Privacy Policy

Effective date: 20 May 2025

1. Who we are

TokPortal – (SIRET 884 450 297 00038), a French micro‑enterprise with its registered office at 14 Boulevard Saint-Germain, 75006 Paris, France ("TokPortal", "we", "our" or "us"), operates the websites tokportal.com and app.tokportal.com (together the "Platform"). For the purposes of European Union data‑protection law, TokPortal is the data controller of the personal data described in this Privacy Policy.

Contact e‑mail for privacy matters: team@tokportal.com (or write to us at the postal address above, marked "Data Protection").

If you are located in the European Economic Area ("EEA"), United Kingdom or Switzerland, you also have the right to lodge a complaint with your local supervisory authority. In France, this is the CNIL (www.cnil.fr).

2. Scope of this Policy

This Privacy Policy explains how we collect, use, disclose and otherwise process personal data about:

• Clients who post Listings ("video listings", "account listings", or combined "listing bundles") on the Platform;
• Account Managers ("CMs") who accept and fulfil those missions; and
• Visitors who browse any TokPortal site.

It does not cover third‑party websites or services (including social‑media platforms such as TikTok, Stripe, or external analytics providers) that are not under our control.

3. Personal data we collect

Below is an overview of the personal data we process and the source of each item. We have removed all tables for easier copy‑and‑paste.

3.1 Account Information (provided by you)

• Name, username/handle and password hash.
• Email address.
• Optional profile photo.

3.2 Identity & Business Data – Account Managers only (provided by you or our ID‑verification partner)

• Date of birth (you must be 18 +).
• Government identification (e.g., passport or national ID).
• Business registration details, VAT/SIRET number.
• Portfolio links or résumé.

3.3 Payment & Payout Data (processed by Stripe on our behalf)

• Last four digits of payment card and billing address supplied by Clients.
• Payout bank details supplied by Account Managers.
• Stripe transaction tokens (TokPortal never stores full card numbers).

3.4 Listing / Mission Content (provided by Clients)

• Text descriptions and instructions.
• Video files and thumbnails.
• TikTok credentials or access tokens generated for the mission.

3.5 Communications (generated or provided by you)

• Messages exchanged via the Platform chat.
• Support tickets and feedback forms.

3.6 Usage & Device Data (collected automatically)

• IP address and approximate location.
• Browser type and operating system.
• Referral URL, timestamps and clickstream data.

3.7 Cookie & Tracking Data (collected automatically — see § 5)

• Session and authentication cookies.
• Stripe cookies required for secure payments.
• Audience‑measurement cookies (e.g., Plausible, Google Analytics).

We do not intentionally collect protected classifications (race, religion, health) or data about children.

4. How and why we use personal data (legal bases)

Under the EU General Data Protection Regulation (GDPR), we rely on different legal bases depending on the purpose, as outlined below — again with no tables for easy re‑use:

• Create and manage your TokPortal account, authenticate you – Contract performance (GDPR Art 6 (1)(b)).
• Enable Clients to post Listings and engage Account Managers – Contract performance.
• Process payments from Clients and payouts to Account Managers via Stripe – Contract performance and legal obligation (tax and accounting compliance).
• Provide customer support and resolve disputes – Contract performance and our legitimate interest in ensuring service quality.
• Send transactional e‑mails and service notices – Contract performance.
• Improve and secure the Platform, monitor trends, fight fraud and abuse – Legitimate interests (GDPR Art 6 (1)(f)) in operating a reliable, secure marketplace.
• Send marketing e‑mails or newsletters – Consent (GDPR Art 6 (1)(a)); you can withdraw consent at any time.
• Comply with laws, court orders or law‑enforcement requests – Legal obligation (GDPR Art 6 (1)(c)).

5. Cookies & similar technologies

We use cookies and local‑storage objects to:

• keep you logged in;
• remember preferences;
• enable secure payments (Stripe);
• perform audience analytics.

You can control cookies via your browser and, where required by law, we display a cookie banner to obtain consent for non‑essential cookies.

6. Sharing & disclosure of data

We share personal data only as necessary:

1. With other Users – When a Client posts a Listing, the Listing content and username are visible to prospective Account Managers. Conversely, when an Account Manager accepts a mission, the Client can view the Account Manager’s profile and communications.
2. Service Providers – Hosting (OVH / Scaleway), payment processing (Stripe Payments Europe Ltd), analytics, e‑mail delivery, ID verification. These processors are bound by written contracts and may process data only on our instructions.
3. Legal & Safety – Authorities, courts or third parties when required to comply with law, enforce our Terms or protect rights, property or safety of TokPortal, our users or the public.
4. Business Transfers – In connection with a merger, acquisition or sale of assets, subject to confidentiality safeguards.

We do not sell or rent personal data.

7. International transfers

Our servers are located in France, but some service providers (e.g., Stripe, analytics) may process data in the United States or other third countries. Where we transfer personal data outside the EEA, we rely on:

• an adequacy decision by the European Commission; or
• Standard Contractual Clauses (SCCs) plus additional safeguards.

8. Data retention

We keep personal data only for as long as necessary:

• Account data – while your account is active and for up to 5 years thereafter (statute of limitations for contractual claims).
• Transaction records & invoices – 10 years (French accounting law).
• Support tickets & communications – 3 years after closure.
• Cookies – see § 5 (session vs. persistent).

You may delete your account at any time in the dashboard or by contacting us. Certain records (payments, invoices) may need to be retained for legal reasons.

9. Security

We implement industry‑standard technical and organisational measures including, but not limited to:

• data encryption in transit (TLS 1.2+);
• hashed & salted passwords (Argon2 / bcrypt);
• least‑privilege access controls;
• regular security audits & penetration tests;
• incident‑response procedures.

No online service is 100 % secure, but we strive to protect your data.

10. Children’s privacy

TokPortal is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from minors. If you believe we have done so, please contact us so we can delete the information.

11. Your rights

11.1 EU / EEA residents (GDPR)

You have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Erase data ("right to be forgotten");
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time (for marketing);
• Lodge a complaint with a supervisory authority (e.g., CNIL).

11.2 California residents (CCPA / CPRA)

You have the right to:

• Know which categories of personal information we collect and disclose;
• Request deletion of personal information (subject to exemptions);
• Opt‑out of the sale or sharing of personal information (we do not sell personal information);
• Non‑discrimination for exercising your rights.

You (or your authorised agent) may exercise these rights by contacting us at team@tokportal.com.

12. Contact us

If you have questions or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer (DPO):

TokPortal – Privacy
144 Boulevard Saint-Germain
75006 Paris
France
team@tokportal.com

13. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the revised version on the Platform and indicate the “Effective date". Significant changes will be notified via e‑mail or Platform notice. Your continued use of TokPortal after the effective date constitutes acceptance of the updated Policy.

Last updated: 20 May 2025

‍