What we hold, and what we do with it.

Who this policy covers

Toile is an ERP and PLM platform a fashion brand runs its business in. Each brand has its own workspace; the brand decides what goes into it. This policy describes what the platform holds and how it handles it, for four kinds of people: the brand's own staff who sign in, the factory contacts the brand invites into its factory portal, the wholesale buyers and other business contacts the brand records, and the storefront customers whose orders reach the workspace through a connected sales channel, or whom the brand imports from its own store.

For the data inside a workspace, the brand is the controller and Toile processes it on the brand's instructions. For the account data of the people who sign in, Toile is the controller.

What we process

Accounts. Name, email address and role for each person who signs in. Sign-in runs through Firebase Authentication; the platform never stores a password.

Business contacts. For the wholesale accounts and contacts a brand records: name, role, email, phone, the consent source and any opt-out reason, and the notes and interaction history the brand's team writes about them.

Storefront customers. When a brand imports them from its connected Shopify store: name, email, phone, city, region and country, marketing consent and order totals, as described under The Shopify app below.

Orders. For an order that arrives from a connected channel (Shopify for the brand's storefront, Joor for wholesale): the buyer's name, delivery address and contact details as the channel sends them, the lines ordered, and the fulfilment and payment status the brand records.

Synced mail. A brand may connect its own mailbox. A message is stored only when a From, To or Cc address matches a contact the brand already holds, and that match runs on the headers before a message body is ever fetched — an unmatched sender's mail never reaches the platform. Attachments are never stored: only the filename, size and type are kept.

Factory portal. For the factory contacts a brand invites: name, email, the factory they belong to, and the production photos and progress updates they upload. Factory users see only the records shared with their factory.

Integration credentials. Tokens for the services a brand connects (its store, its mailbox, its chat workspace) are encrypted at rest with AES-256-GCM, bound to the workspace and user they belong to, and are never shown again after they are saved.

The Shopify app

A brand connects its Shopify store by installing the Toile app. The store owner sees Shopify's consent screen and approves exactly the permissions listed below; the platform requests nothing else. What flows in is the store's orders, and — only when someone in the brand starts an import — the store's customer list; what flows out is the brand's approved product catalogue, as draft products the store team reviews before publishing.

Imported storefront customers are kept as records of their own, apart from the brand's wholesale contacts, and listed beside the brand's CRM accounts, labelled Shopify: name, email, phone, city, region and country, email-marketing consent as the store records it, and order count and total spent. Never a street address. The platform emails these customers one thing only: an invitation to one of the brand's events, when the brand sends one, and only to customers the store records as subscribed to email marketing. Customers who are already among the brand's business contacts are invited as contacts instead. The brand's team can correct a customer's name, phone and location inside the platform, tag them, and export a selection as a spreadsheet; the email address and the consent stay as the store records them, and nothing is written back to the store.

Shopify's mandatory privacy webhooks are honoured. A customer redaction request from a store erases that customer's imported record in place straight away; a shop redaction request, sent after a store uninstalls the app, does the same for every customer imported from that store. Each request is verified and recorded in the workspace's audit ledger, without the customer's contact details, and put in front of the brand's administrator, who carries out any remaining export or erasure with the tools described below. When a store uninstalls the app, the connection is deactivated and recorded the same way.

read_orders

receive the store's order webhooks so a storefront order appears in the brand's order book

read_products

match a storefront line to the brand's own product record by SKU

write_products

publish approved products to the store as drafts — sizes, SKU, EAN, price, images, metafields

read_inventory

read stock levels to reconcile them with the brand's warehouse figures

write_inventory

set stock levels per location, and mark pushed products as inventory-tracked

read_locations

identify the store location stock levels are written to

read_customers

import the store's customers into the brand's CRM when the brand asks — name, email, phone, city and country, marketing consent and order totals — and, when the brand invites them to an event, email that invitation to the customers the store records as subscribed to email marketing

Where it is processed

The application runs on Google Cloud (Firebase): the API in the us-central1 region of the United States, with authentication, documents and files on the same Google Cloud project. Relational records — products, orders, contacts, stock — live in a Neon PostgreSQL database.

One AI feature is used: translating Italian technical terms on factory specification sheets (material and construction names) through Anthropic's API. Only the terms themselves are sent — never a person's name, contact details or order data.

Data also travels to the services a brand chooses to connect, under that service's own terms: its Shopify store, Joor, its Mattermost workspace, its own mail server, and the carriers it ships with (FedEx, UPS) for labels and tracking.

Retention and erasure

Business records are append-only by design: a correction creates a new version rather than overwriting the old one, and the audit ledger that records who changed what is never edited. Records are kept for the life of the brand's workspace.

Synced message bodies are kept for 24 months and then erased; the message headers and thread structure are kept beyond that so the record that an exchange happened survives.

A brand's administrator can produce a complete record of what the workspace holds about one contact, and erase it. The export names every source it read and any it could not. Erasure overwrites the personal fields in place, keeps the rows with a redaction stamp, and reports source by source what it redacted and what it could not reach. Audit and activity entries that name the person are not rewritten — they are part of the immutable ledger described above.

Security

Every request is authenticated and scoped to one workspace on the server; what a role may see or change is enforced there, not only in the interface. Traffic is encrypted in transit. Stored credentials are encrypted at rest as described above. Where each security commitment stands — audits, residency, backups, uptime — is kept honestly on the security page rather than restated here.

The legal particulars

Who you are dealing with

Lala Dynamics LLCLala Dynamics LLC operates the platform and is the controller for account data; for the data inside a workspace it acts on the brand's instructions. Its registered address is available from the contact below.

How to reach us about your data

contact@laladynamics.comWrite to contact@laladynamics.com for access, correction, erasure and complaint requests, and for questions about this policy. This is also the support address for the Toile Shopify app.

Legal bases

Contract · the brand's instructions · legitimate interest · consentProviding the ERP service to a brand and its staff accounts: performance of the contract with the brand. The brand's own contacts, orders and storefront customers: processed on the brand's documented instructions, under the legal basis the brand holds towards those people. Mail sync: on the brand's instruction, limited to correspondence with contacts the brand already holds (a message is stored only when a header matches a known contact). Keeping the append-only audit ledger and securing the platform: legitimate interest in the integrity of the record and of the service. Any marketing by Toile itself: consent, withdrawable at any time.

Storage regions by data class

Set per customerWhere a brand's data comes to rest is determined by the customer's location and the regulation that applies to it, and agreed when the workspace is set up. The application tier runs on Google Cloud in us-central1 today; the brand's own connected services hold their data under their own terms.

Supervisory authority

The data-protection authority where you liveYou may lodge a complaint with the data-protection authority of your country of residence, of your place of work, or of the place where you believe the matter arose. We would rather you write to us first, and we answer.