GDPR & your data rights
Last updated: June 2026
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, this page explains your rights under the General Data Protection Regulation (GDPR) and how to exercise them.
At a glance
- We process data lawfully — consent, contract, or legitimate interest only.
- You can access, export, correct, or delete your data at any time.
- We use infrastructure providers (Supabase, Vercel) for hosting and data storage, each governed by their own data protection terms.
- We do not sell personal data or use it for cross-site advertising.
- Where a personal-data breach must be notified under GDPR, we aim to notify the supervisory authority without undue delay and, where required, within 72 hours of becoming aware.
1. Data controller
Personal data collected through trytokka.com and the TryTokka application is controlled by the TryTokka product operated by Samson PG under the Acsaven brand family (parent hub: https://acsaven.com/). For GDPR requests, email privacy@trytokka.com.
2. Lawful bases for processing
- Contract — account creation, spend monitoring, alerts you configure.
- Legitimate interest — fraud prevention, rate limiting, service security.
- Consent — optional marketing emails (you can withdraw anytime).
- Legal obligation — tax/billing records where applicable.
3. Your GDPR rights
You have the right to:
- Access — request a copy of personal data we hold about you.
- Rectification — correct inaccurate data (e.g. alert email in Settings).
- Erasure — delete your account and all associated data (Settings → Account).
- Portability — export usage data as CSV (Settings → Export).
- Restriction — ask us to limit processing in certain circumstances.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is consent-based.
To exercise any right, email privacy@trytokka.com from your registered address. We respond within 30 days.
4. International transfers
Your data is stored by our infrastructure providers, Supabase and Vercel, which may process it in the United States and other regions. TryTokka is operated from India by Samson PG, and the service is administered — including any support access — from there. Neither the United States nor India is covered by an EU adequacy decision, so for users in the EEA or UK both are restricted transfers.
Both providers make Data Processing Addenda available that incorporate the European Commission’s Standard Contractual Clauses. If you need the transfer terms that apply to your account in writing, email privacy@trytokka.com and we will send them to you — please do not rely on us having a mechanism we have not confirmed to you directly. See our Privacy Policy for the full subprocessor list.
5. Data retention
Account data is retained while your account is active. After deletion, we purge personal data within 30 days except where law requires longer retention (e.g. billing records).
6. Supervisory authority
You may lodge a complaint with your local data protection authority if you believe we have not handled your data correctly. We encourage you to contact us first so we can resolve your concern.