Privacy Policy
Last updated: 1 August 2026
Applies to: trytoky.com
1. Who we are
trytoky.com is operated by TOURINGTUNES Sp. z o.o., a company registered in Poland. You can reach us at privacy@trytoky.com.
We are the controller of the personal data described below, within the meaning of the GDPR (Regulation (EU) 2016/679).
We have not appointed a Data Protection Officer. We are not required to — we do not carry out large-scale monitoring or process special categories of data.
2. What we collect, and why
Right now this site does one thing: it takes waitlist sign-ups. We collect only what you type into one of the two forms.
If you join the creator waitlist
| Data | Why we ask |
|---|---|
| Email address | To tell you when toky opens in your country. This is the only thing we will email you about. |
| TikTok handle | To recognise you when you sign up later, and to sanity-check that the account exists. |
| Country | We open country by country, because payout methods differ. This decides your position in the queue. |
| Follower range | To understand the mix of creators interested, so we build the right thing. |
| How you currently get paid | To decide which payout methods to build first. This is the single most useful answer you give us. |
If you request early access as a label or artist
| Data | Why we ask |
|---|---|
| Name | So we can address you when we reply. |
| Label / artist / company | To understand who we'd be working with. |
| Work email | To reply to you. |
| Releases per month, typical promotion budget | To judge whether toky fits you before we take your time. |
| What you use today | To understand what we're being compared against. |
Recorded alongside your answers
Two things are stored with your entry that you don't type in:
| Data | Why |
|---|---|
| The date you signed up | So we can honour the retention period in section 5, and invite people in the order they joined. |
| Where the link came from | If you arrived through a link that carried campaign tags (utm_source, utm_campaign) or a referral code, we store those tags. They tell us which channel or which person sent you, so we know where to spend effort. If you arrived by typing the address, nothing is stored here. |
These tags come from the link you clicked, not from watching you. We do not follow you across sites and we cannot see where you went afterwards.
What we do not collect
We do not use analytics, advertising pixels, or tracking cookies on this site. We do not build profiles. We do not make automated decisions about you. Apart from the two items just above, we do not collect anything beyond the form fields listed — no IP-based profiling, no fingerprinting, no session recording.
3. Legal basis
Consent (GDPR Art. 6(1)(a)). You give it by submitting the form. Nothing here is required of you — if you don't want to be on the list, don't fill it in.
You can withdraw consent at any time (section 7). Withdrawing does not affect anything we did lawfully before you withdrew.
4. Who else sees your data
We use two service providers, both acting as processors on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Hosts the database your form entry is stored in | Frankfurt, Germany |
| Vercel | Hosts this website, serves the pages, and runs the code that receives your form | Frankfurt, Germany |
We do not sell your data. We do not share it with advertisers, data brokers, or other platforms. We do not pass it to labels or marketers.
Transfers outside the EEA. Both the code that handles your submission and the database it is written to run in Frankfurt. Your form entry is not processed outside the EU in the ordinary course.
Vercel and Supabase are both US companies, so their staff can in principle access systems for support and maintenance from outside the EEA. Where that happens, it rests on the EU Standard Contractual Clauses and — for Vercel — the EU–US Data Privacy Framework.
5. How long we keep it
- Until launch, plus 12 months. If we email you and you don't take up the invitation, we delete your entry after 12 months.
- If you ask us to delete it, we delete it — normally within 30 days.
- If we abandon the project, we delete the whole list. We won't sell it or pass it on.
6. Security
Data sits in a Postgres database with row-level security enabled and no public read access — the table cannot be read through the public API at all. Writes go through a single restricted function that only accepts new sign-ups and returns nothing. Access to the underlying database is limited to the company's own administrators.
No system is perfect, and we won't claim otherwise. If there is a breach affecting your rights, we will notify the Polish supervisory authority within 72 hours and tell you directly where the law requires it.
7. Your rights
Under the GDPR you can ask us to:
- See what we hold about you (Art. 15)
- Correct it if it's wrong (Art. 16)
- Delete it (Art. 17)
- Restrict what we do with it (Art. 18)
- Give you a copy in a portable format (Art. 20)
- Stop processing based on legitimate interests (Art. 21) — not applicable here, since we rely on consent
- Withdraw your consent (Art. 7(3))
Write to privacy@trytoky.com and we reply within one month. There's no form and no hoops: "delete me" is enough.
You can also complain to the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa uodo.gov.pl
If you live in another EU country you can complain to your own authority instead.
8. Children
toky is not for people under 16. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, tell us and we'll delete it.
9. Changes
If we change this policy we'll update the date at the top. If the change is significant and we hold your email, we'll tell you before it takes effect.
Draft prepared 2026-08-09. Not legal advice. Must be reviewed by a Polish lawyer together with 05-tech/LEGAL-BRIEF.md before publication.
Open items tracked in Dart: TKY-010 (company details), TKY-011 (hosting regions and DPAs), TKY-012 (consent banner before any pixel), TKY-013 (minors policy), TKY-015 (lawyer review).