Privacy policy

This policy explains what personal information we collect when you visit or buy from toka.co (the "Site"), why we collect it, who we share it with, and what you can do about it.

The controller of your personal information is Excellent Era LLC, trading as Toka, 10621 Lawson River Ave, Fountain Valley, California 92708, United States. In this policy, "we" and "us" mean Excellent Era LLC. You can reach us about anything in this policy at support@toka.co.

What we collect

Device and browsing information

Your IP address, browser and device type, time zone, cookie identifiers, the pages and products you view, search terms, and how you move around the Site. We collect this automatically through cookies, log files, tags and advertising pixels.

Order information

Your name, billing and shipping address, email address, phone number, payment details and order history. You give us this when you check out. Card numbers are handled by our payment processors — we do not store full card numbers ourselves.

Support, reviews and marketing information

What you tell us when you email us, the content of product reviews and photos you submit, and your marketing preferences, including whether you have opted in to email or SMS.

Sensitive information

We do not collect sensitive personal information as that term is defined under California law — no government ID numbers, precise geolocation, health data, biometrics, or racial, religious, political, union or sexual-orientation data.

Why we use it

To take, process, fulfil and deliver your order, and to handle returns, warranty claims and refunds.
To take payment and to screen orders for fraud.
To answer your emails and provide support.
To send you marketing by email or SMS where you have asked for it, and to measure how it performs.
To run and measure advertising, including on Meta and Google platforms.
To understand how the Site is used and improve it.
To meet our legal, tax and accounting obligations.

Our lawful bases (EU and UK)

If you are in the European Economic Area or the United Kingdom, we rely on: performance of a contract to process and deliver your order; consent for marketing and non-essential cookies, which you can withdraw at any time; legal obligation for tax and accounting records; and legitimate interests for fraud prevention, site security and improving our products, where those interests are not overridden by your rights.

Who we share it with

We share personal information with the service providers who make the store work. We do not sell your information for money. We name them because you are entitled to know who has your data:

Shopify — our ecommerce platform and host (privacy policy).
Our payment processors, including Shopify Payments (which powers Shop Pay, Apple Pay and Google Pay) and Afterpay for instalment payments.
Meta and Google — advertising and analytics pixels, used for measurement, retargeting and building custom audiences (Google, Meta).
Postscript — SMS marketing.
Navidium — Secure Checkout+ shipping protection and claims.
Loox — product reviews and review photos.
Hextom and DoctorApps — Site functionality and merchandising tools.
Our returns portal and order-tracking apps — to process returns and show you delivery status.
Third-party fulfilment partners, manufacturers and carriers — to make and deliver your order.

We will also disclose personal information where we have to: to comply with the law, to respond to a lawful request from an authority, or to establish, exercise or defend legal claims.

Advertising and tracking

We run advertising pixels from Meta and Google on the Site. These providers may combine what they learn about your visit with data they already hold, which is how you end up seeing our products elsewhere on the internet.

Under the California Consumer Privacy Act as amended by the CPRA, that activity is very likely a "sale" or "share" of personal information, even though no money changes hands. We treat it as one, and we give you a way out — see the next section.

You can also opt out directly with the platforms: Meta ad settings, Google Ad Center, or industry-wide at the Digital Advertising Alliance and the Network Advertising Initiative. You can opt out of Google Analytics with Google's browser add-on.

Do Not Sell or Share My Personal Information

You have the right to tell us to stop selling or sharing your personal information for cross-context behavioural advertising. You do not need to give a reason, and we will not charge you or treat you differently for asking.

There are two ways to do it:

Email us. Send "Do Not Sell or Share" to support@toka.co from the email address on your order, or tell us the email address and order number to match. We will action it within 15 business days and confirm by email.
Use the Global Privacy Control. If your browser or extension sends a Global Privacy Control (GPC) signal, we treat it as a valid opt-out request for that browser and device, automatically, with no further action needed from you. Because the signal is tied to the browser, you will need it enabled on each browser and device you use.

An authorised agent can make this request for you; we may ask for proof of their authority and for you to verify your identity.

We do not have actual knowledge of selling or sharing the personal information of anyone under 16.

Separately, because there is still no agreed industry standard for how to respond to the older "Do Not Track" browser setting, we do not change our practices in response to a DNT signal. GPC is the signal we act on.

California categories, in plain terms

In the last 12 months we have collected these categories of personal information, and disclosed or shared each of them as described below:

Category	Examples	Disclosed to	Sold or shared for advertising?
Identifiers	Name, email, postal address, phone number, IP address, cookie and device IDs	Shopify, payment processors, carriers and fulfilment partners, SMS, reviews and returns apps, Meta and Google	Yes — cookie and device IDs, and hashed email, to Meta and Google
Customer records	Billing and shipping details, payment information, order history	Shopify, payment processors, carriers and fulfilment partners	No
Commercial information	Products viewed, carted and purchased, returns, reviews	Shopify, reviews and returns apps, Meta and Google	Yes — purchase and browsing events to Meta and Google
Internet and network activity	Pages viewed, search terms, referring site, session behaviour	Shopify, Meta and Google	Yes
Approximate location	Country, region and city inferred from IP address	Shopify, Meta and Google	Yes
Inferences	Audience and interest segments used for advertising	Meta and Google	Yes

We collect all of the above from you directly, from your device automatically, or from the apps and platforms listed in this policy. We do not sell personal information for money, and we do not use or disclose sensitive personal information for purposes that would require us to offer a right to limit.

Your other California rights

You can ask us to tell you what personal information we hold about you and how we use it, to give you a copy, to correct it, or to delete it. Email support@toka.co. We will verify your identity — usually by matching your email address to an order — before we act. We will not discriminate against you for exercising any of these rights.

Your rights in the EU and the UK

If you are in the EEA or the UK, the GDPR and the UK GDPR give you the right to access your personal information, to have it corrected or erased, to restrict or object to how we process it, to withdraw consent at any time, and to receive your data in a portable format. Email support@toka.co and we will respond within one month.

If you are not happy with how we handle your request, you can complain to your data protection authority. In the UK that is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. In the EU it is the supervisory authority in the country where you live or work.

International transfers

We are based in the United States, and our processors operate in the United States, Canada and elsewhere, so your personal information will be transferred out of the EEA and the UK.

Where it is, the transfer is made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for UK data, supplemented by technical and organisational safeguards. Some recipients also rely on an adequacy decision or on the EU-US Data Privacy Framework. You can ask us for details of the mechanism used for a particular transfer.

How long we keep it

Order, payment and tax records: kept for as long as we are required to keep them for tax, accounting and legal-claims purposes.
Marketing contacts: kept until you unsubscribe. After that we keep a minimal suppression record — usually just your email address or phone number — so that we do not contact you again by mistake.
Support emails: kept for as long as needed to resolve the matter and to handle any warranty or return that follows, then deleted.
Cookie and advertising data: governed by the retention periods of the cookies themselves, described below, and by the platforms' own policies.

You can ask us to delete your information sooner — see the rights sections above.

Automated decision-making

We do not engage in fully automated decision-making that produces legal effects concerning you or similarly significantly affects you.

Shopify, our processor, applies limited automated checks to prevent fraud, which do not have a legal or similarly significant effect on you. These include a temporary blocklist of IP addresses linked to repeated failed transactions, which lasts a few hours, and a temporary blocklist of cards linked to those addresses, which lasts a few days.

Cookies

Cookies are small files stored on your device when you visit the Site. We use four kinds:

Strictly necessary — session, cart, checkout and login cookies set by Shopify. The store cannot work without these.
Performance and analytics — Shopify's analytics and Google Analytics, which tell us how the Site is used.
Advertising — Meta and Google pixels, used for measurement and retargeting.
Functional — cookies set by the apps listed above, for example to remember your consent choices or show your review status.

Most of our cookies are persistent and expire between 30 minutes and two years after they are set; session cookies expire when you close your browser.

Where the law requires consent, we ask for it before setting non-essential cookies, and you can change your choice at any time through the cookie preferences control on the Site. You can also block or delete cookies in your browser settings — see allaboutcookies.org for how. Blocking cookies may break parts of the Site, and on its own it does not stop everything described in the advertising section above; use the opt-out routes there as well.

Text message marketing

If you subscribe to Toka text notifications, you agree to receive automated marketing texts from us at the number you gave, sent using an automatic telephone dialling system or similar technology. Message frequency is recurring, consent is not a condition of purchase, and message and data rates may apply.

Reply STOP to opt out and HELP for help. You may get one final text confirming that you have opted out. You can also email support@toka.co and we will remove you.

Our SMS provider is Postscript. Their Messaging Terms and Messaging Privacy Policy also apply.

Children

The Site is not intended for children under 13, and we do not knowingly collect their personal information. If you are a parent or guardian and believe your child has given us personal information, email support@toka.co and we will delete it.

Security

We use Shopify's hosted, PCI-compliant infrastructure, and payment card details are handled by our payment processors rather than by us. No method of transmission or storage is completely secure, so we cannot promise absolute security, but we take it seriously.

Changes to this policy

We may update this policy to reflect changes to our practices or for operational, legal or regulatory reasons. The date below tells you when it last changed.

Contact us

For any privacy question, request or complaint, email support@toka.co, or write to:

Excellent Era LLC (trading as Toka)
10621 Lawson River Ave
Fountain Valley, California 92708
United States

If you are not satisfied with our response, you can complain to your data protection authority, as described above.

Last updated: 26 August 2026