Privacy Policy

This Privacy Policy explains how Tokkae (“Tokkae”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal information when you use the Tokkae website at tokkae.com, our seller and buyer mobile applications, storefront pages, the Tokkae AI assistant that replies to buyer messages on Facebook Messenger and Telegram, and any related services (collectively, the “Service”).

Tokkae is an online marketplace and seller tooling platform based in Cambodia. We act as a “data controller” for account information you provide directly, and as a “data processor” on behalf of sellers for the buyer conversations routed through our platform. By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Who this policy covers

• Visitors — anyone who visits tokkae.com, including people who join the waitlist.
• Buyers — people who browse the marketplace, create accounts, place orders, or message sellers through Facebook Messenger, Telegram, or in-app chat.
• Sellers — individuals or businesses who create shops on Tokkae, list products, connect messaging channels, and use the AI assistant.

2. Information we collect

2.1 Information you provide

• Account details: name, email, password (stored as a secure hash), phone number, and profile picture.
• Shipping and billing addresses, including location coordinates you pin on a map.
• Order history, items in your cart, saved items, and reviews you post.
• Seller shop details: shop name, slug, logo, banner, description, product catalog (titles, descriptions, prices, images, categories, stock), AI personality and rules.
• Waitlist signups (email address and locale).
• Messages and attachments you send through the platform, and communications with our support team.

2.2 Information from connected accounts (Facebook Login, Messenger, Pages API, Telegram, Google)

If you sign in using Google, Facebook, or Telegram, or connect one of these services to your shop, we receive the data listed below. We request the minimum permissions needed to operate the Service; each permission maps to a specific purpose:

We do not request or access: your Facebook friends list, your posts or photos on Facebook, other Pages you do not choose to connect, Instagram content not associated with a connected Page, Telegram chats other than those sent to a connected bot, or Google Drive, Calendar, or Gmail data.

2.3 Information collected automatically

• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, pages viewed, timestamps, and crash diagnostics.
• Analytics events produced by Vercel Analytics and Vercel Speed Insights about page performance and usage. These services use privacy-friendly measurement and do not rely on cross-site advertising identifiers.
• Cookies and similar technologies strictly necessary for authentication, session management, cart persistence, and language preference. We do not use advertising cookies.

2.4 Information we do not collect

We do not collect payment card numbers or bank account details. Payments, where offered, are handled by licensed third-party payment processors; we receive only a transaction reference, status, and the last four digits of the card or bank reference.

3. How we use information

• Provide, operate, maintain, and improve the Service.
• Authenticate users and keep accounts secure.
• Display product listings, process orders, arrange fulfilment, and enable seller-buyer communication.
• Generate AI replies on sellers’ behalf. Message content is sent to our AI provider (currently OpenAI) solely to generate a contextual response. See Section 4.
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
• Communicate with you about the Service (order updates, security alerts, service announcements, support replies).
• With your consent or where permitted by law, send you marketing updates. You can unsubscribe at any time.
• Comply with legal obligations and enforce our agreements.
• Produce aggregated, de-identified analytics that do not identify any individual.

We do not sell personal information. We do not use buyer message content to train general-purpose AI models. We do not use personal information for third-party advertising.

3.1 Legal bases for processing

Where applicable law requires a legal basis for processing (including the EU / UK General Data Protection Regulation for users in those regions, and Article 32 of the Cambodia Law on Electronic Commerce which requires express consent), we rely on the following bases:

• Performance of a contract — to deliver the Service you signed up for (account creation, order fulfilment, message delivery, AI replies).
• Consent — for connecting a Facebook Page, Telegram bot, or Google account, for marketing emails, and for any processing not covered by another basis. You can withdraw consent at any time.
• Legitimate interests — to keep the Service secure, detect fraud and abuse, and improve our products. We balance these interests against your rights and freedoms.
• Legal obligation — to meet tax, accounting, anti-fraud, and consumer-protection requirements under applicable Cambodian and international law.

4. Third-party service providers

We share personal information with service providers only as necessary to operate the Service:

• Meta Platforms, Inc. — Facebook Login, Messenger Platform, Pages API, Graph API.
• Telegram FZ-LLC — Bot API for the Telegram messaging channel.
• Google LLC — Google Sign-In and Google Maps (address selection).
• OpenAI, L.L.C. — generates AI replies to buyer messages. Under OpenAI’s API data policy, API inputs and outputs are not used to train their models by default; we do not opt in to training.
• Supabase, Inc. — managed PostgreSQL database, authentication, and file storage.
• Vercel Inc. — hosts tokkae.com, provides Analytics and Speed Insights.
• DigitalOcean, LLC — hosts our backend APIs.
• Our own media upload pipeline (backed by Supabase Storage) — storage of product images and videos.
• Resend / email delivery provider — transactional and account emails.
• Licensed payment processors (introduced at launch) — process payments when checkout goes live. Details will be disclosed in-app at checkout.

We may also share information (i) to comply with applicable law, legal process, or binding government requests; (ii) to enforce our Terms of Service; (iii) to protect the rights, safety, or property of Tokkae, our users, or the public; or (iv) in connection with a merger, acquisition, or sale of assets, subject to confidentiality protections and notice to affected users.

5. Data retention

We retain personal information only as long as necessary for the purposes described in this Policy or as required by law.

• Account data: retained for the life of the account and for up to 90 days after deletion to allow recovery and to meet legal, tax, or accounting obligations.
• Conversation and message data: retained while the connected channel is active; deleted within 90 days of channel disconnection or account deletion.
• Order and transaction records: retained for the period required by applicable tax and commercial law (typically up to 10 years).
• Product catalog and shop data: deleted within 30 days of account deletion.
• Backups and logs: purged on rolling schedules not exceeding 12 months.
• Waitlist signups: retained until launch notification is sent or you request deletion, whichever comes first.

6. Security

We use industry-standard technical and organizational safeguards including TLS in transit, AES-256-GCM encryption at rest for credentials and platform tokens, role-based access controls, row-level security on our database, and access monitoring. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

7. Your rights and choices

We extend the following rights to all users of the Service, regardless of where you are located and regardless of whether local law requires us to do so:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request that we delete your personal information.
• Withdraw consent — disconnect a Facebook Page, Telegram bot, or Google account at any time from in-app settings.
• Object or restrict — object to or restrict certain processing.
• Data portability — obtain a copy of your data in a structured, commonly-used format.
• Human review of automated decisions— request a human seller reply to any Messenger or Telegram conversation, or ask for any automated reply to be re-reviewed by a human.
• Complain — lodge a complaint with a competent data-protection authority or the National Committee for Consumer Protection of Cambodia.

To exercise any of these rights, contact us at [email protected]. We respond to verified requests within 30 days.

8. User data deletion

You can request deletion of personal information we hold about you at any time. See our dedicated Data Deletion Instructions page for the step-by-step process, including how to revoke Tokkae’s access from your Facebook account.

9. Automated experience and the AI assistant

A core feature of the Service is an AI assistant that replies to buyer messages on a seller’s connected Facebook Messenger or Telegram bot. In compliance with the Messenger Platform Policy and the transparency principles of the EU AI Act (Article 50) and equivalent regional norms, we disclose the following:

• You are interacting with an automated experience. When you open a new conversation with a Tokkae-connected Page or Telegram bot, or after a significant lapse of time in an existing conversation, the AI assistant will identify itself as automated.
• Human handoff is always available. You can ask to speak to the seller at any time. The seller can also take over the conversation at any moment.
• Message content is sent to OpenAI solely to generate the reply. OpenAI does not train its models on API inputs or outputs by default, and we have not opted in to training. Per OpenAI’s API data-usage policy, API requests may be retained for up to 30 days for abuse and misuse monitoring only, after which they are deleted (unless legally required to be retained).
• Standard Messaging 24-hour window. On Messenger, promotional or non-transactional outreach from a seller may only occur within 24 hours of your last message to that Page, in accordance with Meta’s Standard Messaging rules. Outside the 24-hour window, we send only the limited message types permitted by Meta’s message-tag rules (e.g. order updates).
• AI replies can be wrong. AI-generated answers are probabilistic and may be inaccurate. They are not a binding offer, quote, contract, or legal or professional advice. Always confirm price, stock, and terms with the seller before relying on them.

You can review or revoke Tokkae’s Facebook access at Facebook Settings → Business Integrations.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Sellers must be at least 18 years old (or the age of majority in their jurisdiction) to create an account. If you believe a child has provided us with personal information, contact us and we will delete it.

11. International data transfers

Our service providers may process personal information outside Cambodia, including in the United States, European Economic Area, and Singapore. Where required by law, we rely on appropriate safeguards such as standard contractual clauses to protect cross-border transfers.

12. Cambodia-specific information

Tokkae is based in Cambodia. As of the effective date of this Policy, the Kingdom of Cambodia has not yet enacted a general personal-data-protection statute. A draft Law on Personal Data Protection prepared by the Ministry of Post and Telecommunications was published on 23 July 2025 and remains under consultation. In the interim, we process personal data under Article 32 of the Law on Electronic Commerce (promulgated by Royal Kram NS/RKM/1119/017, 2 November 2019), which requires express consent for the collection and use of personal data, and under the Law on Consumer Protection (promulgated 2 November 2019).

By using the Service, you expressly consent to the collection, processing, storage, and cross-border transfer of your personal data as described in this Policy. You can withdraw your consent at any time by deleting your account or by contacting us at [email protected]. Complaints may be directed to the National Committee for Consumer Protection (NCCP/CCF) of the Ministry of Commerce.

A Khmer-language version of this Policy is available on request and will be provided publicly prior to the Service’s public launch, in line with the Law on Consumer Protection. In the event of any inconsistency between the English and Khmer versions, the English version controls unless local law requires otherwise.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective date” at the top of the page shows the latest revision. Material changes will be notified by email or in-app message before they take effect. Continued use of the Service after an update means acceptance of the revised policy.

14. Contact us

If you have questions about this Privacy Policy or our handling of your personal information, contact:

ភាសាខ្មែរ: A Khmer-language translation of this Privacy Policy is available on request from [email protected].