This policy explains how Tocler ("Tocler"), operated by Tocler, an individual developer (not a registered company), handles personal data on https://tocler.com, in the Tocler Dashboard and Super Admin, and in stores that run on Tocler. Questions: support@tocler.com.

1. Who is responsible

• Tocler is the controller for data about store owners and their team members (accounts, billing, payouts, security), visitors of https://tocler.com, and the records Tocler must keep itself (security, fraud and abuse prevention, payments that go through Tocler, accounting and legal obligations).
• The store owner is the controller for their store's customer relationship (customer accounts, orders, support, marketing, and payments made to the store's own payment providers). Tocler processes that data on the store owner's behalf under the Data Processing Addendum.

2. Data we collect — only what we need

Store owners and team members: name, email, password (stored only as a one-way hash), country, optional sign-up answers, consent choices, 2-step login settings (secret encrypted, backup codes hashed), sign-in times and IP addresses, plan and billing history, invoices, payout addresses (encrypted) and payout history, support messages, an activity log, and — only for features that need it — the compliance information described in the AML & Compliance Notice.

Store customers (buyers): email, username, password hash, orders, delivered keys (encrypted) and whether they were revealed, store credit, support tickets, refund requests and appeals, the IP address and browser data used for security and fraud prevention, and the payment status returned by the payment provider. Tocler never receives full card numbers: card details are entered in the payment provider's secure form.

People who send a report or notice: the details they give us (name, email, the report) and technical data needed to prevent abuse of the report form.

Website visitors: pages visited and technical data (IP address, browser, device) in server logs; cookies only as described in the Cookie Policy.

3. Why we use it (legal basis)

• To provide the Service you asked for: accounts, stores, orders, delivery, billing, payouts, support (contract).
• To keep the platform secure and lawful: sign-in protection, 2-step login, fraud, abuse and prohibited-goods detection, report handling, CAPTCHAs, rate limits, audit logs (legitimate interests and legal obligations).
• To meet legal, tax, accounting, anti-money-laundering and payment-provider obligations (legal obligation).
• To send service emails: verification, security alerts, invoices, receipts, payout and policy notices (contract / legitimate interests).
• To send product news, only if you opted in; you can opt out at any time (consent).

4. Who we share it with

Never sold. Only with providers who need it to run Tocler, under contracts that protect it: application and database hosting, caching, image storage and delivery, email delivery, bot protection (Google reCAPTCHA), Tocler's own payment providers (for plan and invoice payments), and the payment providers a store owner connects (for that store's payments). Also with payment providers, authorities or courts when the law requires it or to prevent fraud and protect rights. Some providers may process data outside your country, with appropriate safeguards where required.

5. How long we keep it

• Account data: while the account exists, then up to 24 months for disputes, fraud prevention and legal claims, unless the law requires longer.
• Billing, payments, payouts and fee records: as long as tax and accounting laws require (often 5–10 years).
• Activity logs, security logs and reports: as long as needed for security and legal claims (typically up to 3 years), longer only under legal hold during an investigation or dispute.
• Marketing consent: until withdrawn.

6. Security

Passwords are hashed; keys, payout addresses, 2-step secrets and payment credentials are encrypted at rest; every connection uses HTTPS; staff access is role-based, protected by 2-step login and logged. If a breach affects you, we tell you and the authorities as the law requires.

7. Your rights

Depending on where you live you may access, correct, delete, restrict or export your data, object to processing, and withdraw consent. Buyers can download their data and delete their store account in the store (My account → Settings → Your data). Store customers should otherwise contact the store first; we help store owners respond. Write to support@tocler.com. You may complain to your data protection authority. Some records must be kept under legal hold (payments, tax, fraud, reports) even after a deletion request; personal details are removed from them where possible.

8. Children

Tocler is not intended for children. Store owners must be 18+. Stores selling age-restricted goods must show the age warning.

9. Changes

We post updates here and change the "Last updated" date; important changes are announced by email or in the Dashboard.