Tokomono

Privacy Policy

This Privacy Policy applies to the website, customer portal, package distribution (Composer/Satis), and online services offered by Tokomono, established in the Netherlands. We attach great importance to the protection of your personal data and process it strictly in accordance with the General Data Protection Regulation (GDPR / AVG) and applicable European data protection laws.

1. Data Controller & Contact

Tokomono (established in the Netherlands) is the data controller responsible for the processing of personal data as described in this Privacy Policy. If you have any questions about this policy or wish to exercise your privacy rights, please contact us via the Contact page on our platform.

2. No Processing of Your Own Application or Customer Data

A core principle of Tokomono is that our software packages run exclusively on your own servers and within your own infrastructure.

  • We do not collect, read, or process any end-user data, customer data, prompts, or database contents from the applications in which you install our packages.
  • This Privacy Policy therefore applies solely to the data we process when you visit our commercial website, create a Tokomono account, purchase a license, contact us, or interact with our Composer repository and MCP documentation servers.

3. Personal Data We Process and Why

A. Account and Authentication Data

When you register an account on our platform, we process:

  • Data: Name, email address, encrypted (hashed) password, optional two-factor authentication settings (2FA / Passkeys), and your generated API/license keys.
  • Purpose: Providing and securing your personal account dashboard, managing your software licenses, and granting access to our services and issue tracker.
  • Legal basis: Performance of a contract and legitimate interest (information security).

B. Billing and Payment Data

When you purchase or claim a license, we process:

  • Data: Name, company name, street address, postal code, city, country, Chamber of Commerce (KvK) number, VAT identification number, payment status, transaction ID, and invoice records.
  • Purpose: Processing payments, generating and issuing invoices, and complying with statutory accounting and tax obligations.
  • Legal basis: Performance of a contract and compliance with a legal obligation (statutory tax retention).

C. License Verification & Composer / Satis Telemetry

When you download or update packages via Composer (or another package manager) from our repository, we log:

  • Data: License key used, associated email address, authorized domain, IP address, reverse DNS, country code, requested package and version, as well as technical environment metadata (Composer version, PHP version, operating system, and CI indicator).
  • Purpose: Verifying the validity of your license, checking whether the package is hosted or used on the domain name(s) authorized in your account, and preventing unauthorized sharing or abuse of license keys.
  • Legal basis: Performance of the license agreement and legitimate interest (protection of intellectual property and fraud/abuse prevention).

D. Usage of Our MCP Documentation Servers

When you or your AI coding agent connect to Tokomono's hosted MCP documentation servers, we log:

  • Data: Email address, masked API key (retaining only the last characters for identification), IP address, user agent, invoked MCP tool name, submitted query or payload, package version, and response duration.
  • Purpose: Delivering accurate documentation responses, enforcing rate limits, debugging, and securing our MCP infrastructure.
  • Legal basis: Performance of a contract and legitimate interest (security and service quality).

E. Contact Inquiries, Consultancy & Issue Tracker

When you submit a question as an authenticated user via our Contact, Consultancy, or Implementation pages, or create a ticket in the Issue Tracker:

  • Data: Your name, email address, subject/company name, and the content of your message or issue report.
  • Purpose: Answering your inquiry, providing consultancy or implementation support, and resolving reported bugs or support requests.
  • Legal basis: Performance of a contract or pre-contractual steps taken at your request.

F. Website Statistics & Analytics Data

On our commercial website, we collect statistical and analytical data:

  • Data: Page views, navigation paths, conversion funnels, anonymized or pseudonymized usage statistics, and device metadata.
  • Purpose: Gaining insight into sales performance, measuring funnel effectiveness, and continuously improving our website and business operations.
  • Legal basis: Legitimate interest (business optimization) and, where legally required, your consent.

4. Sharing Data with Third Parties (Sub-processors)

We never sell your personal data to third parties. To deliver our services, we only rely on carefully selected categories of service providers (data processors):

  1. Hosting & Cloud Infrastructure: All of our servers, databases, and storage are hosted entirely within the European Union / European Economic Area (EU/EEA).
  2. Payment Processors: To securely process online payments (such as iDEAL, credit card, and business payment methods), we use a certified European payment service provider (such as Mollie).
  3. Transactional Email Service: To send system emails (such as email verification, password resets, invoices, and replies to contact requests), we use a secure transactional email provider within the EU/EEA.
  4. Website Analytics & Statistics: To measure website usage and conversion funnels, we combine our own internal (first-party) database logs and statistics with external analytical services (such as Google Analytics or comparable analytics tools).

We enter into data processing agreements (DPAs) with processors that handle personal data on our behalf to ensure an equivalent level of security and confidentiality.

5. Data Retention Periods

We do not retain your personal data longer than strictly necessary for the purposes for which it was collected:

  • Billing and invoice records: Retained for 7 years following the end of the relevant fiscal year, in compliance with Dutch statutory tax retention laws.
  • Account data: Retained for as long as your Tokomono account remains active. If you delete your account, your profile data is erased or anonymized unless statutory retention obligations apply (such as for invoices).
  • MCP server logs: Automatically and permanently pruned from our database after 3 months.
  • Composer/Satis download logs: Retained for the duration of your license and up to 24 months thereafter for license audits, security, and abuse prevention.
  • Contact messages & Support issues: Retained for as long as necessary to handle your inquiry or maintain software support history.

6. Data Security

Tokomono implements appropriate technical and organizational measures to prevent misuse, loss, unauthorized access, and unlawful disclosure. Our security measures include:

  • Mandatory TLS/HTTPS encryption across all web, Composer, and MCP traffic;
  • Strong cryptographic password hashing and automatic masking of sensitive API keys in request logs;
  • Support for Two-Factor Authentication (2FA / TOTP) and Passkeys (WebAuthn);
  • Strict access controls and rate limiting on sensitive endpoints.

7. Your Rights Under the GDPR

Under the GDPR, you have the right at any time to:

  • Request access to the personal data we process about you;
  • Request rectification (correction or completion) of your data — many details can also be updated directly in your account settings;
  • Request erasure of your personal data ('right to be forgotten'), insofar as we are not legally required to retain it (such as tax records);
  • Request restriction of processing or object to processing based on legitimate interests;
  • Request your data in a structured, commonly used format (data portability).

You can submit any privacy request via our Contact page. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl) or the supervisory authority in your EU member state.

8. Changes to This Privacy Policy

Tokomono may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. The most current version will always be available on this page.

Last updated: October 2026