Privacy policy

1. Who we are

Tokoo (the “service”, at www.tokoo.app) is operated by StackAI Lab Pte. Ltd., a company registered in Singapore (“we”, “us”). We are responsible for the personal data described in this policy.

We handle personal data under Singapore's Personal Data Protection Act 2012 and, where they apply to you, the EU and UK General Data Protection Regulations and other local data protection laws.

2. Data we collect about you

When you visit or use the service we collect:

• Account details: your name, work email address, company name and password (stored only as a hash). If you sign in with Google, we receive your name, email address and Google account identifier.
• Sign-in and security data: the IP address and browser details of each session, and a record of sign-ins, so we can keep your account secure.
• Your activity: the searches you run, the companies you save, the contacts you reveal, your credit balance and its history.
• Payments: the pack you bought, the amount, and its status. Card details go straight to our payment processor; we never see or store your card number.
• Messages: what you write to us through the chat, the contact form or email, and the outreach emails you compose and send through the service, including delivery, open and click events and the replies you receive.
• A connected mailbox: if you connect your own mailbox to send from, we store the access it grants in encrypted form and read only the replies to messages sent through the service.
• Analytics: when analytics are enabled, pages viewed and actions such as a search or a sign-up, through the cookies described in our cookie policy.

3. People in our company directory

The service helps businesses find other businesses. To do that it holds business contact information about people who work at companies that appear in trade records: a name, a job title, a work email address, a work phone number and a professional profile link. It comes from customs and shipping records, from commercial business-information providers and from information companies publish about themselves.

We treat this information with care. Until a member pays to see a contact, the service shows only initials, the email domain and the country of the phone number. A contact is released one at a time, only to a signed-in member, and every release is logged. Members may use it only to contact that person about their work, under our terms of use.

If you are one of these people and want to know what we hold about you, have it corrected, or have it removed and never shown again, write to shine@stackailab.com. When we remove you, we also add your address to a suppression list so no member can email you through the service.

4. How we use personal data

• To provide the service: run your searches, show results, release the contacts you pay for, send the emails you queue, and keep your account.
• To take payments, add credits, refund a credit when a contact can't be delivered, and keep financial records.
• To keep the service secure: stop abuse, fraud, scraping and spam, and enforce sending limits.
• To answer your messages and support requests.
• To understand how the service is used and improve it.
• To send you service messages, such as receipts, security notices and changes to these terms.
• To meet legal obligations and to establish or defend legal claims.

5. Legal bases

Where the law asks for a legal basis, we rely on:

• Contract: to provide the service you signed up for and bought credits for.
• Legitimate interests: to keep the service secure, improve it, and hold and release business contact information for business-to-business prospecting, balanced against the interests of the people concerned through masking, logging and opt-out.
• Legal obligation: for tax, accounting and lawful requests.
• Consent: for analytics cookies where the law requires it, and for connecting your mailbox. You can withdraw consent at any time.

6. AI features

The service uses AI models to read your questions, rank companies, draft emails and answer support chats. The text you type is sent to our AI provider for that purpose only. The provider processes it on our behalf and may not use it to train its models. We keep a record of how much each feature is used, not a copy for training.

7. Who we share data with

• Service providers who work for us under contract: hosting and databases, payment processing, email delivery, AI processing and analytics. They may use the data only to provide their service to us.
• Other members, only for a directory contact they have paid to reveal, as described above.
• Authorities, when the law requires it or to protect rights, safety and the security of the service.
• A buyer or successor, if our business or part of it is sold or reorganised, under this policy.

We do not sell your personal data, and we do not share it for advertising.

8. International transfers

We are based in Singapore, and our providers may process data in other countries. When personal data leaves the country it was collected in, we make sure it stays protected to a standard comparable to the law it came from, including through contractual protections such as standard contractual clauses.

9. How long we keep it

• Account details, saved companies and revealed contacts: for as long as your account is open, then deleted or anonymised within a reasonable time after it closes.
• Sign-in sessions: 14 days, or until you sign out.
• Searches made without an account: 90 days. Searches made by members: 2 years.
• Sign-in records: 1 year. Email delivery and tracking events: 1 year.
• AI usage records: 2 years.
• Payment and credit records: as long as tax and accounting law requires, usually 5 years.
• Suppression and opt-out records: for as long as we operate, so an opt-out keeps working.

10. Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can withdraw consent at any time, and you can opt out of any outreach email through the unsubscribe link it carries.

Write to shine@stackailab.com. We reply within 30 days and may ask you to confirm who you are first. If you are not satisfied, you can complain to Singapore's Personal Data Protection Commission or to the data protection authority where you live.

11. Security

All traffic uses HTTPS. Passwords are stored as bcrypt hashes and session tokens only as hashes. Each organisation's data is kept apart at the database level. Mailbox credentials are encrypted. Directory contacts stay masked until they are paid for, and every release is logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

12. Children

The service is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy. The date at the top says when it last changed. If a change is significant, we will tell signed-in members by email or on the site before it takes effect.

14. Contact

StackAI Lab Pte. Ltd., Singapore. Email shine@stackailab.com.