Privacy policy

1. Data controller

The controller of your data is TRAILFOX LTD, a company incorporated in England and Wales (Companies House no. 14926686), with registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Privacy contact: privacidad@hooka.to.

We process your data in accordance with the UK General Data Protection Regulation (UK GDPR) and, when you reside in the European Economic Area, Regulation (EU) 2016/679 (GDPR).

2. What data we process

• Account data: your email and an encrypted (hashed) version of your password.
• TikTok session cookies: when you connect an account we store the session cookies TikTok issues, encrypted, to operate on your behalf. We do not store your TikTok password.
• Lead data: public TikTok usernames (@handles) you import or that the Service collects from public profiles, and the categories you assign to them.
• Campaign and message content: your templates, recipient lists and the conversations managed from the inbox.
• Usage data: technical logs needed to run and secure the Service (e.g. send events, dates, aggregated metrics).
• Payment data: handled by Stripe. We only keep your subscription status and Stripe identifiers, never your card details.
• Where your visit to hooka.to came from: the website, campaign, ad or referral link that brought you (details in section 9). We only receive it if you subscribe, together with the payment.

3. Purposes and legal basis

• Providing the Service and managing your account — performance of the contract.
• Processing payments and subscriptions — performance of the contract.
• Sending you operational emails (welcome, password reset, notices) — performance of the contract.
• Security, abuse prevention and improvement of the Service — legitimate interest.
• Complying with legal obligations (e.g. tax) — legal obligation.
• Knowing which channels (search engines, ads, recommendations, referral links) bring us customers, based on where the visit came from — if you visit us from Europe, your consent (we ask before storing anything); otherwise, legitimate interest. You can say no or object as explained in section 9.

4. Who accesses your data (processors)

We work with providers that process data on our behalf, under contract:

• Stripe — payment processing. If you subscribe from hooka.to, where your visit came from travels with the payment as metadata.
• Resend — transactional email delivery.
• Cloudflare — DNS, network security and aggregated, cookieless visit statistics for hooka.to (Cloudflare Web Analytics).
• Hosting / server provider where the Service runs and data is stored.
• Backup service (when active).

We do not sell your data or share it with third parties for advertising purposes.

5. International transfers

The controller is based in the United Kingdom and some providers (e.g. Stripe or Resend) may process data outside the European Economic Area or the United Kingdom. In those cases appropriate safeguards apply: adequacy decisions (including the one covering EU–UK transfers) or, failing that, the Standard Contractual Clauses approved by the European Commission and their UK equivalents.

6. Retention

We keep your data while your account is active and, after you cancel, for the applicable legal periods. TikTok session cookies are deleted when you disconnect the account. You can request the erasure of your data once it is no longer needed. In your browser, each touch of where your visit came from is valid for 90 days: after that it is no longer used and is discarded on your next visit to hooka.to; if you subscribe, it is kept in your customer record while your account is active.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@hooka.to. You can also withdraw your consent where it is the basis for processing and lodge a complaint with the competent supervisory authority: if you reside in Spain, the Spanish Data Protection Agency (aepd.es); in other EEA countries, your local authority; and in the United Kingdom, the Information Commissioner's Office (ico.org.uk).

8. Security

We apply reasonable technical and organizational measures to protect your data: encryption of sensitive credentials, access control and HTTPS communications. No system is 100% foolproof, but we work to minimize the risks.

9. Cookies and storage in your browser

The dashboard itself uses a technical session cookie (httpOnly) to keep you signed in after you log in. It is necessary for operation and is not used for advertising purposes.

The hooka.to website does not use cookies. To know where our customers come from, we store in your browser's local storage (key hooka_attr) your first and your latest touch: the link's campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), ad click identifiers (gclid, fbclid, msclkid), the referral code (ref), the referring website (domain and path, without parameters), the landing page and the date. Each touch is valid for 90 days. Nothing is sent to anyone while you browse: only if you subscribe does it travel with the payment to Stripe as metadata and get saved in your customer record.

If you visit us from Europe (we infer it from your device's time zone), we ask you with a notice before storing anything, and you can say no. Until you answer we store nothing; if you say no, we don't store where your visit came from and only remember your answer (key hooka_attr_consent) so we don't ask again.

To change your answer or object, wherever you are: in Privacy choices (also in the website footer) you can say yes or no at any time, with one click; if you say no, we immediately delete what was stored in your browser and store nothing more. If your browser sends the Global Privacy Control or Do Not Track signal, we store nothing and delete anything already stored. You can also clear hooka.to's site data in your browser (in Europe we'll ask you again; outside Europe, without one of those signals, it would be stored again on your next visit) or write to privacidad@hooka.to so we delete the origin saved in your record.

10. Minors

The Service is not directed at minors and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. We will publish the current version here and, if the change is significant, notify you by a reasonable means.