Privacy Policy

The short version

To run TOFFEHA we need some information: who you are, how to reach you, what you buy or sell, and how you use the site. We use it to deliver your purchases, pay creators, keep the marketplace safe, comply with the law, and improve the product. We do not sell your personal data, and we only share it where it is needed to run the service or where the law requires.

What we collect

You give us: your name, email, password, and profile details when you register; listing content, pricing, and payout details if you are a creator; billing and address information when you buy; and anything you send through messages, forms, or support requests.

We collect automatically: device and browser information, IP address, pages viewed, referring links, and similar analytics through cookies and comparable technologies, so the site works and we can understand and improve it.

From others: payment confirmations and payout status from our payment partners, and limited information from sign-in or social tools if you choose to use them.

How we use your data

We use your information to create and manage your account, show and deliver purchases, process payments and creator payouts, provide customer support, prevent fraud and abuse, personalise discovery, send service and, where you have opted in, marketing messages, meet legal and tax obligations, and measure and improve the platform.

Legal bases

Where data-protection law such as the GDPR applies, we rely on the following bases: performance of our contract with you to run your account and orders; our legitimate interests in keeping the marketplace secure, functional, and improving; your consent for optional cookies and marketing, which you can withdraw at any time; and compliance with legal obligations such as accounting and tax.

Who we share with

We share data only as needed with: payment and payout processors; hosting, email, analytics, and security providers who process data on our behalf under contract; creators and buyers, so a transaction can be completed; and authorities or advisors where the law requires or to protect rights and safety. We require our processors to protect your data and use it only for the services they provide to us.

Payments and creators

When you buy, the creator and our payment systems receive the information necessary to fulfil and account for the order, such as your name, the items, and where relevant a delivery or contact detail. Card numbers are handled by our payment providers, not stored by us. Creators must use buyer data only to deliver their service and in line with privacy law. When you message or hire a creator, the information you choose to share with them is governed by their own handling as an independent controller.

Cookies and tracking

We use strictly necessary cookies to run the site and, with your consent, analytics and preference cookies to understand usage and remember your choices. You can manage non-essential cookies through our consent banner and your browser settings. Blocking some cookies may affect how parts of the site work.

How long we keep it

We keep personal data for as long as your account is active and as needed to provide the service. After that, we retain what we must for legal, tax, dispute-resolution, and fraud-prevention purposes, then delete or anonymise it. Transaction and invoicing records are typically kept for the period required by accounting and tax law.

How we protect it

We use technical and organisational measures including encryption in transit, access controls, least-privilege administration, hardened infrastructure, and monitoring. No system is perfectly secure, so we also ask you to use a strong, unique password and to enable extra protection where offered. If a breach affects your rights, we will notify you and the relevant authority as required by law.

Your rights

Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, restrict or object to certain processing, port it to another service, and withdraw consent. You can exercise most of these from your account settings or by contacting us. We will respond within the time the law allows and may need to verify your identity first.

International transfers

We and our providers may process data in countries other than yours. Where we transfer personal data across borders, we use appropriate safeguards such as recognised contractual clauses to ensure your data stays protected to the standard required by your local law.

Children

TOFFEHA is not intended for children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us information, contact us and we will remove it.

Changes

We may update this policy as our service and the law evolve. We will revise the date above and, for material changes, provide a clearer notice. Please check back from time to time.

Contact and complaints

To make a privacy request or ask a question, reach us through the contact page. If you are in a region with a data-protection authority and you are unhappy with our response, you have the right to complain to that authority, though we hope you will give us the chance to put things right first.