Privacy Policy

This Privacy Policy explains how Tokoo, operated by Kokiyo Studio Digital Solutions (“Tokoo”, “we”, “us” or “our”), collects, uses, discloses, and protects your personal data when you use our store-builder platform (the “Platform”). We handle personal data in accordance with the Malaysian Personal Data Protection Act 2010 (“PDPA”). By creating an account or using the Platform, you consent to the practices described here and agree to our Terms & Conditions.

1. Who this policy covers

This policy applies to the merchants who register for and operate a store on Tokoo. Where you, as a merchant, collect personal data from your own customers through your store, you are the data controller for that customer data and are responsible for your own privacy practices; we process that data on your behalf as described in these Terms.

2. Information we collect

• Account information — your name, email address, password, and, if you sign in with Google, Facebook, or Apple, the basic profile information those providers share with us.
• Store and business information — your store name, products, pricing, contact details, and any content you add to your store.
• Billing information — subscription plan and payment records. Card details are handled by our payment provider and are not stored by us.
• Usage and device data — log data, IP address, browser type, pages visited, and similar technical information collected automatically to keep the Platform secure and working.

3. How we use your information

We use personal data to:

• create and manage your account and provide the Platform;
• process subscriptions, billing, and payments;
• respond to your enquiries and provide customer and technical support;
• secure the Platform, prevent fraud and abuse, and troubleshoot problems;
• send service-related messages and, where you have consented, product updates;
• comply with our legal and regulatory obligations.

4. Legal basis and consent

We process your personal data on the basis of your consent, to perform our contract with you, to comply with legal obligations, and for our legitimate interests in operating and improving the Platform. You may withdraw your consent for non-essential processing at any time, though this may limit your ability to use certain features.

5. Disclosure of your information

We do not sell your personal data. We may share it with:

• Service providers who help us run the Platform — for example hosting, email delivery, and payment processing — bound to protect your data and use it only for those services;
• Authorities where required by law, regulation, or valid legal process;
• A successor in the event of a merger, acquisition, or sale of assets, subject to this policy.

6. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Platform. After you close your account, we may retain certain data to comply with legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements, after which we securely delete or anonymise it.

7. Data security

We take reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights under the PDPA

Subject to the PDPA, you have the right to access and correct your personal data, to withdraw consent, and to limit how we process it. To exercise any of these rights, contact us at support@tokoo.my. We may need to verify your identity before acting on a request.

9. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Platform is used. You can control cookies through your browser settings, but disabling them may affect how the Platform works.

10. Third-party links

The Platform and merchant stores may link to third-party sites and services that we do not control. This policy does not apply to those sites, and we encourage you to review their privacy policies.

11. Children

The Platform is not intended for individuals under 18, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date above and, for material changes, take reasonable steps to notify you.

13. Contact us

For any questions about this Privacy Policy or how we handle your personal data, email us at support@tokoo.my.