Tokka – Tarjetas de Presentación Digitales

Privacy Notice

Last updated: October 13, 2026.

This is an English translation of our Aviso de Privacidad, for people who do not read Spanish. If the two versions differ, the Spanish version prevails.

1. Who is responsible for your personal data

Julio Emiliano Castillo Pantoja (“TOKKA”, “we”, “us”), with address at Privada Ayuntamiento 2605-7, C.P. 89130, Tampico, Tamaulipas, Mexico, is responsible for processing your personal data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.

For any question, request or to exercise your rights regarding your personal data, contact us at: hola@tokka.com.mx.

2. Personal data we collect

Depending on how you use tokka.com.mx, we may collect the following categories of data:

  • Identification and contact data: name, email, phone number and shipping address, which you give us when you sign up, buy a TOKKA card or fill in a contact form.
  • Account data: username, password (stored encrypted) and, if you sign in with Google, the identifier, name and email of your Google account.
  • Public profile data: profile photo, cover photo, bio, links to social networks and any other information you choose to publish on your digital profile (tokka.com.mx/your-username). Remember that this information is public and visible to anyone who visits your profile.
  • Purchase data: order history, products bought and shipping address. We do not store your full card details: our payment processor (Stripe) receives and processes them directly under its own privacy policy.
  • Technical and browsing data: IP address, device and browser type, pages visited, and cookies or similar technologies (see section 7).
  • Scanned contacts: if you use the “Contacts” feature in the Dashboard, we collect the data shown on other people’s business cards that you choose to photograph (name, company, position, phone, email, etc.). See section 3 for how this data is handled.
  • Profile and card visitor data: if you visit a user’s public profile, scan a TOKKA card or tap one of the buttons on a profile, we record that event with its date and time and your approximate location (city, state and country), calculated from your IP address. Your IP address is not stored, and nothing is saved on your device for this purpose. See section 4.

3. Third-party data captured with the “Contacts” feature (OCR)

3.1 The business card scanner lets each user photograph other people’s physical business cards. The image is sent to our servers and processed with Google Cloud Vision (optical character recognition) to read its text; that text is then sent to Anthropic (Claude), an artificial intelligence service, to sort it into fields (name, position, company, phone, email). The result is saved as a private contact, visible only to the user who captured it.

3.2 In this feature, TOKKA acts as a processor (the provider of the technical tool), while the user who scans the card is responsible for having a legitimate basis to process that third person’s data (for example, having received the card directly from its owner with the intention of being contacted). If you are that third person and want to exercise your rights over data captured this way, you can contact us and we will guide you, without prejudice to the responsibility of the user who did the scan.

3.3 These contacts are not published or shared with other users or the public; they stay private in the account of whoever captured them, who can delete them at any time.

3.4 If the user chooses, they can download their contacts as a CSV file or connect their account to external services (for example HubSpot, or Zapier, Make and others through a webhook address). In that case, each contact they save (name, company, position, phone, email and notes) is sent to the service they chose, on their instruction. The credentials for those connections are stored encrypted and the user can disconnect them at any time.

3.5 Exchange contact. Verified profiles can show a button that lets visitors share their own details with the profile owner. If you use it, the details you enter (your name and, depending on what that profile asks for, email, mobile number, company, position, website and a note) are saved as a private contact in that person’s account, they are notified by email if they set it up that way, and the details may be sent to the external services they have connected (see 3.4). We also store the date and time of the submission as a record of your consent.

3.6 In that case, the profile owner is responsible for the data they receive and TOKKA acts as a processor. Sharing is voluntary and only happens when you submit the form. If you later want the data deleted, you can ask that person or write to us at hola@tokka.com.mx and we will help you exercise your rights.

4. Profile and card statistics

4.1 What we record. When someone opens a TOKKA user’s public profile, scans their card (via NFC or QR code) or taps one of the buttons on their profile (for example social networks, WhatsApp, “Save my contact” or “Call”), we record: the type of event (visit, scan or click), the button used, the date and time, and the approximate location of the person (city, state and country). For card scans we also store the browser type of the phone that scanned it.

4.2 How we get the location. The location is calculated on our own servers at the moment of the event, from the IP address, using a geolocation database hosted on our server (DB-IP). The IP address is not sent to third parties for this purpose and is not stored: we only keep the city, state and country. This is an approximate, city-level location; we do not use GPS or your device’s precise location.

4.3 How we avoid counting twice. Our server computes a one-way encrypted code from your IP address, browser type and language, combined with a key that changes every day. Only that code is stored; it cannot be reversed to recover your IP address, and it is different each day, so it cannot be used to follow you over time. If you open the same profile or tap the same button again within 30 minutes, it is not counted again. Nothing is stored on your device for this purpose: no cookies and no local storage.

4.4 Who sees this information. Each profile owner can see the statistics of their own profile in aggregate form in their Dashboard (totals, visits per day, most-used buttons and the cities visits come from). The owner does not see the identity, IP address or contact details of the people who visit their profile. TOKKA may also use these statistics, in aggregate form, to improve the service.

4.5 What we do not record. We do not record the owner’s own visits to their profile, or visits from known automated programs (bots).

4.6 Retention. Records are kept while the profile owner’s account exists and are permanently deleted when the owner closes their account.

4.7 Objection. If you visited a profile and do not want your visits recorded, you can object by writing to hola@tokka.com.mx. Visits and clicks are recorded with JavaScript, so blocking it in your browser prevents them from being recorded; card scans are recorded directly on our server.

4.8 Maps and icons on profiles. If a profile shows a location, the map is not loaded until you tap “Show map”. Only then does the map provider (OpenStreetMap, or Google Maps for some addresses) receive your IP address and the usual browser data, under its own privacy policy. The logos of social networks and apps on profiles are served from our own server, so those services do not receive your data when you open a profile.

5. Purposes of processing

Primary purposes (necessary for the service):

  • Create and manage your account and your digital profile.
  • Process your purchases, payments and shipping of TOKKA cards.
  • Show your public profile to whoever visits it, according to the information you choose to publish.
  • Operate the Contacts scanning and storage feature that you choose to use.
  • Show each owner the statistics of visits, scans and clicks on their profile, with the approximate location (city) of their visitors (see section 4).
  • Verify your identity when you sign in, including sign-in with Google.
  • Provide support and respond to your contact requests.
  • Comply with legal, tax and invoicing obligations.

Secondary purposes (optional):

  • Send you promotions, news or commercial information about TOKKA by email.
  • Show you personalized TOKKA ads on platforms such as Google and TikTok (remarketing).
  • Produce internal statistics to improve the service.

You can object to these secondary purposes at any time without affecting your access to the service, by writing to hola@tokka.com.mx or, for promotional emails, by using the unsubscribe link included in each email.

6. Data sharing

To operate the service, we share certain data with the following third parties, only as far as necessary for the stated purpose:

  • Stripe: payment processing for cards, Link, Google Pay and Apple Pay.
  • Google (Cloud Vision): OCR processing of the business card images you scan in the Contacts feature.
  • Anthropic (Claude): sorting into fields the text read from the business cards you scan in the Contacts feature.
  • Google (Identity Services): identity verification when you sign in with your Google account.
  • Google Ads / Google Merchant Center and TikTok Ads: campaign measurement and remarketing, only if you accept advertising cookies (see section 7).
  • Couriers: name and shipping address, to deliver your physical card. We also use Skydropx, a platform to quote and generate shipping labels.
  • Hostinger: hosting provider where the site and database are stored.
  • Services you connect (HubSpot, Zapier, Make or others): your saved contacts, only if you turn on that connection in Settings (see 3.4).

We do not sell your personal data to third parties. These transfers do not require your consent when they are necessary to provide the service you requested, under article 37 of the LFPDPPP; transfers for advertising purposes (Google Ads/TikTok Ads) only happen if you accept advertising cookies in the cookie notice, and you can withdraw that consent at any time (see section 7).

7. Cookies and tracking technologies

We use our own and third-party cookies to:

  • Keep you signed in to the Dashboard and, while you are signed in, remember your username to show the “My account” and “Edit profile” buttons (cookie tokka_logged_in, deleted when you sign out).
  • Make the WooCommerce shopping cart and checkout work properly.
  • Only if you accept: record where your visit came from (for example, an ad or a social network) to link it to an order (WooCommerce “order attribution”, cookies sbjs_*).
  • Only if you accept: measure our campaigns and show you TOKKA ads through the Google pixel (Google Listings & Ads) and the TikTok pixel (TikTok for Business).
  • Save display preferences in your browser’s local storage, such as your Dashboard background color.

Profile statistics do not use cookies or store anything on your device (see 4.3).

The first time you visit the site we show you a cookie notice where you choose between Accept (all) or Only necessary. Optional cookies are not activated until you accept them. We store your choice for 12 months in our own cookie (tokka_consent) and you can change it at any time with the Cookie settings link in the footer. You can also disable cookies in your browser settings; note that some features of the site (such as signing in or buying) may stop working properly if you block them all.

8. Your rights and withdrawal of consent

You have the right to Access your personal data, Rectify it if it is inaccurate, Cancel it when you consider it is not needed for any of the stated purposes, and Object to its processing for specific purposes (known in Mexico as ARCO rights). You can also withdraw any consent you have given us.

To exercise any of these rights, send your request to hola@tokka.com.mx, including: (i) your name and contact details, (ii) the right you want to exercise and a clear description of the data, and (iii) any document supporting your request. We will reply within 20 business days, as set out in the LFPDPPP.

You can also manage much of this data yourself directly from your Dashboard (edit your profile, delete scanned contacts, or close your account under Settings → Close account, which deletes your profile, photos, contacts and statistics), without sending a formal request.

9. Minors

The service is not intended for minors. If you are a parent or guardian and learn that a minor in your care has given us personal data without your authorization, contact us to delete it.

10. Security of your data

We apply reasonable administrative and technical measures (such as encrypted passwords and HTTPS connections) to protect your personal data against damage, loss, alteration, or unauthorized access or processing. No system is 100% infallible, so we cannot guarantee absolute security.

11. Changes to this Privacy Notice

We may update this Privacy Notice at any time. We will publish the current version on this page, with the date of the last update. If the change is substantial, we will try to notify you by email or with a visible notice on the site.

12. Visitors in the European Union, the EEA and the United Kingdom

TOKKA is based in Mexico. If you open a TOKKA profile or scan a TOKKA card while in the European Union, the European Economic Area or the United Kingdom (for example, because a TOKKA user handed you their card while traveling), this section summarizes how the above applies to you.

  • What we process about you as a visitor: only what is described in section 4 (event, date and time, approximate city, and a daily-changing code that cannot be reversed). If you use “Exchange contact”, also the details you choose to send (section 3.5).
  • Legal basis: profile statistics and keeping the service secure rely on our legitimate interest, and that of profile owners, in knowing how often their profile and card are used, in a way that does not identify you. The contact exchange relies on your consent, which you give by submitting the form. Optional cookies rely on your consent through the cookie notice.
  • Nothing on your device without your choice: opening a profile does not set cookies or local storage for statistics, does not load maps until you ask for them, and does not load third-party icons.
  • Where your data is processed: in Mexico, on the servers of our hosting provider (Hostinger), and, for the features described in section 6, by providers that may be located in the United States. These countries may not offer the same level of data protection as your country.
  • Your rights: in addition to the rights in section 8, you may request restriction of processing and data portability, and you have the right to lodge a complaint with the data protection authority of the country where you live. We will reply to your requests within one month.
  • Contact: hola@tokka.com.mx, in Spanish or English.

This Privacy Notice should be read together with our Terms and Conditions.