Privacy Policy
Effective 2026-08-01
What personal data Tokolane collects in its own right, why, and what you can do about it.
Which hat we're wearing
As a controller — for merchant accounts, billing, and people browsing tokolane.com. That is what this policy covers.
As a processor — for the shopper data a merchant collects through their storefront. The merchant decides what happens to it; we only act on their instructions. If you bought something from a store hosted here, that merchant is your point of contact and their privacy policy applies. Our obligations to them are in the Data Processing Agreement.
What we collect as controller
| Data | Where it comes from | Why |
|---|---|---|
| Name, email address, password credentials | You, via our identity provider (Clerk) | Authenticating you and securing your account |
| Business name, address, contact details, tax status | You, during onboarding | Running your account, and publishing the trader details consumer law requires on your storefront |
| Identity and verification documents | Collected by Stripe, not by us | KYC/KYB. We receive only a pass/fail status, never the documents |
| Subscription and payment records | Our billing processor | Charging for your plan and meeting tax and accounting obligations |
| IP address, timestamp, terms version accepted | Your browser, at onboarding | Evidence of what you agreed to and when |
| Support correspondence | You | Answering you, and improving recurring answers |
| Server logs and error reports | Automatic | Keeping the service up, and investigating abuse and incidents |
What we don't collect
- Card numbers. Payment details go directly to Stripe and never touch our systems.
- Third-party advertising or cross-site tracking data. We run no ad networks and no analytics that follow you off the site.
- Special-category data. Don't send it to us; we have no basis to process it.
Legal bases (UK/EU GDPR)
- Contract — running your account and providing the service you signed up for.
- Legal obligation — tax, accounting, and responding to lawful requests.
- Legitimate interests — securing the platform, preventing fraud and abuse, and keeping records of consent. [Counsel: a balancing assessment should be documented for each.]
- Consent — only where we ask for it explicitly, and you can withdraw it at any time.
Who we share it with
Our sub-processors — hosting, database, authentication and payments — are listed with what each one does at Sub-processors. Beyond those we share personal data only when the law requires it, when we need to establish or defend a legal claim, or with your instruction. We do not sell personal data.
Where it lives
Application hosting is on Cloudflare's global network; the database runs in the region configured for the deployment. Where data leaves the UK or EEA we rely on the appropriate transfer safeguards. [Counsel: confirm the database region and attach Standard Contractual Clauses and the UK Addendum.]
How long we keep it
- Account and store data — while your account is open, then a stated export window before deletion.
- Terms acceptance records — for as long as the agreement could be relevant to a dispute.
- Billing records — as long as tax law requires.
- Server logs — a short rolling window.
[Counsel / engineering: fix the actual periods and state them here.]
Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict our use of your personal data, and to object to processing based on legitimate interests. California residents have equivalent rights, including the right not to be discriminated against for exercising them.
Exercise any of them by writing to privacy@tokolane.com. We will not charge you, and we will respond within the statutory period. If you are unhappy with our answer you can complain to your data protection authority — in the UK, the ICO.
Children
The platform is for businesses. It is not directed at children and we do not knowingly collect their data.
Changes and contact
We will post material changes here and, where they affect you significantly, tell merchants directly. Questions go to privacy@tokolane.com. [Counsel: name a data protection officer or an EU/UK representative if one is required.]