Your data, your call
Privacy Policy
We collect the least we can to run a trustworthy marketplace, we are clear about why, and we never sell your personal data. This page explains what we hold, how we use it, and the controls you have.
Last updated June 2026. We are the data controller for the account and marketplace data described here. Creators you transact with are separate controllers for the data you share directly with them.
The short version
To run TOFFEHA we need some information: who you are, how to reach you, what you buy or sell, and how you use the site. We use it to deliver your purchases, pay creators, keep the marketplace safe, comply with the law, and improve the product. We do not sell your personal data, and we only share it where it is needed to run the service or where the law requires.
What we collect
You give us: your name, email, password, and profile details when you register; listing content, pricing, and payout details if you are a creator; billing and address information when you buy; and anything you send through messages, forms, or support requests.
We collect automatically: device and browser information, IP address, pages viewed, referring links, and similar analytics through cookies and comparable technologies, so the site works and we can understand and improve it.
From others: payment confirmations and payout status from our payment partners, and limited information from sign-in or social tools if you choose to use them.
How we use your data
We use your information to create and manage your account, show and deliver purchases, process payments and creator payouts, provide customer support, prevent fraud and abuse, personalise discovery, send service and, where you have opted in, marketing messages, meet legal and tax obligations, and measure and improve the platform.
Legal bases
Where data-protection law such as the GDPR applies, we rely on the following bases: performance of our contract with you to run your account and orders; our legitimate interests in keeping the marketplace secure, functional, and improving; your consent for optional cookies and marketing, which you can withdraw at any time; and compliance with legal obligations such as accounting and tax.
Payments and creators
When you buy, the creator and our payment systems receive the information necessary to fulfil and account for the order, such as your name, the items, and where relevant a delivery or contact detail. Card numbers are handled by our payment providers, not stored by us. Creators must use buyer data only to deliver their service and in line with privacy law. When you message or hire a creator, the information you choose to share with them is governed by their own handling as an independent controller.
How long we keep it
We keep personal data for as long as your account is active and as needed to provide the service. After that, we retain what we must for legal, tax, dispute-resolution, and fraud-prevention purposes, then delete or anonymise it. Transaction and invoicing records are typically kept for the period required by accounting and tax law.
How we protect it
We use technical and organisational measures including encryption in transit, access controls, least-privilege administration, hardened infrastructure, and monitoring. No system is perfectly secure, so we also ask you to use a strong, unique password and to enable extra protection where offered. If a breach affects your rights, we will notify you and the relevant authority as required by law.
Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, restrict or object to certain processing, port it to another service, and withdraw consent. You can exercise most of these from your account settings or by contacting us. We will respond within the time the law allows and may need to verify your identity first.
International transfers
We and our providers may process data in countries other than yours. Where we transfer personal data across borders, we use appropriate safeguards such as recognised contractual clauses to ensure your data stays protected to the standard required by your local law.
Children
TOFFEHA is not intended for children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us information, contact us and we will remove it.
Changes
We may update this policy as our service and the law evolve. We will revise the date above and, for material changes, provide a clearer notice. Please check back from time to time.
Contact and complaints
To make a privacy request or ask a question, reach us through the contact page. If you are in a region with a data-protection authority and you are unhappy with our response, you have the right to complain to that authority, though we hope you will give us the chance to put things right first.