Privacy Policy

Who operates Tokkii

Tokkii is operated by Tokkii LLC, based in New Jersey, United States. This policy covers our public website, creator and brand workspace, and connected publishing features.

Contact us about privacy at support@tokkii.com.

Information we collect

• Account and profile information: your email, authentication information, name, account role, biography, portfolio links, profile photo, and brand details.
• Partnership information: applications, contact details you provide to a brand, compensation offers, messages, uploaded videos, previews, creator notes, review decisions, and revision history.
• Connected accounts: social account identifiers and names, authorization tokens, permissions, selected ad accounts, publishing preferences, captions, post identifiers, processing results, and errors. We retrieve advertising performance data when you use the analytics features.
• Payment records: Stripe account identifiers, onboarding status, statements, payment status, and transaction references. Payment features currently operate in a test environment. Stripe-hosted forms collect payment and onboarding details directly; Tokkii does not collect full card numbers through its own forms.
• Technical information: IP addresses, browser/device information, request and security logs, and information needed to keep sign-in and uploads working. Hosting, authentication, email, and anti-abuse providers may process this information.
• Support: your contact information, correspondence, and any details you choose to include in a support or privacy request.

How we use information

We use information to create and secure accounts; connect creators and brands; deliver messages and videos; support review and revisions; carry out publishing actions you authorize; display performance and payment information; provide support; investigate errors, misuse, and disputes; and meet applicable obligations.

We use connected-account permissions for the features you authorize. Delivering a video to a brand does not itself publish it or launch an ad.

Who receives information

• Other Tokkii users: creators can view brand listings and offers. Brands can see information submitted by their applicants. Accepted partners can access their shared messages and submissions, including revisions. Treat information you send to a partner as information that partner can retain and use under your agreement.
• Service providers: Cloudflare supports hosting and anti-abuse checks; Supabase supports accounts, databases, and file storage; Resend supports transactional email; Google Workspace supports our business, support, and privacy-request email; and Stripe supports payment features. Our pages also load fonts from Google Fonts and app libraries from jsDelivr, which receive normal browser requests.
• Connected platforms: Meta, Instagram, and TikTok receive the content, account information, and instructions needed for the actions you authorize. They handle information under their own policies. Published content may become visible according to the settings you select.
• Other disclosures: information may be disclosed when required by law, to protect rights and security, or in connection with a business transfer, with any safeguards or notices required by applicable law.

Tokkii does not currently use additional analytics tools, advertising pixels, or marketing-email tools, or share customer data with external recipients beyond those described in this policy.

Shopify connections and order reporting

When a brand connects Shopify, Tokkii stores the store identifier, connection details, and encrypted authorization credentials. Shopify receives authorization and API requests needed to provide the connected features and handles information under its own policies.

When the brand requests a report, we retrieve order identifiers, creation times, test-order flags, payment and refund totals and, for attribution, available visit times, sources, and UTM parameters. We use this information to show aggregate store results and connect eligible orders to the brand's creator videos through its Meta ad mappings. This integration does not request customer names, email addresses, phone numbers, or postal addresses.

Raw orders and customer journeys are processed for the requested report and are not saved as report records. The browser receives aggregate results and creator, video, and ad identifiers. This integration does not install a storefront pixel or script; attribution uses journey information available from Shopify.

Disconnecting Shopify in Tokkii removes the stored Shopify authorization. Verified Shopify uninstall and shop-redaction notifications also remove the store connection. Customer privacy notifications are verified and handled without retaining the notification as a customer record. Disconnecting Tokkii does not itself uninstall the app from Shopify or delete Shopify's records. Contact support@tokkii.com for privacy requests concerning Tokkii; Shopify and the merchant handle requests concerning their own records.

Product samples and optional Shopify product import

Brands can offer sample products to their accepted creators. With optional Shopify product-read authorization, we retrieve catalog information and store the product and variant identifiers, titles, descriptions, images and links the brand chooses to import. Brands decide which offerings creators can request. Catalog import does not request Shopify customer names or addresses, create orders, or initiate fulfillment. Imported catalog information is a saved copy rather than a live inventory reservation.

When a creator requests a sample, Tokkii collects their recipient name and shipping address directly, their permission to share that address with the selected brand, and any note they provide. The brand sees the address after approving the request so it can arrange shipping. We store request status, product details, notes, carrier and tracking information to show the request history. We do not send these addresses to Shopify through the sample-request feature.

Shipping addresses are removed from active storage when a request is declined, cancelled, or marked received. Address access expires after 90 days, and expired records are removed by daily maintenance. Backup copies can follow separate retention schedules. Cancelling a request before shipment withdraws access to its stored address, but cannot erase copies a brand has already used for shipping. Request history and tracking information remain while needed to provide the service and handle support or disputes. Contact support@tokkii.com to request access, correction or deletion.

Disconnecting Shopify stops API access but keeps the selected sample offerings and request history in Tokkii. Verified Shopify uninstall or shop-redaction notifications remove imported offerings and their associated sample requests and addresses. Manually entered offerings are independent of Shopify. Brands can stop offering a product without cancelling requests already approved.

Browser storage and third-party requests

Tokkii uses browser storage for sign-in sessions, saved brands, connection verification, upload recovery, and publishing drafts or retries. Clearing this storage may sign you out or remove saved preferences and unfinished work. Hosting and anti-abuse services may use cookies or similar technologies for security.

Disconnecting a social account and clearing browser storage are different actions. Neither automatically removes content already published to a social platform.

How long information is kept

Crosspost video files are temporary. After both platforms succeed and no transfer remains active or unresolved, the file becomes eligible for cleanup, normally on the next five-minute maintenance run. Unfinished uploads normally become eligible after 24 hours; active or unresolved transfers may remain for up to 72 hours, with a short allowance for a running transfer. Failed cleanup is retried, so these are operational targets rather than guaranteed deletion times.

Publishing records remain separately. Captions, account identifiers, outcomes, and request records may remain after the video file is deleted so we can show history and avoid duplicate posts.

Brand submissions are different. Partnership videos, thumbnails, revision history, profiles, messages, and account records are not covered by Crosspost's temporary-file cleanup. They are retained while needed to provide the service and address requests, disputes, security, and legal obligations.

When handling an account-deletion request, we remove or anonymize information as appropriate, subject to justified retention and applicable law. Backup copies and records held by independent providers or partners may follow separate retention schedules. See Data deletion.

Your choices and rights

You can edit available profile fields, remove showcase videos, choose publishing settings, disconnect integrations, and contact us to request access, correction, export, or deletion. Depending on applicable law, you may also have rights to restrict or object to processing, withdraw consent, appeal a decision, or complain to a privacy regulator. We may need to verify ownership before acting.

Request handling: We monitor the contact inbox and verify account ownership before acting on requests. We aim to respond to and complete verified requests within 30 days of receipt, subject to applicable law and permitted exceptions. If additional time or limited retention is necessary, we explain the reason and next steps. Any shorter deadline required by law takes priority.

Security and international processing

We use access controls and private storage for nonpublic workspace content. Connected-account credentials are handled server-side. No online service can guarantee absolute security.

Our service providers may process information in countries other than yours. Where required, applicable safeguards and transfer rules must be followed.

Eligibility and changes

Minimum age: 18 years or older. Service availability: United States only.

We may update this policy as the service changes. The effective date identifies the current version. Where required, we will provide additional notice or obtain consent for material changes.