our providers may process data outside your country, including in the EU/EEA and the United States. Where data leaves the UK/EEA we rely on appropriate safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses, together with technical measures like encryption in transit.

Account, project, and team data is kept for as long as your account is active. If you delete your account or ask us to delete your data, we remove or anonymise it within 30 days, except where we must keep it longer: order and tax records held for statutory accounting periods (typically up to 10 years, largely by Paddle), security and abuse logs for up to 12 months, and email suppression records kept by our email provider so we do not mail addresses that bounced or opted out. When data is no longer needed for these purposes it is deleted or anonymised.

Subject to the law that applies to you, you can ask us to: give you access to your personal data; correct inaccurate data; delete your data; restrict or object to processing (including processing based on our legitimate interests); provide your data in a portable format; and withdraw consent where we relied on it. You can export your worksheets and drawings from the app at any time.

Email support@toolhvac.com to exercise a right. We respond within one month. If you are in the UK or EEA and are not satisfied, you can complain to your local data protection supervisory authority.

We apply appropriate technical and organisational measures to protect personal data: encrypted transport (HTTPS), encryption at rest by our hosting provider, hashed passwords, row-level database access rules so users can only reach their own records, role-restricted administrative access, verified payment webhooks, and server-side enforcement of plan entitlements. No system is perfectly secure; if a breach affects your data and the law requires it, we will notify you and the relevant authority.

We use only essential cookies and browser storage: a session cookie/token that keeps you signed in, security tokens that protect sign-in and checkout, and local storage for your language, unit system, saved worksheets, and drawings. We do not use advertising or third-party tracking cookies. Paddle may set cookies needed to run checkout securely on its own pages. You can clear cookies and local storage in your browser settings, though this will sign you out and remove locally saved preferences and drafts.

HVAC Toolkit is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16.

We may update this notice. The date at the top shows the latest version, and we will announce material changes in the app or by email.