Privacy Policy
This policy explains how Toda Labs Pte. Ltd., Singapore ("we"), handles personal data across meshlite.io, MeshLite demos, the customer console and related services. Customer agreements may provide additional terms for business use.
1. Information we process
- Visits and enquiries. We collect approximate location (derived from the IP address, which our visit statistics do not store), browser and device information, page activity, referral and campaign information, and technical events. If you contact us, we collect the name, email, company and message you provide.
- Server requests. To detect automated access and service errors, we record server request and network information, including for visits without JavaScript. We keep these records for up to seven days.
- Accounts and configuration. We store account and authentication details, avatar settings, personality instructions, reference content and usage records. Instructions and reference content may be sent to AI services to generate responses. If you connect your own voice service account, we process the credentials needed for that connection.
- AI interactions. Depending on the features you use, speech, AI and voice services process microphone audio, text and generated responses. Avatar rendering runs in your browser, while conversation processing uses network services. When audio diagnostics are enabled, we may store audio samples to investigate faults. Avoid sensitive or confidential information in public demos.
- Avatar materials. When you request a custom avatar, we process your photo and related materials to create, train and deliver it. Provide materials only where you have the necessary rights and permissions.
2. How we use information
We use this information to provide and administer services, respond to enquiries, maintain security, troubleshoot issues and understand service performance. We handle personal data under Singapore’s Personal Data Protection Act 2012 (PDPA), relying on consent or other grounds permitted by applicable law. Before using data for a new purpose, we provide notice and obtain consent where required by law.
When processing personal data on a business customer’s behalf, we follow its lawful instructions and our agreement, while retaining our own applicable legal obligations. Customers are responsible for appropriate notices to their users and any permissions required for their use of the service.
3. Cookies and microphone access
We use cookies and browser storage for language, authentication and service controls. Our visit statistics (Umami, hosted on our own server in Germany) use no cookie and no device fingerprinting; our team switches them off on its own devices with a browser setting. You can manage storage and microphone permission in your browser.
4. Service providers and sharing
We use hosting, storage, AI, speech, voice, email and font providers. They receive data needed for their services, including IP addresses when fonts load, and may process it outside Singapore. We protect overseas transfers as required by law.
We may disclose information as required by law or, where legally permitted, to protect legal rights or prevent abuse. We do not sell personal data or share it for advertising.
5. Retention and security
We keep personal data as long as needed for services, security, our business relationship or legal duties, including applicable backup periods. We then delete or anonymise it. We use reasonable safeguards and limit access to people who need it for their work.
6. Your choices and contact
You can browse without starting the Demo and can deny or revoke microphone access. For privacy questions, access or correction requests, withdrawal of consent, or deletion requests, contact dpo@todalabs.io.
Data Protection Officer: dpo@todalabs.io
Representative in the European Union and the United Kingdom: data@todalabs.io
We handle requests under applicable law, may verify your identity, and will explain any relevant service limitations or retention requirements. For services operated by a business customer, please contact that customer first about its processing of your data.
7. Children and policy updates
Our website and public demos are not directed at children. We update the effective date when this policy changes and provide additional notice where required.