Toffu is an AI marketing agent that connects to your ad accounts (Google, Meta, LinkedIn), analytics platforms, and content channels. You delegate marketing tasks through natural language conversation.

How do AI agents connect to Toffu?

AI agents can connect via the MCP server at mcp.toffu.ai/mcp. Register with POST /agent/signup to get an API key, then add Toffu as an MCP server using the returned token.

Toffu can manage ad campaigns, pull performance analytics, generate marketing content, analyze competitors, create reports, and automate recurring marketing tasks across Google, Meta, and LinkedIn platforms.

Is there a free tier?

Yes, Toffu offers a free tier with 500 one-time credits to try the platform. Paid plans start at $100/month for individuals and $3,000/month for agencies.

Yes, Toffu is SOC 2 Type II compliant. Data is encrypted at rest and in transit, and we never train AI models on customer data.

Data Processing Agreement (DPA)

Last Updated: November 9, 2026

This Data Processing Agreement ("DPA") is incorporated into our Terms of Service and applies to all customers ("Controller" or "Customer") of Toffu AI, Inc. ("Processor" or "Toffu"). By using our services, you agree to the terms of this DPA. The Processor does not use Customer Personal Data or Customer Content to train, fine-tune, or improve any machine learning model, and accesses its large language model subprocessors over commercial APIs under which that data is not used for training (see Section 4).

1. Definitions

"Applicable Data Protection Law" means all laws and regulations, including GDPR, applicable to the Processing of Personal Data under the Main Agreement.
"Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Personal Data Breach" shall have the meanings given to them in GDPR.
"GDPR" means the General Data Protection Regulation (EU) 2016/679.
"Services" means the services provided by the Processor to the Controller under the Main Agreement.

2. Subject Matter and Scope of Processing

2.1. Nature and Purpose of Processing: The Processor will process Personal Data as necessary to provide the Services under the Main Agreement. The purpose of the Processing is to enable the Controller to use Toffu's AI-powered marketing platform to manage marketing strategies, create content, and engage customers.

2.2. Duration of Processing: The Processor will process Personal Data for the duration of the Main Agreement, unless otherwise agreed upon in writing.

2.3. Categories of Data Subjects: Data Subjects may include the Controller's employees, contractors, customers, and end-users.

2.4. Types of Personal Data:

Account Data: Names, email addresses.
Chat Data: User prompts, conversation history.
Content Data: Marketing content, website content, files, or other materials provided by the Controller.
Usage Data: IP addresses, device information, analytics data.
Any other Personal Data the Controller chooses to process through the Services.

3. Obligations of the Processor

The Processor agrees to:

3.1. Instructions: Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law.
3.2. Confidentiality: Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.3. Security: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption and regular security testing.
3.4. Sub-processing: Not engage any other processor ("Sub-processor") without the Controller's prior authorization. We maintain an up-to-date list of our Sub-processors here. We ensure any Sub-processor is bound by data protection obligations at least as protective as those in this DPA.
3.5. Data Subject Rights: Assist the Controller with appropriate measures to fulfill the Controller's obligation to respond to requests for exercising Data Subject's rights.
3.6. Personal Data Breaches: Notify the Controller without undue delay after becoming aware of a Personal Data Breach and provide sufficient information to allow the Controller to meet its notification obligations.
3.7. Data Protection Impact Assessments: Assist the Controller in ensuring compliance with its obligations regarding DPIAs and prior consultation with supervisory authorities.
3.8. Deletion or Return of Data: Upon termination of the Main Agreement, at the choice of the Controller, delete or return all Personal Data, unless law requires storage. Retention periods and the deletion process are set out in Section 9.
3.9. Audits: Make available to the Controller all information necessary to demonstrate compliance with this DPA.

4. AI Training and Model Improvement

4.1. No Training on Customer Data: The Processor shall not use Customer Personal Data or Customer Content to train, fine-tune, or improve any machine learning or artificial intelligence model, whether the Processor's own or that of any third party.

4.2. Subprocessor LLM Terms: The Processor accesses its large language model subprocessors over their commercial APIs, under which Customer Personal Data and Customer Content submitted for processing are not used to train or improve any model. The Processor has a zero data retention arrangement with Anthropic, under which Anthropic does not store API inputs and outputs after the response is returned, except where required by law or to combat misuse. For other providers, retention is governed by each provider's published API terms, which may allow retention of API inputs and outputs for a limited period for abuse monitoring. The Processor's primary large language model providers are Anthropic and Google (Vertex AI).

5. Obligations of the Controller

The Controller warrants that it has complied and will continue to comply with all Applicable Data Protection Laws in its use of the Services and that it has a valid legal basis for the Processing of Personal Data by the Processor.

6. Data Transfers

6.1. Location: Toffu AI, Inc. is a United States company. The Processor stores and processes Customer Personal Data primarily in the United States (AWS and MongoDB Atlas, region us-west-2, Oregon). The processing location of each Sub-processor is listed on the Sub-processors page.

6.2. Transfers from the EEA and Switzerland: Where Customer Personal Data subject to the GDPR is transferred to the Processor in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated into this DPA by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is itself a processor. Clause 7 (docking) applies; under Clause 9, Option 2 (general written authorization) applies, and changes are notified by updating the Sub-processors page; the optional wording in Clause 11 does not apply; under Clauses 17 and 18 the law and courts of Ireland apply. Annex I is completed by Section 2 of this DPA, Annex II by Section 3.3, and Annex III by the Sub-processors page. For Swiss data, references to the GDPR include the Swiss Federal Act on Data Protection.

6.3. Transfers from the United Kingdom: The International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies, with the parties' details and the selected clauses as set out in Section 6.2.

6.4. Transfers from Israel: Transfers of Customer Personal Data from a database in Israel are made under Regulation 2(4) of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. By this DPA the Processor undertakes in writing to comply with the conditions for holding and using data that apply to a database in Israel, to take adequate measures to protect the data, and not to transfer it to any third party other than the Sub-processors the Controller authorizes under Section 3.4, each bound by equivalent written terms.

6.5. Onward Transfers: The Processor transfers Customer Personal Data only to the Sub-processors listed on the Sub-processors page, under written agreements that include the Standard Contractual Clauses or another transfer mechanism recognized by Applicable Data Protection Law where one is required.

7. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Main Agreement.

8. Governing Law

This DPA shall be governed by the laws of the jurisdiction specified in the Main Agreement, except that the Standard Contractual Clauses are governed by the law stated in Section 6.2.

9. Retention and Deletion

9.1. During the Term: Customer Content, including conversations, reports, and files that contain data read from connected platforms, is kept for as long as the workspace is active, until the Controller removes it or requests its deletion. Credentials for a connected platform are stored encrypted and are deleted when the Controller disconnects that platform.

9.2. Deletion on Request or Termination: On a written request from a workspace administrator to security@toffu.ai, or on termination of the Main Agreement, the Processor permanently deletes the Customer Personal Data of the workspace within 30 days and confirms the deletion to the Controller in writing by email.

9.3. Backups and Logs: Database backups expire within 7 days, and earlier versions of deleted files are permanently removed within 7 days. Application logs are kept for 365 days for security and audit purposes and then deleted. Error-tracking events are kept for up to 90 days. Retention by AI model providers is set out in Section 4.2.

9.4. Per-Integration Retention: The Services do not apply an automatic retention period per connected platform. The Controller can disconnect a platform at any time and request deletion of the related Customer Content under Section 9.2.