TOKA AI PTY LTD — ABN 21 687 183 286
Privacy Policy
The short version
We collect data to make Toka work, not to sell ads or build profiles. We store your conversations to improve our services and your experience, but you can opt out or delete your data at any time. We don't share your information with anyone except the services required to run the platform. Payments are processed by Stripe, and sellers are verified by Stripe in order to be paid. Your listings are visible to other Toka users inside the app. Your data is stored in Australia, with limited exceptions: identity verification and payment data, which Stripe may process outside Australia, including in the United States (see Biometric and Face Data), and copies of listing images held in caches that make them load faster, which may sit outside Australia.
1
Who we are
Toka is a secondhand marketplace operated by TOKA AI PTY LTD (ABN 21 687 183 286), a company registered in Victoria, Australia.
The Toka platform (the "Platform") consists of a mobile application and associated web services available at https://www.gettokaapp.com. When this policy refers to "Toka", "we", "us" or "our", it means TOKA AI PTY LTD.
Privacy contact: Toka Support · support@gettokaapp.com
We are subject to the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained within it. This policy explains how we handle personal information in accordance with those obligations.
2
Scope of this policy
This policy applies to all personal information we collect through:
- The Toka mobile application (iOS and Android)
- Our website at gettokaapp.com
- Communications between you and Toka (including email, phone and in-app support)
- Interactions with our AI assistant within the Platform
This policy does not apply to third-party platforms or services that you access via links from Toka. Those services have their own privacy policies.
3
Information we collect
3.1 Information you give us
When you create an account or use the Platform, you may provide:
- Your name and email address (via Google or Apple sign-in, or email magic link)
- Your profile information, including any photos you choose to upload
- Listing details you submit as a seller: photos, descriptions, pricing, and location
- Photos of your space that you share with the Toka AI assistant for style recommendations
- Messages and conversations you have with the Toka AI assistant (Toka does not provide direct user-to-user messaging)
- Identity verification information submitted through our verification provider, Stripe
3.2 Information we collect automatically
When you use the Platform, we automatically collect certain technical and usage data:
- Device identifiers and operating system information
- App usage data: features used, screens visited, session duration, and interaction patterns
- Location, used to show you nearby listings (not precise GPS tracking) and other product related tasks
- Crash reports and error logs to help us identify and fix technical problems
- Conversational data for model improvement
- Basic fraud prevention signals derived from usage patterns
We use this information solely to operate and improve the Platform. We do not build advertising profiles or sell usage data to third parties.
3.3 Identity verification data
When you set up to sell, you are verified through our payment provider, Stripe, Inc., so that you can be paid. As part of this, Stripe may collect a government-issued identity document (e.g. driver's licence or passport) and a selfie or biometric facial comparison.
Toka does not store your identity document or biometric data. We receive only a verification result (verified or not verified) and a reference identifier from Stripe. Stripe processes your identity data on our behalf and, for fraud-prevention and security purposes, as an independent data controller. See the "Biometric and Face Data" section for full detail. Stripe's handling of your identity data is governed by Stripe's Privacy Policy.
3.4 Payment and transaction data
When you buy or sell on Toka, we collect information needed to process the transaction:
- Buyers, your card. Your card details are collected and processed by our payment provider, Stripe. Toka never stores full card numbers, and only ever sees a reference to your card plus the last few digits and card type. Apple Pay and Google Pay are not currently supported.
- Buyers, your card is saved for that order. Stripe stores your card so it can be used again for the same purchase without asking you to enter it again. The main reason is that a card hold only lasts about 7 days, so if your handover takes longer we place a fresh hold on the same card to keep your order alive. Terms and Conditions Section 7 explains this. Your saved card is not used for any other purchase unless you choose to use it.
- Transaction records. The item, the amounts paid and received, the buyer and seller involved, and confirmation of handover.
- Sellers, the details Stripe needs to pay you. These normally include your name, date of birth, address, and bank account details, and are collected by Stripe as a standard know-your-customer check. This happens when you publish a listing, so you are set up to receive payment before any offer arrives. If you created a listing before this was introduced, it happens the first time you go to sell. It is not required to create an account or draft a listing.
Money earned from a sale is held in the seller's own Stripe account, not by Toka. Toka receives the payout status and the amounts involved, not the contents of the seller's bank account.
3.5 Photos and images
Who can see them. Photos attached to a published listing are visible to other Toka users. To load quickly, they are served from a public web address, the way product images work on any online store. This means a published listing photo can be opened by someone who has its exact web address, even if they are not signed in to Toka. That address is long and randomly generated so it cannot be guessed, the images are not published on any web page and cannot be browsed, and we do not allow search engines to crawl or index them (Toka has no public web presence). In practice, a listing photo is only reachable by someone who is given its exact link.
Your profile picture is visible to other signed-in Toka users. Your profile picture, the photos you share privately with the Toka AI assistant (for example a photo of your room shared for style suggestions), and any photo still under review before its listing is published are not publicly reachable. They load only for a signed-in Toka account, through temporary links that expire after about 15 minutes, and someone who is not signed in cannot open them, even with the link.
Other Toka users can still screenshot or save a photo they can see, as in any app, so we recommend not including anything in a listing photo that identifies you or your address more precisely than you intend.
Caching, and why some copies sit outside Australia. To make images load quickly we use a content delivery network, which keeps copies of image data at locations closer to the person viewing it. Some of those locations are outside Australia. Caching changes where a copy of the image data is held; it does not change who is allowed to view it.
Moderation. All uploaded images are automatically screened for prohibited content before they can be attached to a listing.
4
Biometric and Face Data (Identity Verification)
This section explains how face data is collected, used, disclosed, shared, and retained when your identity is verified on Toka. Identity verification is carried out through our payment provider, Stripe, Inc. ("Stripe"), as part of setting sellers up to be paid.
What face data is collected. When you are verified as a seller, Stripe may capture a photograph of your face (a "selfie") and a photograph of your government-issued identity document. Stripe derives biometric identifiers, a mathematical representation of your facial geometry, from these images to confirm that the selfie matches the photograph on your identity document.
How face data is used. Face data is used for one purpose only: to verify your identity and to prevent fraud, impersonation, and scams on the Platform. Toka does not use face data for advertising, marketing, user profiling, or to train Toka's AI models, and Toka does not sell face data.
Who face data is shared with. Face data is collected and processed by Stripe as Toka's identity verification provider. Toka itself does not receive, view, or store your selfie, identity document, or biometric identifiers. Toka receives only the verification result (verified or not verified) and a reference identifier. Stripe processes this data on Toka's behalf and, for its own fraud-prevention and security purposes, as an independent data controller. Stripe's handling of your data is governed by Stripe's Privacy Policy.
Where face data is stored. Face data collected during identity verification is processed and stored by Stripe in the United States, regardless of where you are located. This is an exception to Toka's general practice of storing data in Australia.
How long face data is retained. The biometric identifiers generated during verification are removed from Stripe's systems within one year. Other submitted identity information (such as the document image) is typically retained by Stripe for approximately three years. Toka retains only the verification result and reference identifier for up to five years after your last verified transaction, for fraud-prevention and compliance purposes. You may request erasure of the data Stripe holds as an independent controller by emailing privacy@stripe.com, and you may request deletion of your Toka verification records by emailing support@gettokaapp.com.
5
How we use your information
To operate the marketplace
- Create and manage your account
- Display listings to buyers in your area
- Facilitate connections between buyers and sellers
- Coordinate transactions and logistics
- Process payments, complete handovers, and maintain records of your transactions
- Respond to your support requests
To power the Toka AI assistant
The Toka AI assistant reads listing details, your conversation history, and any photos you share to:
- Answer buyer questions on behalf of sellers, using information already provided in the listing
- Suggest items that match your style preferences or space requirements
- Guide you through buying or selling steps
We store your conversations with the AI assistant in de-identified form to improve the quality and accuracy of Toka's AI models over time. See Section 7 for details on retention and how to opt out.
To maintain trust and safety
- Verify user identities to reduce fraud and scams
- Block non-compliant conversational data to protect users and Toka
- Screen uploaded images for prohibited content before they appear on the Platform
- Analyse usage patterns to detect suspicious or bad-faith behaviour
- Enforce our Terms and Conditions, including our content and conduct rules
- Investigate and resolve disputes
To improve the Platform
- Analyse usage data to understand how the Platform is used
- Diagnose and fix technical issues
- Develop new features and improve existing ones
Legal and compliance
- Comply with applicable laws and regulations, including the Australian Privacy Act
- Respond to lawful requests from regulatory or law enforcement authorities
6
Who we share your information with
Toka is not in the business of selling or renting your personal information. We share data only in the following limited circumstances:
Other users of the Platform
When you list an item, your listing details (photos, description, price, and approximate location) are visible to other users. Once a sale is confirmed, precise location details are shared to complete logistics and delivery. Your profile name and verification status may also be visible. Your precise personal contact details are not shared automatically. Buyer questions are handled by the Toka AI assistant, which answers using the information in a listing and relays escalated questions to the seller. Toka does not provide a direct messaging channel between users.
"Other users" means people signed in to a Toka account. The listing itself can only be viewed inside the app by someone signed in to a Toka account, and listings are not published on the open web or indexed by search engines. Listing photos are the exception noted in Section 3.5: they are served from public web addresses and can be opened by anyone who has the exact link, though they are not browsable or indexed. Section 3.5 explains how listing photos are served.
Service providers
We use a small number of third-party service providers who process data on our behalf:
Stripe, Inc and Stripe Payments Australia Pty Ltd
Payment processing, identity verification, and seller payment accounts. Stripe processes payment and identity data under Stripe's Privacy Policy. Sellers who receive payments through Toka also agree to the Stripe Connected Account Agreement.
Google Cloud Platform (Australia region)
Cloud infrastructure, storage, AI services, and the content delivery network that serves images to the app. Data stored on Toka's own Google Cloud systems is held in Australian data centres. The content delivery network keeps cached copies of image data at edge locations, some of which are outside Australia, so that images load quickly for the person viewing them.
These providers are contractually bound to use your data only for the purpose of providing services to us, and to maintain appropriate security measures.
Legal requirements
We may disclose your information if we are required to do so by law, court order, or lawful request from a government authority. Where permitted, we will notify you before making such a disclosure.
Business transfers
If Toka is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.
7
Data retention
We retain your information for as long as it is necessary for the purposes described in this policy, or as required by law.
Account information
Retained while your account is active, and for up to 2 years after account closure for legal and fraud prevention purposes.
Listing data
Retained while the listing is active, plus 90 days after it is closed or removed.
Listing photos
A photo you delete, or that is rejected in moderation, stops being publicly served straight away. When a listing is sold or removed, its photos stop being publicly served within about 5 minutes, and their public web addresses and cached copies are cleared. If your account is deleted, your listing photos are taken out of public view and cleared from the cache as part of processing the deletion; an original copy may be kept in our private, non-public storage where we are required to keep it for legal or compliance reasons. Because photos are cached on devices to load faster, a copy already downloaded to someone's device or browser can remain there for up to a year, and we cannot reach onto someone's device to erase a copy they already have, or one another user saved or screenshotted.
Conversation data (with AI assistant)
Active conversations are retained for the duration of the relevant listings. De-identified conversation data used for AI model training may be retained indefinitely in anonymised form.
Identity verification results
Retained for up to 5 years after your last verified transaction, for fraud prevention and compliance purposes.
Transaction and financial records
Retained for 7 years, as required by Australian tax and corporations law.
Usage and analytics data
Retained for up to 12 months in identifiable form, then aggregated and anonymised.
AI training opt-out
You can opt out of having your de-identified conversations used to train Toka's AI models at any time by emailing support@gettokaapp.com. Opting out does not affect your use of the Platform.
8
Your rights
Under the Australian Privacy Act, you have the right to:
- Access the personal information we hold about you
- Request correction of information that is inaccurate, incomplete, or out of date
- Request deletion of your personal information (subject to legal obligations)
- Opt out of AI model training uses of your conversation data
- Complain about how we have handled your personal information
To exercise any of these rights, contact us at support@gettokaapp.com. We will respond within 30 days. In some cases, we may need to verify your identity before fulfilling a request.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
9
Deleting your account and data
You can request deletion of your Toka account and associated personal information at any time. To delete your account, use the in-app account deletion flow available in Settings.
Upon deletion, we will remove your personal information from our active systems within 30 days. This includes taking your listing photos out of public view and clearing them from the cache (see Section 7). Some information may be retained in anonymised or aggregated form, or where required by law (for example, transaction records for tax or legal compliance purposes).
10
Security
We take the security of your personal information seriously. Measures we take include:
- Data on Toka's own systems is stored on Google Cloud Platform in Australian data centres, using industry-standard encryption at rest and in transit. Payment and identity data processed by Stripe may be processed outside Australia, including in the United States, under Stripe's safeguards.
- Published listing photos are served from public, randomly-addressed web URLs (see Section 3.5); all other images, including profile pictures, private and in-review photos, are served only through links issued to a signed-in Toka account, which expire. Cached copies of image data held to speed up loading may sit at edge locations outside Australia, as described in Sections 3.5 and 6.
- Access to personal data is restricted to authorised team members who need it to perform their role
- Identity verification is handled by Stripe, a PCI DSS-compliant provider
- We monitor for unusual activity and maintain fraud detection systems
No method of electronic transmission or storage is 100% secure. If you become aware of a security concern related to your Toka account, please contact us immediately at support@gettokaapp.com.
11
Children and minimum age
Toka is not intended for use by anyone under the age of 16, and buying and selling on Toka is limited to people aged 18 and over. We do not knowingly collect personal information from users under 16, and we do not knowingly collect payment details or bank details from anyone under 18.
If you believe a user under 16 has created an account, or that someone under 18 is buying or selling on Toka, please contact us at support@gettokaapp.com and we will take appropriate action.
12
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Post the updated policy at gettokaapp.com/privacy
- Update the effective date at the top of this document
- Notify you via in-app notification or email where the changes are significant
Your continued use of the Platform after the effective date of an updated policy constitutes your acceptance of the changes.
13
Contact us
For any questions, requests, or complaints relating to this Privacy Policy or our handling of your personal information, please contact: