Privacy policy

1. Data controller

The controller of your data is TRAILFOX LTD, a company incorporated in England and Wales (Companies House no. 14926686), with registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Privacy contact: privacidad@hooka.to.

We process your data in accordance with the UK General Data Protection Regulation (UK GDPR) and, when you reside in the European Economic Area, Regulation (EU) 2016/679 (GDPR).

2. What data we process

• Account data: your email and an encrypted (hashed) version of your password.
• TikTok session cookies: when you connect an account we store the session cookies TikTok issues, encrypted, to operate on your behalf. We do not store your TikTok password.
• Lead data: public TikTok usernames (@handles) you import or that the Service collects from public profiles, and the categories you assign to them.
• Campaign and message content: your templates, recipient lists and the conversations managed from the inbox.
• Usage data: technical logs needed to run and secure the Service (e.g. send events, dates, aggregated metrics).
• Payment data: handled by Stripe. We only keep your subscription status and Stripe identifiers, never your card details.

3. Purposes and legal basis

• Providing the Service and managing your account — performance of the contract.
• Processing payments and subscriptions — performance of the contract.
• Sending you operational emails (welcome, password reset, notices) — performance of the contract.
• Security, abuse prevention and improvement of the Service — legitimate interest.
• Complying with legal obligations (e.g. tax) — legal obligation.

4. Who accesses your data (processors)

We work with providers that process data on our behalf, under contract:

• Stripe — payment processing.
• Resend — transactional email delivery.
• Cloudflare — DNS and network security.
• Hosting / server provider where the Service runs and data is stored.
• Backup service (when active).

We do not sell your data or share it with third parties for advertising purposes.

5. International transfers

The controller is based in the United Kingdom and some providers (e.g. Stripe or Resend) may process data outside the European Economic Area or the United Kingdom. In those cases appropriate safeguards apply: adequacy decisions (including the one covering EU–UK transfers) or, failing that, the Standard Contractual Clauses approved by the European Commission and their UK equivalents.

6. Retention

We keep your data while your account is active and, after you cancel, for the applicable legal periods. TikTok session cookies are deleted when you disconnect the account. You can request the erasure of your data once it is no longer needed.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@hooka.to. You can also withdraw your consent where it is the basis for processing and lodge a complaint with the competent supervisory authority: if you reside in Spain, the Spanish Data Protection Agency (aepd.es); in other EEA countries, your local authority; and in the United Kingdom, the Information Commissioner's Office (ico.org.uk).

8. Security

We apply reasonable technical and organizational measures to protect your data: encryption of sensitive credentials, access control and HTTPS communications. No system is 100% foolproof, but we work to minimize the risks.

9. Service cookies

The dashboard itself uses a technical session cookie (httpOnly) to keep you signed in after you log in. It is necessary for operation and is not used for advertising purposes.

10. Minors

The Service is not directed at minors and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. We will publish the current version here and, if the change is significant, notify you by a reasonable means.