Privacy Policy

1. Introduction

Welcome to Tokia.ai, a service operated by JE Commerce Ventures LLC (“we,” “our,” or “us”). We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform that connects TikTok Shop sellers with affiliate marketers (the “Services”).

This Policy applies to all users of Tokia.ai, including sellers, affiliates, and visitors to our website. If you do not agree with our policies and practices described in this Policy, please do not use our Services.

Scope. This Policy covers personal information processed by Tokia.ai in our capacity as a data controller. It does not cover third-party services (such as TikTok and Stripe), which have their own privacy policies.

2. Interpretation and Definitions

2.1 Interpretation

Words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions have the same meaning regardless of whether they appear in singular or in plural.

2.2 Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access our Services or parts of our Services.
• Affiliate means a TikTok content creator participating in affiliate programs discoverable through the Platform.
• Company (referred to as either “the Company,” “We,” “Us,” or “Our” in this Policy) refers to JE Commerce Ventures LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States, operating the Tokia.ai platform.
• Cookies are small files that are placed on your computer, mobile device, or any other device by a website, containing details of your browsing history on that website among its many uses.
• Device means any device that can access the Services, such as a computer, a cell phone, or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service Provider means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Services, to provide the Services on behalf of the Company, to perform services related to the Services, or to assist the Company in analyzing how the Services are used.
• Services refers to the Tokia.ai platform, website, and related offerings provided by the Company.
• TikTok Data means any data, content, or information accessed by the Company through TikTok’s APIs or platform pursuant to authorization you provide.
• Usage Data refers to data collected automatically, either generated by the use of the Services or from the Services infrastructure itself (for example, the duration of a page visit).
• Web Beacons are small electronic files (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited certain pages or opened an email, and for other related website statistics.
• Website refers to Tokia.ai, accessible from https://tokia.ai.
• You means the individual accessing or using the Services, or the company or other legal entity on behalf of which such individual is accessing or using the Services, as applicable.

3. Information We Collect

We collect information in the following categories:

A. Information You Provide Directly

• Account Information: Name, email address, business name, password (stored as a salted hash), and profile information. If you sign up or sign in with Google, Google shares your name, email address and profile picture with us; we never receive your Google password
• TikTok Shop Information: Shop name, product listings, sales data, and performance metrics when you connect your TikTok Shop account
• Payment Information: Billing address and payment method details (processed securely through our payment providers; we do not store full card numbers)
• Communications: Information you provide when you contact our support team or participate in surveys

B. Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on platform, click patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies and Tracking: We use cookies and similar technologies as described in Section 12
• Log Data: Server logs that record access times, page views, and system activity
• Ad Click Information: If you come to our website from an ad, the identifier the ad platform adds to the link (for example, Google’s gclid or Meta’s fbclid) and the campaign tags in it (such as utm_source and utm_campaign), which we save with your account when you sign up. From November 3, 2026, if you arrive without such an identifier but the Google tag on our website (Section 12.2) has stored Google’s identifier from an earlier visit from one of our Google ads, we save that one instead, and if you sign up with your email address while the Google tag is running in your browser, we note that it was. When you create a workspace, we also record the country your connection comes from, whether your browser sent a Global Privacy Control signal or had ad measurement and remarketing turned off (Section 11.F) and, if you came from a Meta ad, your browser’s user agent

C. Information from Third Parties

• TikTok API Data: Public profile information, follower counts, engagement metrics, and shop performance data, accessed only with your explicit authorization, which you give on TikTok’s own authorization page
• Analytics Providers: Aggregated information about how you interact with our platform

D. Data Minimization Principle

We only collect information that is necessary to provide, maintain, and improve our Services. We do not collect sensitive personal data (such as government ID numbers, health information, or biometric data) unless expressly required and with your explicit consent.

4. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide our affiliate matching and campaign management Services
• Account Management: To create and manage your account, authenticate users, and provide customer support
• Matching Algorithm: To analyze data and match sellers with appropriate affiliates (see Section 13 for details on automated decision-making)
• Communication: To send service updates, respond to inquiries, and — with your consent — marketing communications
• Improvement: To analyze usage patterns and improve our platform features
• Advertising Measurement: To learn which of our ads bring new customers. If you came from an ad and then create an account, start a free trial or make your first payment, we tell that ad platform so it can count the result and improve how it delivers our ads (see Section 6.F)
• Legal Compliance: To comply with legal obligations and enforce our Terms of Service
• Security: To detect and prevent fraud, abuse, and security incidents

4.1 What We Do NOT Do

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal bases:

• Contract: Processing necessary to provide the Services you requested (e.g., account management, TikTok integration)
• Consent: Where you have given explicit consent (e.g., marketing emails, optional cookies, connecting your TikTok account)
• Legitimate Interests: For improving our Services, preventing fraud, and ensuring network security — balanced against your rights and interests
• Legal Obligation: Where processing is required to comply with applicable laws

You have the right to withdraw consent at any time where consent is the legal basis. See Section 11.

6. Information Sharing & Disclosure

We do not sell your personal information. We may share your information only in the limited circumstances described below.

A. With Your Consent

We share information when you explicitly authorize us to do so — for example, when connecting with affiliates through our Platform or integrating third-party services.

B. Service Providers (Sub-Processors)

We work with trusted third-party companies that help us provide our Services. All sub-processors are bound by written contracts requiring them to protect your information and use it only for the purposes we specify. Current categories include:

• Cloud hosting providers (e.g., AWS, Google Cloud) — infrastructure and data storage
• Payment processors (Stripe) — handling payment transactions under their own privacy policies
• AI providers (currently Anthropic) — drafting replies, answering common questions, plain-language creator search and Copilot; they process the messages and shop data involved only to do this for you
• Email service providers — transactional and marketing email delivery
• Analytics providers — platform performance and usage analytics
• Customer support tools — ticketing and helpdesk systems

A current list of material sub-processors is available on request from privacy@tokia.ai.

C. Business Transfers

If Tokia.ai (or JE Commerce Ventures LLC) is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users and ensure any successor entity honors this Privacy Policy or provides equivalent protection.

D. Legal Requirements

We may disclose information if we have a good-faith belief that such disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request
• Enforce our Terms of Service, including investigation of potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of Tokia.ai, our users, or the public

E. Aggregated or Anonymized Data

We may share aggregated or anonymized data that cannot reasonably be used to identify you for research, analytics, or business purposes.

F. Advertising Platforms

From November 3, 2026, our marketing pages and our sign-up and sign-in pages (not the Tokia app) load Google’s advertising tag, the Google tag. Through it, Google receives the address of each page you visit and the interactions the tag detects on it (such as scrolling, clicking a link or submitting a form), the identifiers in Google’s advertising cookies (Section 12.2) and the click identifier from one of our Google ads, and information about your browser and device, including the IP address your connection comes from, which Google receives with each request. When you create an account with your email address on our sign-up page, the tag also sends Google a hashed form of that address: before it leaves your browser, we turn the address into a fixed-length code (a SHA-256 hash), so Google receives the code and never the address itself.

When you come to our website from one of our Google ads, Google adds a click identifier to the link. If you then create an account, start a free trial or make your first payment, we send Google Ads that identifier, which of those events happened and when, a reference number for the event and, for a trial or payment, the plan’s monthly price. From November 3, 2026, we also send these reports if you signed up with your email address while the Google tag was running in your browser and did not come from an ad on that visit, and each report also carries a hashed form, made the same way, of the email address of the Tokia account that created the workspace, if that account was created on or after November 3, 2026 (except when the report’s only identifier is one of the two Google uses for some Apple devices, gbraid or wbraid, with which Google does not use it). We do not send your name, phone number, the email address itself or TikTok Data.

Google compares the hashed address with hashed addresses of signed-in Google accounts and of the sign-up its tag recorded, to tell which of our ads led to the sign-up, trial or payment. Google uses this information to report our ads’ results to us and to improve how it delivers our ads. It processes the hashed email address for this measurement on our behalf under the Google Ads Data Processing Terms, and it uses what its tag collects as described in How Google uses information from sites or apps that use our services and Google’s Privacy Policy. We do not use Google Analytics.

We also use the Google tag for remarketing: Google adds browsers that visit our marketing pages or our sign-up and sign-in pages to lists of our website’s visitors, so that we can show our ads to them again. Third-party vendors, including Google, show our ads on sites across the internet, and they use cookies to show ads based on your past visits to our website. You can opt out of Google’s use of cookies for personalized ads in Google’s Ads Settings, find other companies’ opt-outs on the Network Advertising Initiative’s opt-out page, and turn the Google tag off on our website in this browser (Section 11.F).

We may also use customer lists, through Google’s Customer Match. For accounts created on or after November 3, 2026, Google can add the hashed email addresses in the reports described above to lists in our Google Ads account, and we may upload a list of those accounts’ hashed email addresses ourselves. We share this customer data with Google to perform services on our behalf: Google compares the hashed addresses with those of signed-in Google accounts, so that we can show our ads to people who have a Tokia account, stop showing ads to them, or have Google find people like them. These lists never include TikTok Data, or accounts whose sign-up, trial and payment we do not report to ad platforms (see below and Section 11.F).

When you come to our website from one of our Meta ads (on Facebook or Instagram), Meta adds a click identifier to the link. If you then create an account, start a free trial or make your first payment, we send Meta that identifier, your browser’s user agent (which names your browser and operating system), which of those events happened and when, a reference number for the event and, for a trial or payment, the plan’s monthly price. We do not send your name, email address, phone number, IP address or TikTok Data. We ask Meta to apply its Limited Data Use option, under which Meta processes this information as a service provider for people in the US states that option covers. Meta uses this to report our ads’ results to us and to improve how it delivers them, as described in Meta’s Privacy Policy.

We do not load the Google tag for visitors whose connection our hosting provider places in the European Economic Area, the United Kingdom or Switzerland, in a browser sending a Global Privacy Control signal, or in a browser where ad measurement and remarketing are turned off (Section 11.F). If we cannot tell where you are, the tag loads with Google’s consent settings for those countries set to deny advertising cookies, ad personalization and the sending of user data, so for visitors Google places there it stores no advertising cookies, adds no one to our remarketing lists and sends no hashed email address. We do not send Google or Meta the sign-up, trial and payment reports described above for workspaces created from those countries, or from a browser that sent a Global Privacy Control signal or had ad measurement and remarketing turned off when the workspace was created. To opt out, see Section 11.F.

7. TikTok Data & API Usage

This section explains how we handle data accessed through TikTok’s APIs. We take TikTok data handling seriously and comply with the TikTok Developer Terms of Service, TikTok API Terms of Service, TikTok Data Use Policy, and TikTok Shop Developer Terms of Service.

7.1 Authorization

When you connect your TikTok Shop to Tokia.ai, you approve access on TikTok’s own authorization page:

• We access only the specific data scopes you authorize
• We do not store your TikTok password — authentication is handled entirely by TikTok
• OAuth access tokens are stored encrypted and refreshed only as long as authorization remains active

7.2 What We Access

Depending on the scopes you authorize, we may access:

• TikTok Shop data (products, orders, shop profile)
• Affiliate program information available to your account
• Creator marketplace data you are authorized to view
• Campaign and messaging data within TikTok’s permitted API scopes
• Performance metrics for affiliates participating in your campaigns

7.3 How We Use TikTok Data

• Purpose Limitation: Solely for providing the specific Services you authorized
• No Sale: TikTok Data is never sold, licensed, or rented
• No Ad Profiling: TikTok Data is not used to build advertising profiles or targeting segments
• No ML Training: TikTok Data is not used to train machine-learning models beyond the matching functionality you enabled
• Rate Limiting & Caching: We implement rate limiting and caching to minimize API calls and comply with TikTok’s rate limits

7.4 Revocation & Deletion

You may revoke our access to your TikTok data at any time by:

• Disconnecting your account within Tokia.ai settings, or
• Revoking the app in your TikTok account settings

Upon revocation, we will immediately stop accessing and using your TikTok Data. We keep TikTok Data only as long as we need it to provide the Services or as required by law, and promptly delete TikTok Data we no longer need.

Honoring TikTok User Deletions. If a TikTok user deletes their account or content on TikTok, or if TikTok instructs us to delete specific data, we will promptly delete the corresponding TikTok Data from our systems.

7.5 No Affiliation with TikTok

Tokia.ai is an independent platform. We are not affiliated with, endorsed by, sponsored by, or officially connected to TikTok, ByteDance, or any of their subsidiaries. References to TikTok trademarks are nominative only.

8. Data Retention

We retain your personal information only as long as necessary for the purposes described in this Policy or as required by law. In practice:

When we no longer need the data, we delete or anonymize it. Copies in backups are removed on our regular backup rotation.

9. Data Security & Breach Notification

9.1 Security Measures

We implement commercially reasonable technical and organizational measures to protect your information, including:

• Encryption: Data encrypted in transit (TLS 1.2 or higher) and at rest (AES-256)
• Access Controls: Role-based access control, multi-factor authentication for administrative access, and principle of least privilege
• Credential Protection: Passwords stored as salted hashes; OAuth tokens encrypted at rest
• Regular Audits: Security assessments, code reviews, and vulnerability testing
• Incident Response: Documented procedures for detecting, investigating, and responding to security incidents
• Employee Training: Regular security and privacy awareness training, with background checks for personnel with access to sensitive data
• Monitoring: Continuous logging and monitoring of access to systems handling personal data

9.2 Breach Notification

In the event of a security incident affecting your personal data or TikTok Data, we will:

• Notify affected users without undue delay, and in any case within 72 hours of becoming aware of the breach where required by applicable law
• Notify TikTok in accordance with the TikTok Developer Terms where TikTok Data is affected
• Notify relevant supervisory authorities as required by GDPR, state breach laws, or other applicable regulations
• Provide information about the nature of the breach, data affected, likely consequences, and mitigation steps

9.3 No System Is Perfectly Secure

While we strive to protect your information using industry-standard practices, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continually work to improve our safeguards.

10. International Data Transfers

Tokia.ai is operated from the United States. If you access our Services from outside the United States, your information will be transferred to, stored in, and processed in the United States or other countries where we or our service providers operate.

Safeguards for International Transfers. For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Addendum where applicable
• Supplementary measures such as encryption and access controls

You may request a copy of the relevant safeguards by contacting privacy@tokia.ai.

11. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

A. Access and Portability

You can request a copy of your personal data in a structured, commonly used, machine-readable format.

B. Correction

You can update or correct your information through your account settings or by contacting privacy@tokia.ai.

C. Deletion

You can request deletion of your account and personal data, subject to legal retention requirements (e.g., tax and financial records).

D. Restriction and Objection

You can request that we restrict certain processing or object to processing based on our legitimate interests.

E. Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.

F. Opt-Out Choices

• Marketing Emails: Use the unsubscribe link in any marketing email or email privacy@tokia.ai
• Cookies: Adjust your browser settings to refuse cookies
• Analytics: Use browser plugins (e.g., Google Analytics Opt-out) to opt out of analytics tracking
• Advertising Measurement and Remarketing: Use the button below to turn ad measurement and remarketing off in this browser, or back on. While they are off, the Google tag does not load on our website in this browser, so Google does not add it to our remarketing lists, and if you create your workspace in this browser, we will not report your sign-up, trial or payment to ad platforms or include your account in customer lists. A Global Privacy Control signal from your browser has the same effect. Your choice is saved in this browser only, so other browsers and devices keep their own, and clearing this site’s data in your browser turns them back on. To stop seeing personalized ads from Google, including ours, based on visits you have already made, use Google’s Ads Settings. You can also opt out at any time, including for a workspace you have already created, by emailing privacy@tokia.ai

G. GDPR Rights (EEA, UK, Switzerland)

If you are in the European Economic Area, United Kingdom, or Switzerland, you also have:

• Right to lodge a complaint with a supervisory authority
• Right not to be subject to solely automated decision-making with legal or similarly significant effects (see Section 13)

H. US State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive privacy law, you have rights that may include:

• Right to know what personal information is collected, used, and disclosed
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell personal information; the Google tag’s remarketing and the customer lists described in Section 6.F may count as sharing for cross-context behavioral advertising under some state laws, and you can opt out of them, and of the ad measurement described there, with the button in Section 11.F, a Global Privacy Control signal or an email to privacy@tokia.ai)
• Right to non-discrimination for exercising your rights
• Right to limit use of sensitive personal information (we do not collect sensitive personal information)

California residents: Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), you have the rights listed above. You may designate an authorized agent to make requests on your behalf.

I. How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@tokia.ai. We will respond within the timeframe required by applicable law (generally 30–45 days). We may need to verify your identity before processing your request.

12. Cookies & Tracking Technologies

We use cookies, web beacons, and similar technologies to:

• Maintain your session and authentication status
• Remember your preferences and settings
• Analyze platform usage and performance
• Provide personalized features
• Measure our ads and show them to people who visited our website (Section 12.2)

12.1 Tracking Technologies We Use

The technologies we use may include:

• Cookies (Browser Cookies). A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our Services may use cookies.
• Web Beacons. Certain sections of our Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email, and for other related website statistics (such as recording the popularity of a certain section and verifying system and server integrity).

12.2 Types of Cookies We Use

• Essential Cookies: Required for core platform functionality (authentication, security). These are Session and Persistent Cookies administered by us. Cannot be disabled.
• Analytics Cookies: Help us understand how users interact with our Services so we can improve them.
• Preference / Functionality Cookies: Remember your settings and choices (e.g., language, display preferences) to provide a more personal experience.
• Advertising Cookies: From November 3, 2026, the Google tag on our marketing pages and our sign-up and sign-in pages sets and reads Google’s advertising cookies on our domain. Their names begin with _gcl_ (for example, _gcl_au and _gcl_aw), they last 90 days, and the tag also keeps ad click information in your browser’s local storage (_gcl_ls). They record which of our Google ads brought you to our website, so that a sign-up can be credited to it, and Google uses them, along with advertising cookies on its own domains, to add your browser to our remarketing lists and show you our ads (Section 6.F). They are not set inside the Tokia app, for visitors from the European Economic Area, the United Kingdom or Switzerland, or in a browser that sends a Global Privacy Control signal or has ad measurement and remarketing turned off (Section 11.F). Google describes these cookies in Our advertising and measurement cookies.

12.3 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may impair platform functionality.

13. Automated Decision-Making

Our Platform uses an automated matching algorithm that analyzes seller and affiliate data to suggest potential partnerships. We want you to understand how this works.

13.1 How the Matching Algorithm Works

• The algorithm evaluates factors such as product category, audience alignment, historical performance, and engagement metrics
• It generates suggestions and rankings — it does not make final decisions or form binding contracts automatically
• All partnership decisions are made by you (the user) based on the information we provide

13.2 Your Rights Regarding Automated Processing

Because our algorithm produces suggestions rather than final decisions with legal or similarly significant effects, GDPR Article 22’s restrictions on solely-automated decision-making generally do not apply. However, you always have the right to:

• Request human review of any decision influenced by our algorithm
• Contest recommendations or outcomes you believe are inaccurate
• Request information about the logic involved in the matching process

To exercise these rights, contact privacy@tokia.ai.

14. Links to Other Websites

Our Services may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

15. Children’s Privacy

Tokia.ai is intended for business users and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18, and our Services are not available to them.

COPPA Compliance. In accordance with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If we discover that we have inadvertently collected personal information from a child under 13, we will delete it immediately.

If you believe we may have collected information from a child under 18, please contact privacy@tokia.ai so we can investigate and take appropriate action.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will:

• Post the updated Privacy Policy on this page
• Update the “Last Updated” date at the top of the Policy
• Let you know by email and/or a prominent notice on our Services before the change takes effect
• Obtain fresh consent where required by law for significant changes affecting your rights

Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy. If you do not agree with the changes, you must stop using the Services and may request deletion of your account.

17. Contact Us